Information security training
Annual security training has a simple compliance measure: the share of people who received it against the people who need it.
What the published 2016 guidance says
Annual security training has a simple compliance measure: the share of people who received it against the people who need it. Illustrative bands are red from 0 to 60, yellow from 60 to 90 and green from 90 to 100. A yellow result becomes red automatically if progress of at least 10 points a quarter is not made. The evidence is the training register marked as received. It is collected monthly, analysed and reported quarterly, and reviewed annually. The security officer and training manager own it, HR training collects, and the management system leads are clients.
What it means in practice
Annual training completion is the simplest awareness measure. The refinement is the automatic downgrade when progress is too slow, which turns a static percentage into an early warning. Keep the evidence as a registry, not a slide.
Status of this record. For B.12, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the annual training plan and the completion records. Count the people trained against those who need it. Apply the automatic downgrade when progress is too slow, and record the intervention.
Evidence an assessor asks for
- Awareness and trainingTraining records with completion dates against the annual requirement
- Human resourcesQuarterly progress figures
- Awareness and trainingColour-coded bar graph
The question an assessor will ask
An assessor will ask for training records with completion dates against the annual requirement. The test for B.12 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Annual requirement not defined per role, so the denominator is unclear
- Yellow ratings left standing without checking the quarterly progress rule
Before the next review
Before the next review, test this against one live record: annual requirement not defined per role, so the denominator is unclear.
What to check when the revision publishes
When DIS 27004 is published, compare the B.12 Information security training record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.