ISMS Competence and Training Matrix Template (ISO/IEC 27001 7.2)

Role catalogue, competence requirements per role, proficiency scale, gaps, actions, effectiveness evaluation, awareness link, training plan, records

SMSI & ISO/IEC 27001CompletISO/IEC 27001:2022 + Amd 1:2024 clauses 7.2, 7.3, A.5.2, A.6.3 (cited only); ISO/IEC 27021:2017 + Amd 1:2021competence training matrixMis à jour 1 nov. 2026

Ouvrir dans l'éditeurTélécharger .md

Mode d'emploi: Use it when you set up the ISMS, when roles change and before the annual training budget. Fill the role catalogue and the requirements per role first, then assess people against them. The main pitfall is offering awareness completion as proof of competence and never checking whether training worked.

Aperçu

Competence and Training Matrix: [Organization name]

Competence requirements, current levels, gaps, actions and evidence for every role that affects information security performance, plus the link to the awareness programme. It supports ISO/IEC 27001:2022 + Amd 1:2024 clause 7.2 (competence) and clause 7.3 (awareness), and Annex A controls A.6.3 (awareness, education and training) and A.5.2 (security roles and responsibilities). ISO/IEC 27021:2017 + Amd 1:2021 is used as a reference for the competence of ISMS professionals. Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-026
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@isms-manager]
Co-owner	[@hr-lead]
Approvers/reviewers	[@ciso], [@hr-director], [@isms-steering-committee]
Last updated	YYYY-MM-DD
Classification	[Confidential: contains personnel data]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024 (clauses 7.2, 7.3; Annex A A.5.2, A.6.3); ISO/IEC 27021:2017 + Amd 1:2021
Next scheduled review	YYYY-MM-DD
Roles source	DOC-ISMS-006 (roles, responsibilities and RACI)
Assessment period	[YYYY-MM-DD to YYYY-MM-DD]

Approvals

Role	Name	Decision	Date
ISMS manager	[@isms-manager]	[Prepared]	YYYY-MM-DD
HR lead	[@hr-lead]	[Reviewed]	YYYY-MM-DD
Top management	[@coo]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	YYYY-MM-DD	[@isms-manager]	First issue: role catalogue, requirements, baseline assessment
1.1 (Example)	YYYY-MM-DD	[@isms-manager]	Added cloud security requirements after ISMS-CHG-007
[x.y]	YYYY-MM-DD	[@author]	[Change summary]

1. Purpose and scope
2. Competence, awareness and training
3. Role catalogue
4. Competence requirements per role
5. Proficiency scale and assessment method
6. Individual assessment and gaps
7. Actions to close gaps
8. Effectiveness evaluation
9. Awareness programme link
10. Qualifications and certifications
11. Annual training plan
12. Size tiers
13. Records and evidence
14. References
Standard and licence note

1. Purpose and scope

This matrix shows, role by role, what skills keep our information safe, who has them, where the gaps are and how we close them, together with proof that every person in scope has had the basic security briefing. It covers:

employees, contractors, temporary staff and interns working under [Organization name]'s control within the ISMS scope (DOC-ISMS-002);
roles named in the roles and RACI document (DOC-ISMS-006);
suppliers' staff only where they perform an ISMS role on our behalf (for example a managed security service); their competence is otherwise assured through supplier agreements (DOC-ISMS-068).

Item	Value
Population in scope	[Number of persons, split employees / contractors]
Roles with specific security competence	[Number of roles from section 3]
Matrix owner	[@isms-manager], with HR for records
Review frequency	[Annually and on role change]

2. Competence, awareness and training

Concept	What it means here	Clause or control	Applies to	Typical evidence
Competence	The person can actually do the security-relevant parts of the job well, and someone has checked it	7.2	Roles that affect security performance	Qualifications, assessed tasks, work samples, certificates, supervisor sign-off
Awareness	Everyone knows the security rules exist, how their daily work helps or hurts, and what happens if they break the rules	7.3	Everyone in scope	Completion records, attestation, phishing simulation results
Education and training	The means to build competence and awareness	A.6.3	Everyone, depth by role	Course records, attendance, test scores
Role definition	Who is responsible for what	5.3, A.5.2	All ISMS roles	RACI, job descriptions

In practice clause 7.2 becomes a simple loop: write down what good looks like for each role, check each person against it, close any gap in whatever way is quickest and then confirm the gap really closed, and keep proof at every step. Sections 4 to 8 and 13 follow that loop.

