Competence and awareness for new cloud and data controls
Meridian Health provides telehealth software to 300 clinics. Its ISO 27001:2013 certificate is valid until March 2026, but a customer requires 2022 certification by December 2024. The support processes have not changed since 2020. Awareness training is a 20-minute annual e-learning module covering phishing and password hygiene; completion is 98%. The new controls include A.5.7 threat intelligence, A.5.23 cloud services, A.7.4 physical security monitoring, A.8.11 data masking, A.8.12 DLP. Meridian has no threat intelligence function; its developers use a public cloud with default logging; its helpdesk staff have access to production patient data to troubleshoot. Competence records consist of CVs in an HR folder; there are no records of training for the cloud platform or secure development. The CISO proposes to 'refresh the e-learning with two new slides on cloud security' and declare the transition complete, arguing that clause 7.2 only requires 'appropriate' competence.
1. Evaluate the CISO's proposal against clauses 7.2 and 7.3. What evidence would demonstrate conformity, and where are the specific gaps?
Read the worked answer
Clause 7.2 requires the organisation to determine the competence needed for persons doing work that affects information security performance, ensure they are competent, take action to acquire competence, evaluate the effectiveness of the action, and retain documented information. Clause 7.3 requires awareness of the policy, their contribution to the ISMS and the implications of not conforming. The CISO's two-slide refresh does not determine competence needs, does not address developers' cloud configuration or secure coding work, and does not evaluate whether the training changed behaviour. Helpdesk staff with access to production patient data need role-specific competence in privacy, access control, incident reporting and secure troubleshooting; the current 20-minute module is not sufficient. Evidence would include a competence matrix by role, training and certification records for the cloud platform and secure development, assessments or observed work, and awareness records that cover the updated policy and incident reporting. The gap is not the word 'appropriate'; 7.2 requires a documented determination of what appropriate means for each role. A transition audit would likely raise a nonconformity if the only evidence is an e-learning completion rate.
2. Helpdesk access to production patient data is a specific risk. What should Meridian do under clause 7.2 and the relevant Annex A controls, and how does that affect the transition?
Read the worked answer
Meridian should first decide whether helpdesk staff need to see identifiable patient data to troubleshoot. If not, data masking (A.8.11) and least privilege (A.8.2) should be applied so they see only what is necessary; access should be logged and reviewed (A.8.15, A.8.3). If access is necessary, the role should have a defined competence requirement covering confidentiality, privacy law, secure remote support, and incident reporting, with training and evaluation recorded under 7.2. Awareness under 7.3 should make clear the implications of misuse. For the transition, this becomes a risk assessment item and a SoA entry: A.8.11 and A.8.12 may be applicable even if Meridian had not previously considered them. The auditor will look for evidence that the access is justified, limited, monitored and supported by competence records. Simply adding a cloud-security slide does not address the risk. If Meridian cannot show these controls before the customer deadline, it should either restrict helpdesk access or accept that the transition scope cannot honestly include that process until remediated.