Skip to main content
Control Institute
Category: ISMS Clauses and Planning

Awareness

Also known as: Security Awareness, Security Awareness Training
Simply put

In a compliance context, awareness refers to ensuring that personnel understand security expectations, their responsibilities, and the risks relevant to their roles. The general dictionary sense of the word is the quality or state of being conscious of, or having knowledge and understanding that, something exists or is happening. Programs that build this understanding help people recognize and respond appropriately to security-related situations.

Formal definition

The evidence provided contains only general-purpose and unrelated dictionary, psychology, and entertainment sources defining 'awareness' as the state of being conscious or the knowledge and understanding that something exists or is happening; it does not include SOC 2 or ISO 27001 source material. Within security compliance frameworks, awareness typically denotes the ongoing effort to make personnel cognizant of information security policies, responsibilities, and threats. In ISO/IEC 27001, awareness is addressed as an ISMS requirement in the clauses 4-10 support provisions, requiring that persons doing work under the organization's control are aware of the information security policy, their contribution to the ISMS, and the implications of nonconformity, while related reference controls appear in Annex A (with the specific control designation depending on the edition cited). In SOC 2 engagements, awareness activities generally support the Security (Common Criteria) category and are evaluated by the CPA firm as part of the suitability of control design (Type I) and, where applicable, operating effectiveness over the review period (Type II). The precise definition, mapping, and evidentiary expectations vary by scope, framework version, auditor, and certification body, and the sources in this evidence packet do not substantiate framework-specific detail.

Why it matters

Security frameworks recognize that people are a central part of any control environment. Technical safeguards can be undermined if personnel do not understand security expectations, their own responsibilities, or the risks relevant to their roles. Awareness programs address this human dimension by building the knowledge and understanding that something is happening or exists, the general sense of the word, and applying it to the specific context of information security policies and threats.

In compliance terms, awareness matters because both ISO/IEC 27001 and SOC 2 treat human understanding as a control worth evaluating. In ISO 27001, awareness is an explicit ISMS support requirement within clauses 4-10, meaning an organization seeking certification must demonstrate that persons working under its control understand the information security policy, their contribution to the ISMS, and the implications of nonconformity. In SOC 2 engagements, awareness activities typically support the Security (Common Criteria) category and may be examined by the CPA firm as part of the suitability of control design and, for a Type II report, operating effectiveness over the review period.

It is worth noting that awareness is not a guarantee of secure behavior, and the sources reviewed here define the term only in a general dictionary and psychology sense. The precise framework-specific expectations, mappings, and evidentiary requirements vary by scope, framework version, auditor, and certification body, so awareness should be understood as a supporting element within a broader control environment rather than a standalone assurance.

Who it's relevant to

Compliance and GRC Managers
Those responsible for demonstrating conformity need to understand that awareness is an explicit ISMS support requirement in ISO 27001 clauses 4-10 and typically supports the SOC 2 Security (Common Criteria) category. They should be prepared to show, in most engagements, that personnel understand relevant policies, responsibilities, and the implications of nonconformity, while recognizing that specific expectations vary by scope and framework version.
Auditors and CPA Firms
Practitioners performing SOC 2 examinations may evaluate awareness activities as part of the suitability of control design (Type I) and, where applicable, operating effectiveness over the review period (Type II). The precise evidentiary expectations depend on the scope, applicable criteria, and the auditor's judgment.
Certification Bodies and ISMS Assessors
Those assessing ISO/IEC 27001 conformity consider whether persons doing work under the organization's control are aware of the information security policy, their contribution to the ISMS, and the implications of nonconformity. Related reference controls in Annex A may also be in scope, with the applicable control designation depending on the edition cited.
Security Engineers and Operational Staff
Personnel across the organization are the subject of awareness efforts. Understanding security expectations relevant to their roles helps them recognize and respond appropriately to security-related situations, which supports, but does not by itself guarantee, the effectiveness of the broader control environment.

