Information security awareness compliance
Training completion and signature compliance are separate duties, so the construct measures both.
What the published 2016 guidance says
Training completion and signature compliance are separate duties, so the construct measures both. One figure is progress against the people scheduled to have completed by now; the other is the share who signed. The ratios are compared with the plan and with the previous status. Illustrative targets are 0.9 to 1.1 and 0.99 to 1.01, with a trend that is rising or stable. Evidence is the schedule, the completion status and the signed agreements. It is collected monthly and reported quarterly. The security officer and training manager own it, HR training collects, and the management system leads are clients.
What it means in practice
This construct separates training completion from signature compliance, which are different duties. Report both, compare with the plan, and show the trend. A signature rate near 100 percent with a low training rate is a process problem, not a success.
Status of this record. For B.13, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the training plan, the signature plan and the signed records. Report both completion and signature rates against the plan. Explain any gap between the two.
Evidence an assessor asks for
- Awareness and trainingAwareness training plan with scheduled personnel
- Human resourcesSigned user agreements against the signing plan
- Awareness and trainingStatus report using the three-font convention
The question an assessor will ask
An assessor will ask for awareness training plan with scheduled personnel. The test for B.13 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Signing of user agreements not tracked separately from training completion
- Plan dates missing, so progress to date cannot be computed
Before the next review
Before the next review, test this against one live record: signing of user agreements not tracked separately from training completion.
What to check when the revision publishes
When DIS 27004 is published, compare the B.13 Information security awareness compliance record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.