# Competence and Training Matrix: [Organization name]

> Competence requirements, current levels, gaps, actions and evidence
> for every role that affects information security performance, plus
> the link to the awareness programme. It supports ISO/IEC 27001:2022 +
> Amd 1:2024 clause 7.2 (competence) and clause 7.3 (awareness), and
> Annex A controls A.6.3 (awareness, education and training) and A.5.2
> (security roles and responsibilities). ISO/IEC 27021:2017 + Amd
> 1:2021 is used as a reference for the competence of ISMS
> professionals. Replace every `[bracketed]` value and every row marked
> *Example*.

<!--
Guidance: How to use this template
- Use it when you set up the ISMS, when a role is created or changes,
  and once a year before you plan the training budget.
- Fill section 3 (role catalogue) first, from the roles and RACI
  document (DOC-ISMS-006). Then set requirements per role (section 4)
  before you assess any person: requirements set after assessment get
  bent to fit the people you already have.
- Main pitfall: confusing awareness with competence. A completed
  awareness course shows a person knows the policy exists; it does not
  show a firewall administrator can configure a firewall securely.
  Under clause 7.2 an auditor will ask how you know a course or
  mentoring actually closed the gap, not only that it took place.
- Clause 7.2 requires documented information as evidence of
  competence. Keep certificates, assessments and sign-offs, not just a
  spreadsheet with ticks.
- Related templates: `security/security-awareness-program`,
  `isms/phishing-simulation-plan`, `isms/employee-security-handbook`,
  `isms/isms-roles-raci`, `ops/onboarding-checklist`,
  `isms/isms-budget-resource-plan`, `isms/control-evidence-matrix`.
-->

## Document control

<!-- Guidance: The matrix contains personal data about staff (names, assessment results). Classify it accordingly, limit access to managers, HR and the ISMS manager, and apply your retention rules for personnel records. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-026 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Co-owner | [@hr-lead] |
| Approvers/reviewers | [@ciso], [@hr-director], [@isms-steering-committee] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential: contains personnel data] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 (clauses 7.2, 7.3; Annex A A.5.2, A.6.3); ISO/IEC 27021:2017 + Amd 1:2021 |
| Next scheduled review | YYYY-MM-DD |
| Roles source | DOC-ISMS-006 (roles, responsibilities and RACI) |
| Assessment period | [YYYY-MM-DD to YYYY-MM-DD] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| HR lead | [@hr-lead] | [Reviewed] | YYYY-MM-DD |
| Top management | [@coo] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | First issue: role catalogue, requirements, baseline assessment |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Added cloud security requirements after ISMS-CHG-007 |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

- [1. Purpose and scope](#1-purpose-and-scope)
- [2. Competence, awareness and training](#2-competence-awareness-and-training)
- [3. Role catalogue](#3-role-catalogue)
- [4. Competence requirements per role](#4-competence-requirements-per-role)
- [5. Proficiency scale and assessment method](#5-proficiency-scale-and-assessment-method)
- [6. Individual assessment and gaps](#6-individual-assessment-and-gaps)
- [7. Actions to close gaps](#7-actions-to-close-gaps)
- [8. Effectiveness evaluation](#8-effectiveness-evaluation)
- [9. Awareness programme link](#9-awareness-programme-link)
- [10. Qualifications and certifications](#10-qualifications-and-certifications)
- [11. Annual training plan](#11-annual-training-plan)
- [12. Size tiers](#12-size-tiers)
- [13. Records and evidence](#13-records-and-evidence)
- [14. References](#14-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Purpose and scope

<!-- Guidance: Name who is covered. Clause 7.2 reaches everyone whose work you direct, which includes contractors and temporary staff, not only employees. Auditors check that contractors with privileged access appear in the matrix. -->

This matrix shows, role by role, what skills keep our information safe,
who has them, where the gaps are and how we close them, together with
proof that every person in scope has had the basic security briefing.
It covers:

- employees, contractors, temporary staff and interns working under
  [Organization name]'s control within the ISMS scope (DOC-ISMS-002);
- roles named in the roles and RACI document (DOC-ISMS-006);
- suppliers' staff only where they perform an ISMS role on our behalf
  (for example a managed security service); their competence is
  otherwise assured through supplier agreements (DOC-ISMS-068).

