Security awareness that auditors accept: the evidence behind ISO/IEC 27001 and NIST CSF 2.0

Most organisations run security awareness training. Far fewer can prove it in an audit. The session happened, people attended, a slide deck exists somewhere, and yet the auditor still writes a finding. The reason is simple: auditors do not assess whether training took place. They assess whether a planned programme exists, whether it reached the right people, and whether anyone checked that it worked.

This article sets out what ISO/IEC 27001:2022 and the NIST Cybersecurity Framework (CSF) 2.0 expect, and the five pieces of evidence that answer both.

What the two frameworks ask for

ISO/IEC 27001:2022 covers awareness in three places. Clause 7.2 asks the organisation to decide what competence its people need and to keep evidence of it. Clause 7.3 asks that people know the information security policy, how their own work contributes, and what follows if they do not conform. Annex A control 6.3 asks that personnel, and relevant outside parties, receive awareness, education and training suited to their role, with regular updates.

NIST CSF 2.0 covers the same ground in its Awareness and Training category (PR.AT). PR.AT-01 expects all personnel to receive awareness and training so they can do their everyday work with cybersecurity risks in mind; PR.AT-02 expects the same, in more depth, for people in specialised roles such as administrators, developers and executives. The Improvement category adds that improvements are identified from evaluations (ID.IM-01).

The wording differs. The audit question is the same: show me the programme, show me who it reached, show me it works.

Five pieces of evidence auditors accept

1. An approved programme plan. A dated document, approved by a named owner, that says who the audiences are, what each will learn, through which channel and in which month. A twelve-month plan is the usual shape. It answers the first question any auditor asks: was this planned, or did it just happen?

2. Content matched to role and risk. One annual session for everyone rarely satisfies either framework. Auditors look for different treatment of different groups: all staff, new joiners, system administrators and other privileged users, developers, executives, and contractors where they handle your information. The link to risk matters too. If your risk register says phishing is a top risk, the plan should show phishing content.

3. Attendance and completion records. A register showing each session, the date, the audience, how many were expected and how many completed. The detail auditors probe is the gap: who did not attend, and what happened next. New joiners and contractors are the common blind spots. A register with a 100% figure and no names behind it invites more questions than one showing 91% with a follow-up list.

4. Effectiveness measures. Completion tells an auditor that people sat through the material. It says nothing about whether behaviour changed. Evidence here includes quiz results, phishing simulation click rates and report rates over time, the time taken to report a suspicious message, and the number of incidents staff reported themselves. Three or four measures with a target and a trend are enough.

5. Review and improvement. A record that someone looked at the results and changed something: a topic added after an incident, a module rewritten after poor quiz scores, the plan updated when a new system went live. In an ISO/IEC 27001 management system this usually appears in management review inputs. In NIST CSF 2.0 it is the improvement outcome: improvements identified from evaluations.

Where programmes usually fail

The same findings appear again and again.

Training exists but no plan does. Sessions were run when someone had time, so there is nothing to show the programme was designed.

Evidence is scattered. Attendance sits in one person's inbox, quiz results in a learning platform, phishing results with a supplier. Nobody can assemble the picture inside the audit window.

Completion is reported as effectiveness. A 98% completion rate is presented as proof that awareness works, with no behavioural measure beside it.

Privileged and senior roles are missed. Administrators and executives are the most targeted people in the organisation and often the least trained, because the general session was judged enough.

Phishing simulations have no rules. Tests are run without an agreed procedure, without HR alignment, and with results used to embarrass people. That damages the reporting culture the programme is meant to build, and it leaves the organisation unable to explain how the results were used.

One evidence set, two frameworks

Many organisations answer to more than one framework: ISO/IEC 27001 for certification, NIST CSF for a customer, a board or a sector regulator. They do not need two programmes. One plan, one register and one set of measures can serve both, provided a simple crosswalk shows which document answers which requirement.

A thirty-day start

Week one: name an owner and write a one-page plan covering the next twelve months. Week two: build a single register and move every past attendance record into it. Week three: choose three measures you can collect now and record a baseline. Week four: hold a short review, write down one change, and file the note. At the end of the month you have all five pieces in a first version, and a first version with honest gaps is far stronger in an audit than a polished deck with nothing behind it.

A note on using AI

AI tools are useful for tailoring messages to different roles and for drafting quiz questions. They must never be used to create attendance records, results or sign-offs. Evidence that was generated and not observed is a nonconformity in any audit, whatever tool produced it. AI drafts, a named person decides, and the record shows who reviewed it.

What comes next

October is Cybersecurity Awareness Month, and every Brivellis article this month covers one part of the subject. The complete, free awareness programme kit is now on brivellis.com: Cybersecurity Awareness Programme Kit.