3. Role catalogue

Role ID	Role	Security responsibilities (summary)	Typical holders	Criticality
ROLE-01	Top management	Direction, resources, approval of policy, risk acceptance, management review	CEO, executive team	High
ROLE-02	ISMS manager	Runs the ISMS, risk process, documentation, internal coordination	[@isms-manager]	High
ROLE-03	Security engineer or analyst	Monitoring, vulnerability management, incident handling, control operation	Security team	High
ROLE-04	System and cloud administrator	Secure configuration, access, backup, logging	Platform team	High
ROLE-05	Software developer	Secure coding, code review, dependency management	Engineering	Medium
ROLE-06	Risk owner and asset owner	Owning risks and assets, approving treatment, reviewing access	Department heads	Medium
ROLE-07	Internal auditor	Planning and performing ISMS audits impartially	Trained staff or external	Medium
ROLE-08	Incident response team member	Triage, containment, communication, evidence	Rota from IT and security	High
ROLE-09	HR and people managers	Screening, contracts, onboarding, disciplinary process, offboarding	HR, line managers	Medium
ROLE-10	Privacy lead or DPO	Personal data protection, breach assessment, data subject requests	[@privacy-lead]	Medium
ROLE-11	Supplier manager	Supplier assessment, contracts, monitoring	Procurement	Medium
ROLE-12	All staff and contractors	Following policies, reporting events, protecting information	Everyone	Baseline

4. Competence requirements per role

Required minimum levels (0 to 4, see section 5). A dash means the area is not required for the role.

Competence area	ROLE-01	ROLE-02	ROLE-03	ROLE-04	ROLE-05	ROLE-06	ROLE-07	ROLE-08	ROLE-09	ROLE-10	ROLE-11	ROLE-12
ISMS requirements (clauses 4 to 10)	1	4	2	1	1	2	3	1	1	2	1	1
Risk assessment and treatment	2	4	3	2	1	3	2	1	-	2	2	-
Annex A controls relevant to the role	1	3	3	3	2	2	3	2	2	2	2	1
Secure configuration and hardening	-	1	3	3	1	-	-	2	-	-	-	-
Secure development	-	1	2	1	3	-	-	1	-	-	-	-
Incident handling	1	2	3	2	1	1	-	3	1	2	1	1
Audit techniques	-	2	1	-	-	-	3	-	-	1	1	-
Privacy and data protection	1	2	1	1	1	1	1	1	2	4	2	1
Supplier security	1	2	1	1	-	1	1	-	-	2	3	-
Legal and contractual requirements	2	2	1	-	-	1	1	1	2	3	2	-
Leadership and communication	3	3	1	1	-	2	2	2	2	2	1	-

4.1 How requirements were set

Requirements come from:

the responsibilities assigned in DOC-ISMS-006;
risks in the risk register (DOC-ISMS-016) where human error or lack of skill is a vulnerability, for example misconfiguration of cloud storage;
legal and contractual obligations in the legal register (DOC-ISMS-014), for example a customer contract that requires annual security training or a regulation that requires training of the management body (NIS2 Article 20 is one example);
ISO/IEC 27021:2017 + Amd 1:2021 as a reference for ISMS professional roles (ROLE-02, ROLE-07), and the NICE Framework (NIST SP 800-181 Rev. 1) as an optional reference for technical work roles.