| Item | Value |
|---|---|
| Population in scope | [Number of persons, split employees / contractors] |
| Roles with specific security competence | [Number of roles from section 3] |
| Matrix owner | [@isms-manager], with HR for records |
| Review frequency | [Annually and on role change] |

## 2. Competence, awareness and training

<!-- Guidance: Use this section to stop the most common audit finding in this area: an awareness course offered as evidence of competence. Explain the difference to managers in one table. -->

| Concept | What it means here | Clause or control | Applies to | Typical evidence |
|---|---|---|---|---|
| Competence | The person can actually do the security-relevant parts of the job well, and someone has checked it | 7.2 | Roles that affect security performance | Qualifications, assessed tasks, work samples, certificates, supervisor sign-off |
| Awareness | Everyone knows the security rules exist, how their daily work helps or hurts, and what happens if they break the rules | 7.3 | Everyone in scope | Completion records, attestation, phishing simulation results |
| Education and training | The means to build competence and awareness | A.6.3 | Everyone, depth by role | Course records, attendance, test scores |
| Role definition | Who is responsible for what | 5.3, A.5.2 | All ISMS roles | RACI, job descriptions |

In practice clause 7.2 becomes a simple loop: write down what good
looks like for each role, check each person against it, close any gap
in whatever way is quickest and then confirm the gap really closed, and
keep proof at every step. Sections 4 to 8 and 13 follow that loop.

```mermaid
flowchart LR
  A["Define role requirements (section 4)"] --> B["Assess people (section 6)"]
  B --> C{"Gap?"}
  C -->|No| F["Record evidence (section 13)"]
  C -->|Yes| D["Act: train, mentor, hire, reassign (section 7)"]
  D --> E["Evaluate effectiveness (section 8)"]
  E -->|Not effective| D
  E -->|Effective| F
  F --> G["Annual review or role change"]
  G --> A
```

## 3. Role catalogue

<!-- Guidance: List roles, not people. Keep the list aligned with DOC-ISMS-006 so the same role names appear in both. Common pitfall: listing only the security team and forgetting system owners, developers, HR and top management, whose decisions affect security too. -->

| Role ID | Role | Security responsibilities (summary) | Typical holders | Criticality |
|---|---|---|---|---|
| ROLE-01 | Top management | Direction, resources, approval of policy, risk acceptance, management review | CEO, executive team | High |
| ROLE-02 | ISMS manager | Runs the ISMS, risk process, documentation, internal coordination | [@isms-manager] | High |
| ROLE-03 | Security engineer or analyst | Monitoring, vulnerability management, incident handling, control operation | Security team | High |
| ROLE-04 | System and cloud administrator | Secure configuration, access, backup, logging | Platform team | High |
| ROLE-05 | Software developer | Secure coding, code review, dependency management | Engineering | Medium |
| ROLE-06 | Risk owner and asset owner | Owning risks and assets, approving treatment, reviewing access | Department heads | Medium |
| ROLE-07 | Internal auditor | Planning and performing ISMS audits impartially | Trained staff or external | Medium |
| ROLE-08 | Incident response team member | Triage, containment, communication, evidence | Rota from IT and security | High |
| ROLE-09 | HR and people managers | Screening, contracts, onboarding, disciplinary process, offboarding | HR, line managers | Medium |
| ROLE-10 | Privacy lead or DPO | Personal data protection, breach assessment, data subject requests | [@privacy-lead] | Medium |
| ROLE-11 | Supplier manager | Supplier assessment, contracts, monitoring | Procurement | Medium |
| ROLE-12 | All staff and contractors | Following policies, reporting events, protecting information | Everyone | Baseline |

## 4. Competence requirements per role

<!-- Guidance: For each role, write the competence areas and the minimum proficiency level (section 5). Be specific enough that an assessor can test it. "Knows security" cannot be assessed; "can run a risk workshop using DOC-ISMS-010" can. An auditor picks a role and asks how you decided its requirements. -->

Required minimum levels (0 to 4, see section 5). A dash means the area
is not required for the role.

