Support (Clause 7)
Support (Clause 7)
Clause 7 supplies the people, awareness, communication, and documented information the ISMS depends on. The exam tests whether support activities are evidence-based, whether awareness is broader than training, and whether documented information is controlled through its life cycle.
Core rules
- 7.1 resources: determine and provide resources needed for the ISMS.
- 7.2 competence: determine necessary competence for persons doing work affecting ISMS performance; ensure they are competent; take action to acquire competence; evaluate effectiveness; retain documented evidence.
- 7.3 awareness: persons doing work under the organization's control must be aware of the policy, their contribution to ISMS effectiveness, and the implications of not conforming.
- 7.4 communication: determine what, when, with whom, and how to communicate relevant ISMS information, internally and externally.
- 7.5 documented information: when creating and updating, ensure identification, format, and review/approval; when controlling, address availability, protection, distribution, access, retrieval, use, storage, preservation, changes, retention, and disposition. Documented information of external origin must be controlled.
Worked example
A contractor with production administrator rights completed no security briefing and has no competence record. Exam reasoning: 7.2 requires competence for work affecting ISMS performance, and 7.3 awareness applies to persons working under the organization's control, which can include contractors. The gap is not fixed by a generic induction slide; the organization needs role-specific competence criteria, evidence of briefing, and a way to verify understanding and evaluate effectiveness.
Traps that cost marks
- Treating awareness as annual training completion only.
- Keeping competence records without linking them to role requirements.
- Forgetting that externally sourced documents, such as cloud provider certificates or customer security schedules, need control.
- Confusing retention with disposition: retention sets how long, disposition covers what happens at the end.