5. Proficiency scale and assessment method

Level	Label	Description	How it is shown
0	None	No knowledge of the area	Not applicable
1	Aware	Knows the concepts and where to find rules and help	Awareness course passed, attestation
2	Working	Performs routine tasks with guidance	Supervised tasks completed, internal training passed
3	Practitioner	Performs tasks independently and handles exceptions	Assessed work samples, relevant certificate or course with exam, 12 months' experience (Example)
4	Expert	Designs, teaches and improves the area; judged by peers	Recognised qualification plus several years' experience, leads the process

Assessment method by role criticality:

Criticality	Method	Assessor	Frequency
High	Evidence review plus a structured interview or practical test	Line manager plus ISMS manager	Annually and on role change
Medium	Evidence review plus manager confirmation	Line manager	Annually
Baseline	Awareness completion and attestation	Automated record, HR	Annually and at onboarding

6. Individual assessment and gaps

Assessment ID	Person	Role	Competence area	Required	Assessed	Gap	Evidence	Action ID
CMP-001 (Example)	[Person A]	ROLE-02 ISMS manager	ISMS requirements	4	3	1	Lead implementer course booked; 2 years running ISO 9001 system	ACT-001
CMP-002 (Example)	[Person A]	ROLE-02 ISMS manager	Audit techniques	2	2	0	Internal auditor course certificate YYYY-MM-DD	None
CMP-003 (Example)	[Person B]	ROLE-04 Cloud administrator	Secure configuration	3	2	1	Configuration review found 4 deviations from baseline	ACT-002
CMP-004 (Example)	[Person C]	ROLE-07 Internal auditor	Audit techniques	3	1	2	No audit training or experience	ACT-003
CMP-005 (Example)	[Person D]	ROLE-05 Developer	Secure development	3	3	0	Secure code review samples, course exam passed	None
CMP-006 (Example)	[Person E]	ROLE-01 Top management	Risk assessment	2	1	1	No prior exposure	ACT-004

Summary (Example, Quillmere Analytics Ltd baseline): 6 rows shown, 4 with a gap, total gap points 1 + 1 + 2 + 1 = 5.

7. Actions to close gaps

Option	Use when	Example
Formal training or course	A defined body of knowledge exists	Lead implementer, internal auditor, cloud security course
Mentoring or shadowing	Skill is learned by doing	A new incident responder shadows three incidents
On-the-job assignment	Practice under supervision closes the gap	Running a risk workshop with the ISMS manager present
Hiring	The gap is large and permanent	Recruiting a security engineer
Contracting competent people	The need is temporary or specialised	External internal auditor for the first audit cycle
Reassignment	Another person already has the competence	Moving firewall changes to a trained administrator

Action ID	Assessment IDs	Action	Owner	Target date	Effectiveness check	Status
ACT-001 (Example)	CMP-001	Lead implementer course with exam	[Person A]	2027-03-31	Exam result plus internal audit of ISMS documents finds no major gaps	Booked
ACT-002 (Example)	CMP-003	Cloud hardening course plus 3 peer-reviewed configurations	[Person B]	2027-02-28	Next configuration review shows no baseline deviations	In progress
ACT-003 (Example)	CMP-004	Internal auditor course, then co-audit with an external auditor	[Person C]	2027-04-30	Co-auditor rates audit report and interview technique at level 3	Planned
ACT-004 (Example)	CMP-006	2-hour risk briefing for the leadership team	[@isms-manager]	2027-01-31	Leadership team reviews the risk register and makes acceptance decisions in management review	Done

8. Effectiveness evaluation

Level	Question	Method (Example)	When
Reaction	Did participants find it relevant?	Short feedback form	End of the activity
Learning	Did they acquire the knowledge or skill?	Exam, quiz, practical test	End of the activity
Behaviour	Do they apply it at work?	Work samples, peer review, supervisor observation, configuration review results	1 to 3 months later
Results	Did security performance improve?	Fewer related incidents, audit findings or baseline deviations; metrics in DOC-ISMS-080	Next measurement cycle

Rules:

For High-criticality roles, evaluate at least at the behaviour level.
When an action is not effective, choose another option in section 7; do not repeat the same course by default.
Report effectiveness results to management review as part of the resources and competence input.