| Competence area | ROLE-01 | ROLE-02 | ROLE-03 | ROLE-04 | ROLE-05 | ROLE-06 | ROLE-07 | ROLE-08 | ROLE-09 | ROLE-10 | ROLE-11 | ROLE-12 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ISMS requirements (clauses 4 to 10) | 1 | 4 | 2 | 1 | 1 | 2 | 3 | 1 | 1 | 2 | 1 | 1 |
| Risk assessment and treatment | 2 | 4 | 3 | 2 | 1 | 3 | 2 | 1 | - | 2 | 2 | - |
| Annex A controls relevant to the role | 1 | 3 | 3 | 3 | 2 | 2 | 3 | 2 | 2 | 2 | 2 | 1 |
| Secure configuration and hardening | - | 1 | 3 | 3 | 1 | - | - | 2 | - | - | - | - |
| Secure development | - | 1 | 2 | 1 | 3 | - | - | 1 | - | - | - | - |
| Incident handling | 1 | 2 | 3 | 2 | 1 | 1 | - | 3 | 1 | 2 | 1 | 1 |
| Audit techniques | - | 2 | 1 | - | - | - | 3 | - | - | 1 | 1 | - |
| Privacy and data protection | 1 | 2 | 1 | 1 | 1 | 1 | 1 | 1 | 2 | 4 | 2 | 1 |
| Supplier security | 1 | 2 | 1 | 1 | - | 1 | 1 | - | - | 2 | 3 | - |
| Legal and contractual requirements | 2 | 2 | 1 | - | - | 1 | 1 | 1 | 2 | 3 | 2 | - |
| Leadership and communication | 3 | 3 | 1 | 1 | - | 2 | 2 | 2 | 2 | 2 | 1 | - |

### 4.1 How requirements were set

Requirements come from:

1. the responsibilities assigned in DOC-ISMS-006;
2. risks in the risk register (DOC-ISMS-016) where human error or lack
   of skill is a vulnerability, for example misconfiguration of cloud
   storage;
3. legal and contractual obligations in the legal register
   (DOC-ISMS-014), for example a customer contract that requires
   annual security training or a regulation that requires training of
   the management body (NIS2 Article 20 is one example);
4. ISO/IEC 27021:2017 + Amd 1:2021 as a reference for ISMS professional
   roles (ROLE-02, ROLE-07), and the NICE Framework (NIST SP 800-181
   Rev. 1) as an optional reference for technical work roles.

## 5. Proficiency scale and assessment method

<!-- Guidance: Use one scale for the whole organisation. Define how each level is shown, so a manager rating their own team cannot inflate scores. Pitfall: self-assessment only. Combine it with evidence or a second assessor for High-criticality roles. -->

| Level | Label | Description | How it is shown |
|---|---|---|---|
| 0 | None | No knowledge of the area | Not applicable |
| 1 | Aware | Knows the concepts and where to find rules and help | Awareness course passed, attestation |
| 2 | Working | Performs routine tasks with guidance | Supervised tasks completed, internal training passed |
| 3 | Practitioner | Performs tasks independently and handles exceptions | Assessed work samples, relevant certificate or course with exam, 12 months' experience *(Example)* |
| 4 | Expert | Designs, teaches and improves the area; judged by peers | Recognised qualification plus several years' experience, leads the process |

Assessment method by role criticality:

| Criticality | Method | Assessor | Frequency |
|---|---|---|---|
| High | Evidence review plus a structured interview or practical test | Line manager plus ISMS manager | Annually and on role change |
| Medium | Evidence review plus manager confirmation | Line manager | Annually |
| Baseline | Awareness completion and attestation | Automated record, HR | Annually and at onboarding |

## 6. Individual assessment and gaps

<!-- Guidance: Record one row per person and competence area where a requirement exists. Show the required level, the assessed level and the evidence. Only rows with a gap need an action. Keep this table restricted: it contains personal data. -->

| Assessment ID | Person | Role | Competence area | Required | Assessed | Gap | Evidence | Action ID |
|---|---|---|---|---|---|---|---|---|
| CMP-001 *(Example)* | [Person A] | ROLE-02 ISMS manager | ISMS requirements | 4 | 3 | 1 | Lead implementer course booked; 2 years running ISO 9001 system | ACT-001 |
| CMP-002 *(Example)* | [Person A] | ROLE-02 ISMS manager | Audit techniques | 2 | 2 | 0 | Internal auditor course certificate YYYY-MM-DD | None |
| CMP-003 *(Example)* | [Person B] | ROLE-04 Cloud administrator | Secure configuration | 3 | 2 | 1 | Configuration review found 4 deviations from baseline | ACT-002 |
| CMP-004 *(Example)* | [Person C] | ROLE-07 Internal auditor | Audit techniques | 3 | 1 | 2 | No audit training or experience | ACT-003 |
| CMP-005 *(Example)* | [Person D] | ROLE-05 Developer | Secure development | 3 | 3 | 0 | Secure code review samples, course exam passed | None |
| CMP-006 *(Example)* | [Person E] | ROLE-01 Top management | Risk assessment | 2 | 1 | 1 | No prior exposure | ACT-004 |

Summary *(Example, Quillmere Analytics Ltd baseline)*: 6 rows shown,
4 with a gap, total gap points 1 + 1 + 2 + 1 = 5.

