Sub-clauses
- 7.1 Resources
- 7.2 Competence
- 7.3 Awareness
- 7.4 Communication
- 7.5 Documented information
Why it matters
The unglamorous plumbing — do people have what they need, do they know what's expected of them, is anything actually written down and controlled.
What it requires
Adequate resources for the ISMS; competence records for security-relevant roles; staff awareness of the policy and their responsibilities; a communication plan; a controlled set of documents.
How a self-led small team handles it
A simple training log and a document register cover most of this at small scale. Resist building heavy processes for a five-person team — proportionate beats thorough here.
Track Clause 7 directly — itsbestpractice has a dedicated Support section built around exactly this clause.
Start your ISMS