9. Awareness programme link

The awareness programme is run under the Security Awareness Program (security/security-awareness-program) and the Phishing simulation plan (isms/phishing-simulation-plan, DOC-ISMS-074). This matrix holds the requirement (ROLE-12, level 1 in the relevant areas) and the completion evidence.

Awareness topic	Covers (clause 7.3)	Delivery	Frequency	Audience
Information security policy and handbook	Policy	Onboarding session, employee security handbook (DOC-ISMS-073)	Onboarding and annually	All
Reporting security events	Contribution	Short module, poster, intranet page (DOC-ISMS-023)	Onboarding and annually	All
Phishing and social engineering	Contribution	Module plus simulations	Annually, simulations quarterly (Example)	All
Consequences of not following requirements	Implications	Handbook section, disciplinary process summary (DOC-ISMS-052)	Onboarding and annually	All
Role-based briefings	Contribution	Targeted sessions for developers, administrators, HR, finance	Annually	By role

Completion (Example, Quillmere Analytics Ltd): 44 of 46 persons in scope completed annual awareness by the due date (95.7%); the 2 outstanding were contractors on leave, completed within 14 days of return.

10. Qualifications and certifications

Examples of qualifications accepted as evidence, by role. Names are cited as examples only; equivalent qualifications or demonstrated experience are accepted.

Role	Examples of acceptable evidence
ISMS manager	ISO/IEC 27001 lead implementer course with exam under a personnel certification scheme (for example one operated under ISO/IEC 17024); CISM (ISACA); several years running a management system
Internal auditor	ISO/IEC 27001 internal or lead auditor course with exam; audit training aligned with ISO 19011:2026; CISA (ISACA)
Security engineer or analyst	CISSP (ISC2); vendor-neutral security certifications; demonstrated incident handling experience
Cloud administrator	Cloud provider security certifications for the platform in use; reviewed configuration work
Developer	Secure coding course with assessment; reviewed pull requests showing secure patterns
Privacy lead	Recognised privacy qualification; experience with data protection impact assessments

ISO/IEC 27021:2017 + Amd 1:2021 describes competence requirements for ISMS professionals (knowledge and skills for running and auditing an ISMS). Use it to structure requirements for ROLE-02 and ROLE-07; read the official text for its content.

11. Annual training plan

Training plan (Example, Quillmere Analytics Ltd, USD; use local currency):

Plan ID	Activity	Participants	Unit cost	Total	Quarter
TRN-001 (Example)	ISO/IEC 27001 lead implementer course	1	2,500	2,500	Q1
TRN-002 (Example)	Internal auditor course	2	1,200	2,400	Q1
TRN-003 (Example)	Secure coding course	20	150	3,000	Q2
TRN-004 (Example)	Cloud security certification preparation	2	900	1,800	Q2
TRN-005 (Example)	Awareness platform licence	46	25	1,150	Q1
Total				10,850

Approved budget reference: [DOC-ISMS-031, budget and resource plan, line reference].

12. Size tiers

Aspect	Small: Quillmere Analytics Ltd (46 staff: 38 employees, 8 contractors)	Medium: Quillmere Health Systems (320 staff)	Large: Quillmere Group (2,400 staff, 6 sites)
Roles in the catalogue	About 8; one person often holds several roles (the 0.5 FTE ISMS manager is also Head of Engineering Operations)	All 12 roles, plus clinical safety and service desk roles	All 12 roles plus OT engineer, site ISMS coordinator, plant safety roles
Format	This document as a spreadsheet-style table	HR system fields plus this matrix for security roles	Learning management system with role curricula; this matrix as the requirement source
Internal auditor competence	External auditor or a trained peer from another team for the first cycle	Two trained internal auditors, rotated for impartiality	Pool of auditors across sites, auditing other sites
Awareness	One annual module, phishing simulation, handbook	Role-based modules, clinical data handling for hospital-facing staff	Localised content in site languages, OT safety and security briefings
Effectiveness evaluation	Exam results and configuration reviews	Plus metrics trend in DOC-ISMS-080	Plus site comparison and integrated reporting with ISO 9001 and ISO 22301 competence records
Typical gap drivers	Certification target in 6 months, first enterprise customers	27001 in 10 months, 27701 extension the year after	Phased site certification over 15 months, OT security skills