## 7. Actions to close gaps

<!-- Guidance: Training is one option among several. Under clause 7.2 you can also pair someone with an expert, move work to a person who already has the skill, or bring the skill in through a hire or a contractor. Choose the fastest option that works, and record a target date and how you will check it worked. -->

| Option | Use when | Example |
|---|---|---|
| Formal training or course | A defined body of knowledge exists | Lead implementer, internal auditor, cloud security course |
| Mentoring or shadowing | Skill is learned by doing | A new incident responder shadows three incidents |
| On-the-job assignment | Practice under supervision closes the gap | Running a risk workshop with the ISMS manager present |
| Hiring | The gap is large and permanent | Recruiting a security engineer |
| Contracting competent people | The need is temporary or specialised | External internal auditor for the first audit cycle |
| Reassignment | Another person already has the competence | Moving firewall changes to a trained administrator |

| Action ID | Assessment IDs | Action | Owner | Target date | Effectiveness check | Status |
|---|---|---|---|---|---|---|
| ACT-001 *(Example)* | CMP-001 | Lead implementer course with exam | [Person A] | 2027-03-31 | Exam result plus internal audit of ISMS documents finds no major gaps | Booked |
| ACT-002 *(Example)* | CMP-003 | Cloud hardening course plus 3 peer-reviewed configurations | [Person B] | 2027-02-28 | Next configuration review shows no baseline deviations | In progress |
| ACT-003 *(Example)* | CMP-004 | Internal auditor course, then co-audit with an external auditor | [Person C] | 2027-04-30 | Co-auditor rates audit report and interview technique at level 3 | Planned |
| ACT-004 *(Example)* | CMP-006 | 2-hour risk briefing for the leadership team | [@isms-manager] | 2027-01-31 | Leadership team reviews the risk register and makes acceptance decisions in management review | Done |

## 8. Effectiveness evaluation

<!-- Guidance: This is the step most often missing. Evaluate the result, not the attendance. Choose a method in advance and record it with the action. An auditor will ask "how do you know the training worked?". -->

| Level | Question | Method *(Example)* | When |
|---|---|---|---|
| Reaction | Did participants find it relevant? | Short feedback form | End of the activity |
| Learning | Did they acquire the knowledge or skill? | Exam, quiz, practical test | End of the activity |
| Behaviour | Do they apply it at work? | Work samples, peer review, supervisor observation, configuration review results | 1 to 3 months later |
| Results | Did security performance improve? | Fewer related incidents, audit findings or baseline deviations; metrics in DOC-ISMS-080 | Next measurement cycle |

Rules:

1. For High-criticality roles, evaluate at least at the behaviour level.
2. When an action is not effective, choose another option in section 7;
   do not repeat the same course by default.
3. Report effectiveness results to management review as part of the
   resources and competence input.

## 9. Awareness programme link

<!-- Guidance: Clause 7.3 is tested by asking ordinary staff three questions: do you know there is a security policy, how does your own work help keep information safe, and what happens if you ignore the rules? Make sure the awareness programme prepares people for all three and keep evidence per person. -->

The awareness programme is run under the Security Awareness Program
(`security/security-awareness-program`) and the Phishing simulation
plan (`isms/phishing-simulation-plan`, DOC-ISMS-074). This matrix holds
the requirement (ROLE-12, level 1 in the relevant areas) and the
completion evidence.

| Awareness topic | Covers (clause 7.3) | Delivery | Frequency | Audience |
|---|---|---|---|---|
| Information security policy and handbook | Policy | Onboarding session, employee security handbook (DOC-ISMS-073) | Onboarding and annually | All |
| Reporting security events | Contribution | Short module, poster, intranet page (DOC-ISMS-023) | Onboarding and annually | All |
| Phishing and social engineering | Contribution | Module plus simulations | Annually, simulations quarterly *(Example)* | All |
| Consequences of not following requirements | Implications | Handbook section, disciplinary process summary (DOC-ISMS-052) | Onboarding and annually | All |
| Role-based briefings | Contribution | Targeted sessions for developers, administrators, HR, finance | Annually | By role |

Completion *(Example, Quillmere Analytics Ltd)*: 44 of 46 persons in
scope completed annual awareness by the due date (95.7%); the 2
outstanding were contractors on leave, completed within 14 days of
return.

