Clause 7.2 Competence
Clause 7.2 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Competence. The organization must decide what competence is needed by people working under its control whose work affects information security performance; make sure they are competent through education, training or experience; where applicable act to acquire the competence and check those actions worked; and keep documented evidence of competence. The note gives examples such as training, mentoring or reassigning current staff, or hiring or contracting competent people.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 7.2 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 7), in our words, not a statement of the standard and not binding on an assessor.
- Competence requirements for roles affecting information security performance
- Training, qualification and experience records for people in those roles
- Records of actions taken to close competence gaps and evaluation of their effectiveness
- Coverage of contractors and others working under the organization's control