13. Records and evidence

Record	Proves	Owner	Location	Retention (Example)
This matrix (requirements and assessments)	Competence is determined, assessed and evidenced (7.2 a, b, d)	ISMS manager	[Restricted folder]	Current version plus previous [3] versions
Certificates, transcripts, CVs	Competence through education, training or experience (7.2 b, d)	HR	HR system	Duration of employment plus [period set by HR policy]
Action records (section 7)	Actions taken to acquire competence (7.2 c)	Line managers	[Learning system or folder]	[3] years
Effectiveness evaluations	Actions were evaluated (7.2 c)	ISMS manager	Attached to action records	[3] years
Awareness completion and attestations	Awareness (7.3), A.6.3	HR	Learning system	[3] years
Phishing simulation results (aggregated)	Awareness effectiveness	Security team	DOC-ISMS-074 records	[2] years
Training plan and budget approval	Resources provided (7.1)	ISMS manager	DOC-ISMS-031	[3] years

Map these records to clauses 7.2 and 7.3 and controls A.6.3 and A.5.2 in the control evidence matrix (isms/control-evidence-matrix, DOC-ISMS-033).

14. References

Reference	Edition	Use
ISO/IEC 27001:2022 + Amd 1:2024	Current; Amd 1 published 2024-02-23	Clauses 7.1, 7.2, 7.3; Annex A A.5.2, A.6.3 (cited only)
ISO/IEC 27002:2022	Current	Guidance for A.6.3
ISO/IEC 27021:2017 + Amd 1:2021	Current	Competence of ISMS professionals
ISO 19011:2026	Current, published 2026-05-27	Auditor competence and evaluation
NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program	September 2024, https://csrc.nist.gov/pubs/sp/800/50/r1/final	Optional reference for learning programmes
NIST SP 800-181 Rev. 1, Workforce Framework for Cybersecurity (NICE Framework)	November 2020, https://csrc.nist.gov/pubs/sp/800/181/r1/final; components maintained separately by NIST	Optional reference for technical work roles
Directive (EU) 2022/2555 (NIS2), Article 20	2022	Example of a legal training duty for management bodies

Related templates: Security awareness program (security/security-awareness-program), Phishing simulation plan (isms/phishing-simulation-plan, DOC-ISMS-074), Employee security handbook (isms/employee-security-handbook, DOC-ISMS-073), Roles, responsibilities and RACI (isms/isms-roles-raci, DOC-ISMS-006), Onboarding checklist (ops/onboarding-checklist), Budget and resource plan (isms/isms-budget-resource-plan, DOC-ISMS-031), Internal audit programme (compliance/internal-audit-program, DOC-ISMS-082).

Official texts: ISO/IEC 27001:2022 https://www.iso.org/standard/82875.html, Amd 1:2024 https://www.iso.org/standard/88435.html, ISO/IEC 27002:2022 https://www.iso.org/standard/75652.html, ISO/IEC 27021:2017 https://www.iso.org/standard/61003.html, ISO 19011:2026 https://www.iso.org/standard/88984.html.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 7.2 and 7.3, Annex A controls A.5.2 and A.6.3), with ISO/IEC 27021:2017 + Amd 1:2021 and ISO 19011:2026 as references. NIST SP 800-50 Rev. 1 and NIST SP 800-181 Rev. 1 are US government works cited as optional references. Certification names (CISSP, CISM, CISA) are cited by name only as examples, with no endorsement. Clause and control numbers are cited with original paraphrases; the role catalogue, scale, matrix and examples are original, and no ISO/IEC text is reproduced. You need the official standards to implement and audit the requirements. Check the current editions before use. Quillmere organisations, persons and figures are fictional examples. Template licence: MIT.

Modèles associés

SMSI & ISO/IEC 27001