## 10. Qualifications and certifications

<!-- Guidance: Certifications are useful evidence but never the only proof of competence. List them as examples of acceptable evidence, not as mandatory hiring filters, unless a contract or regulation requires one. Do not treat any provider as endorsed. -->

Examples of qualifications accepted as evidence, by role. Names are
cited as examples only; equivalent qualifications or demonstrated
experience are accepted.

| Role | Examples of acceptable evidence |
|---|---|
| ISMS manager | ISO/IEC 27001 lead implementer course with exam under a personnel certification scheme (for example one operated under ISO/IEC 17024); CISM (ISACA); several years running a management system |
| Internal auditor | ISO/IEC 27001 internal or lead auditor course with exam; audit training aligned with ISO 19011:2026; CISA (ISACA) |
| Security engineer or analyst | CISSP (ISC2); vendor-neutral security certifications; demonstrated incident handling experience |
| Cloud administrator | Cloud provider security certifications for the platform in use; reviewed configuration work |
| Developer | Secure coding course with assessment; reviewed pull requests showing secure patterns |
| Privacy lead | Recognised privacy qualification; experience with data protection impact assessments |

ISO/IEC 27021:2017 + Amd 1:2021 describes competence requirements for
ISMS professionals (knowledge and skills for running and auditing an
ISMS). Use it to structure requirements for ROLE-02 and ROLE-07; read
the official text for its content.

## 11. Annual training plan

<!-- Guidance: Turn the gaps into a plan with costs, so management can approve resources under clause 7.1. Use local currency; the figures below are worked examples in USD. -->

Training plan *(Example, Quillmere Analytics Ltd, USD; use local
currency)*:

| Plan ID | Activity | Participants | Unit cost | Total | Quarter |
|---|---|---|---|---|---|
| TRN-001 *(Example)* | ISO/IEC 27001 lead implementer course | 1 | 2,500 | 2,500 | Q1 |
| TRN-002 *(Example)* | Internal auditor course | 2 | 1,200 | 2,400 | Q1 |
| TRN-003 *(Example)* | Secure coding course | 20 | 150 | 3,000 | Q2 |
| TRN-004 *(Example)* | Cloud security certification preparation | 2 | 900 | 1,800 | Q2 |
| TRN-005 *(Example)* | Awareness platform licence | 46 | 25 | 1,150 | Q1 |
| **Total** | | | | **10,850** | |

Approved budget reference: [DOC-ISMS-031, budget and resource plan,
line reference].

## 12. Size tiers

<!-- Guidance: Show how the matrix scales. Small organisations combine roles and rely on external courses; large ones run role-based curricula and learning management systems. These are the library's working tiers. -->

| Aspect | Small: Quillmere Analytics Ltd (46 staff: 38 employees, 8 contractors) | Medium: Quillmere Health Systems (320 staff) | Large: Quillmere Group (2,400 staff, 6 sites) |
|---|---|---|---|
| Roles in the catalogue | About 8; one person often holds several roles (the 0.5 FTE ISMS manager is also Head of Engineering Operations) | All 12 roles, plus clinical safety and service desk roles | All 12 roles plus OT engineer, site ISMS coordinator, plant safety roles |
| Format | This document as a spreadsheet-style table | HR system fields plus this matrix for security roles | Learning management system with role curricula; this matrix as the requirement source |
| Internal auditor competence | External auditor or a trained peer from another team for the first cycle | Two trained internal auditors, rotated for impartiality | Pool of auditors across sites, auditing other sites |
| Awareness | One annual module, phishing simulation, handbook | Role-based modules, clinical data handling for hospital-facing staff | Localised content in site languages, OT safety and security briefings |
| Effectiveness evaluation | Exam results and configuration reviews | Plus metrics trend in DOC-ISMS-080 | Plus site comparison and integrated reporting with ISO 9001 and ISO 22301 competence records |
| Typical gap drivers | Certification target in 6 months, first enterprise customers | 27001 in 10 months, 27701 extension the year after | Phased site certification over 15 months, OT security skills |

