Competence and Awareness in a Shift-Based Operation
Halcyon Foods runs three production shifts across two plants. The ISMS covers 420 staff. Awareness training is delivered once a year as a 40-minute e-learning module; completion is tracked at 71%. The security policy is posted on the intranet, which most production staff cannot access from the shop floor. A recent phishing simulation achieved a 38% click rate among office staff and could not be run at all on the shop floor because those workers have no email. Two incidents in the last quarter involved contractors tailgating into the server room; neither contractor had signed an acceptable-use acknowledgment. The HR manager, who owns onboarding, says security awareness is "the IT team's job." The internal audit is scheduled in six weeks.
1. Assess the awareness and competence posture against Clauses 7.2 and 7.3. What is the most significant gap, and why?
Read the worked answer
Clause 7.2 (competence) requires that persons doing work affecting information security be competent on the basis of education, training, or experience, with evidence retained. Clause 7.3 (awareness) requires that persons be aware of the policy, their contribution to effectiveness, and the implications of not conforming.
The most significant gap is the shop floor. The policy is only on an intranet those workers cannot reach, training is an email-based module they cannot complete, and phishing simulation cannot reach them at all. For a large share of the 420 staff, there is no evidence of awareness or competence. That is a Clause 7.3 failure at scale, and likely a 7.2 failure for roles that affect security (e.g., anyone with physical access to the server room).
The contractor tailgating incidents compound this: contractors doing work that affects security had no acceptable-use acknowledgment, so there is no evidence they were made aware of their obligations. The 71% completion rate is itself a finding - 29% have no record.
The fix is channel-appropriate delivery (toolbox talks, shift briefings, signed acknowledgments at the gate) and a contractor onboarding gate, not another e-learning push.
2. The HR manager disclaims ownership of awareness. How should the ISM respond, and what does ISO/IEC 27001 require of roles and responsibilities here?
Read the worked answer
Clause 5.3 requires that responsibilities and authorities for the ISMS be assigned and communicated within the organization. Clause 7.2 and 7.3 obligations attach to the organization, not to a single team. HR controls onboarding, which is precisely where policy acknowledgment and awareness must occur - so HR is a legitimate control owner, and the ISM should formalize that rather than argue.
The ISM's move: propose a documented responsibility assignment (e.g., HR owns onboarding acknowledgment and records; IT owns delivery platform; ISM owns content and monitoring). Escalate to top management if HR will not accept, because Clause 5.1 requires top management to ensure responsibilities are assigned. The conversation should be framed as a control gap with audit consequences, not a turf dispute.
For contractors, the requirement is sharper: contracts and onboarding must produce evidence of acknowledgment and awareness before access is granted. A gate at the contractor onboarding step, with records retained, closes both the Clause 7.3 gap and the tailgating exposure.