ISO 27001 clause 7: The clause that keeps your ISMS running when people leave

What clause 7 covers

Five parts. Each one takes only a few lines in the standard, and each has a job.

• 7.1 Resources. The people, time and budget the ISMS needs.
• 7.2 Competence. The people doing security work can do it, and you can show why.
• 7.3 Awareness. Everyone else knows enough to not be the weak point.
• 7.4 Communication. You have decided what gets communicated, when, to whom and how.
• 7.5 Documented information. Your rules and your evidence are current, findable and controlled.

Resources

The shortest requirement in the clause and the easiest to wave through. You have to work out what the ISMS needs and then provide it: someone's hours, a budget line for training or tooling, and time in the calendar for the work.

The decision itself belongs to management, which is why this links straight back to what the standard requires from management. What clause 7 adds is the practical test: if the person responsible for security has no hours reserved for it, that is a second job squeezed into a full week, and an auditor will treat it as a resourcing gap.

Competence and awareness, which are different things

This is the pair people get wrong, and the distinction is worth two minutes.

Competence (7.2) applies to the people whose work affects information security: whoever runs access reviews, whoever manages the firewall, whoever handles incidents. For each of those, the standard asks you to decide what competence the role needs, make sure the person has it through education, training or experience, and keep evidence of it. If you had to train someone to close a gap, you also have to check afterwards whether the training worked.

In practice the evidence is ordinary: a certificate, a CV showing five years of doing the job, a record of an internal handover, or a test result. One line per role in a table is enough. The common finding has nothing to do with people being incompetent. It is that nobody wrote down what the role required, so there is nothing to compare anyone against.

Awareness (7.3) applies to everyone who works under your control, including contractors. Three things, and the standard names all three: they know the information security policy exists and roughly what it says, they know how their own work contributes, and they know what happens if they ignore the rules.

That last point sounds heavy-handed until you see what it prevents: a developer moving customer data to a personal drive because it was faster, when someone who understood the rule would have asked first.

Here is the part that catches teams out. An auditor does not check awareness by looking at your training platform. They ask someone. "What would you do if a supplier emailed asking to change their bank details?" If three people give three different answers, your completion rate of 100 percent proves nothing. If nobody in your team can run that session credibly yet, an external security lead can until someone can.

Communication

Clause 7.4 asks you to decide four things: what you communicate about security, when, with whom, and how. That applies both inside the company and outside it.

Most companies have the internal half by accident: a channel for security questions, a line in onboarding. The external half is where the gap sits. If you had an incident on a Friday night, who tells the customer, in what timeframe, and who signs off the wording? Writing that down before it happens is the whole requirement, and it is the difference between a calm email and a panicked one.

A short table does the job. One row per thing you communicate, four columns for what, when, to whom and how.

Documented information

ISO 27001 uses one phrase, "documented information", for two different things.

Documents are the rules: your policies, procedures, the scope statement. They tell people what to do.

Records are the proof: the completed access review, the training log, the minutes of a management review. They show something happened.

Both have to be controlled, and the standard is specific about what that means. When you create or update something, it needs to be identifiable (a title, a date, an author), in a usable format, and reviewed and approved by someone before it counts. Once it exists, it has to be available where people need it, protected from being lost or changed by the wrong person, kept legible, version controlled, and kept for as long as you decided and then disposed of.

Two practical traps:

Retention. If your rule says you keep access review records for three years, deleting them after one is a finding. So is having no rule at all, which usually surfaces when an auditor asks for last year's records and they are gone.

Documents from outside. Supplier audit reports, customer contract requirements, the legal register: anything from outside that your system depends on has to be identified and controlled too. Downloading a supplier's SOC 2 report into someone's personal drive does not count.

Keeping this tidy is also what makes the certification audit short, which is why getting your evidence organised early tends to pay for itself.

What an auditor checks

Clause 7 findings are rarely dramatic. They look like this:

• Security training completed by everyone, with no record of who did it or when.
• A policy in use with no version number, no approval date, and a second copy in a different folder saying something different.
• No written competence requirement for the person running the ISMS.
• Staff who cannot say where the security policy lives or what it asks of them.
• Records that were deleted before the retention period ended, or kept with no period defined.
• A supplier's assurance report that nobody can find.

None of these takes long to fix. They take longer to fix under audit pressure than they would have taken in a quiet week in advance.

Where to start

1. List the roles whose work affects information security, and write one line per role saying what the role needs to know. That list is your competence requirement.
2. For each of those people, note the evidence you already hold: a certificate, experience, a training record. Most of it exists already, it has just never been collected in one place.
3. Write the three awareness points into your onboarding, and test them once by asking three people a real question.
4. Fill in a four column communication table: what, when, to whom, how. Include at least one external row for incidents.
5. Go through your policies for a title, an owner, a version, an approval date and a retention rule. Fix the ones that are missing them and delete the duplicates.

What's next?

Resources, the policy and the objectives all come from the top, so what the standard requires from management covers where clause 7 gets its budget and direction. And because awareness is tested by asking people rather than reading documents, your internal audit is the place to rehearse it. How an internal audit actually works walks through that trial run before a certification auditor does it for real.