## 13. Records and evidence

<!-- Guidance: Clause 7.2 explicitly requires documented information as evidence of competence. Name each record, who keeps it and for how long. Apply personnel data retention rules and data minimisation. -->

| Record | Proves | Owner | Location | Retention *(Example)* |
|---|---|---|---|---|
| This matrix (requirements and assessments) | Competence is determined, assessed and evidenced (7.2 a, b, d) | ISMS manager | [Restricted folder] | Current version plus previous [3] versions |
| Certificates, transcripts, CVs | Competence through education, training or experience (7.2 b, d) | HR | HR system | Duration of employment plus [period set by HR policy] |
| Action records (section 7) | Actions taken to acquire competence (7.2 c) | Line managers | [Learning system or folder] | [3] years |
| Effectiveness evaluations | Actions were evaluated (7.2 c) | ISMS manager | Attached to action records | [3] years |
| Awareness completion and attestations | Awareness (7.3), A.6.3 | HR | Learning system | [3] years |
| Phishing simulation results (aggregated) | Awareness effectiveness | Security team | DOC-ISMS-074 records | [2] years |
| Training plan and budget approval | Resources provided (7.1) | ISMS manager | DOC-ISMS-031 | [3] years |

Map these records to clauses 7.2 and 7.3 and controls A.6.3 and A.5.2
in the control evidence matrix (`isms/control-evidence-matrix`,
DOC-ISMS-033).

## 14. References

<!-- Guidance: Cite editions and check for new ones at the annual review. Use NIST references as free optional material, not as requirements. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | Current; Amd 1 published 2024-02-23 | Clauses 7.1, 7.2, 7.3; Annex A A.5.2, A.6.3 (cited only) |
| ISO/IEC 27002:2022 | Current | Guidance for A.6.3 |
| ISO/IEC 27021:2017 + Amd 1:2021 | Current | Competence of ISMS professionals |
| ISO 19011:2026 | Current, published 2026-05-27 | Auditor competence and evaluation |
| NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program | September 2024, https://csrc.nist.gov/pubs/sp/800/50/r1/final | Optional reference for learning programmes |
| NIST SP 800-181 Rev. 1, Workforce Framework for Cybersecurity (NICE Framework) | November 2020, https://csrc.nist.gov/pubs/sp/800/181/r1/final; components maintained separately by NIST | Optional reference for technical work roles |
| Directive (EU) 2022/2555 (NIS2), Article 20 | 2022 | Example of a legal training duty for management bodies |

Related templates: Security awareness program
(`security/security-awareness-program`), Phishing simulation plan
(`isms/phishing-simulation-plan`, DOC-ISMS-074), Employee security
handbook (`isms/employee-security-handbook`, DOC-ISMS-073), Roles,
responsibilities and RACI (`isms/isms-roles-raci`, DOC-ISMS-006),
Onboarding checklist (`ops/onboarding-checklist`), Budget and resource
plan (`isms/isms-budget-resource-plan`, DOC-ISMS-031), Internal audit
programme (`compliance/internal-audit-program`, DOC-ISMS-082).

Official texts: ISO/IEC 27001:2022 https://www.iso.org/standard/82875.html,
Amd 1:2024 https://www.iso.org/standard/88435.html, ISO/IEC 27002:2022
https://www.iso.org/standard/75652.html, ISO/IEC 27021:2017
https://www.iso.org/standard/61003.html, ISO 19011:2026
https://www.iso.org/standard/88984.html.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 7.2
and 7.3, Annex A controls A.5.2 and A.6.3), with ISO/IEC 27021:2017 +
Amd 1:2021 and ISO 19011:2026 as references. NIST SP 800-50 Rev. 1 and
NIST SP 800-181 Rev. 1 are US government works cited as optional
references. Certification names (CISSP, CISM, CISA) are cited by name
only as examples, with no endorsement. Clause and control numbers are
cited with original paraphrases; the role catalogue, scale, matrix and
examples are original, and no ISO/IEC text is reproduced. You need the
official standards to implement and audit the requirements. Check the
current editions before use. Quillmere organisations, persons and
figures are fictional examples. Template licence: MIT.