Inside Awareness

Security awareness program
A structured set of activities intended to inform personnel of information security policies, their responsibilities, and expected behaviors. Under ISO 27001, personnel awareness is addressed within the ISMS requirements (clauses 4-10), notably the competence and awareness provisions, and is supported by relevant Annex A reference controls selected via the Statement of Applicability.
Awareness versus training versus competence
Awareness generally refers to personnel understanding the relevance and importance of their actions to information security objectives, whereas training builds specific skills and competence reflects demonstrated ability. These are related but distinct concepts, and the emphasis depends on the role and scope defined for the ISMS or the controls covered by a SOC 2 examination.
Role in SOC 2
In a SOC 2 examination, awareness typically appears as evidence supporting controls within the Security category (the Common Criteria), for example controls addressing communication of policies and personnel responsibilities. The specific controls and how awareness is evidenced depend on the service organization's control design and the scope of the engagement.
Evidence of awareness
Typically includes records such as acknowledgment of policies, completion of awareness activities, and communications to personnel. The exact evidence expected varies by auditor, certification body, scope, and the applicable criteria or controls in play.

Common questions

Answers to the questions practitioners most commonly ask about Awareness.

Is a formal security awareness training program explicitly required to pass a SOC 2 examination or achieve ISO 27001 certification?
The frameworks address awareness differently, and neither prescribes a single mandatory program format. In SOC 2, awareness typically supports the Security (Common Criteria) category, and auditors evaluate whether the controls you have defined are suitably designed and, for a Type II, operating effectively over the review period. For ISO 27001, the ISMS requirements in clauses 4 through 10 include a requirement that persons doing work under the organization's control be aware of relevant policy and their contribution to the ISMS, and Annex A includes a reference control related to awareness that is selected via the Statement of Applicability informed by risk assessment. So awareness is expected in most engagements, but the specific form, frequency, and content depend on scope, the auditor or certification body, and your risk decisions rather than a fixed universal rule.
Does completing awareness training under one framework mean I automatically satisfy the awareness expectations of the other?
Not automatically. Mapping between SOC 2 and ISO 27001 is possible but partial, and satisfying one does not inherently satisfy the other. A SOC 2 report attests only to the controls and period covered under the AICPA SSAE 18 standard, while an ISO 27001 certificate covers only the defined scope of the ISMS against a management system standard. Awareness activities can often be leveraged toward both, but the evidence, framing, and evaluation criteria differ, so you should confirm that your program addresses each framework's requirements as scoped rather than assuming equivalence.
How do we demonstrate awareness to an assessor in a SOC 2 Type II engagement versus a Type I?
A Type I assesses the suitability of design of controls at a point in time, so evidence typically centers on the existence and design of the awareness control, such as a documented program and defined expectations. A Type II assesses both design and operating effectiveness over a defined review period, so assessors typically expect evidence that awareness activities actually occurred throughout that period. The period length varies and is set by scoping decisions. In most engagements you would retain records supporting your defined control, though the specific evidence expected depends on the auditor and scope.
Who within the organization should awareness activities cover?
For ISO 27001, the ISMS requirements direct awareness toward persons doing work under the organization's control, which can extend beyond employees depending on how you define scope. For SOC 2, coverage is shaped by the controls you define to support the applicable Trust Services Criteria. In most engagements the population covered is driven by your defined ISMS scope or system boundary rather than a fixed list, so you should align coverage with the scope you have documented and, for ISO 27001, with your risk assessment and Statement of Applicability.
How often should awareness activities be delivered to meet these frameworks?
Neither framework, as a general matter, mandates a single fixed frequency; cadence typically depends on scope, risk decisions, and the expectations of the auditor or certification body. For a SOC 2 Type II, the relevant consideration is that your defined control operates consistently across the review period, so whatever frequency you commit to should be evidenced throughout. For ISO 27001, frequency should be informed by your risk assessment and the ongoing nature of the ISMS. It is safer to define a cadence you can consistently demonstrate than to assume any specific interval is universally required.
What documentation supports an awareness control during an assessment?
The specific evidence varies by auditor, certification body, and scope, but in most engagements it helps to maintain a documented awareness policy or program, records showing activities were delivered, and evidence tying those activities to the covered population and time frame. Keep in mind that such records attest only to what they cover; they do not guarantee freedom from breaches or extend beyond the controls and, for SOC 2, the period covered, or, for ISO 27001, the defined ISMS scope. Align your documentation with your defined control and, for ISO 27001, with the Statement of Applicability rather than assuming a fixed evidence checklist.

Common misconceptions

Awareness and formal training are the same thing and satisfy the same requirements.
Awareness generally concerns personnel understanding why security matters and their responsibilities, while training develops specific skills; the two serve different purposes. Depending on scope and the standard involved, both may be relevant, but demonstrating one does not automatically demonstrate the other.
Meeting ISO 27001 awareness expectations means the equivalent SOC 2 requirement is automatically satisfied.
Mapping between SOC 2 and ISO 27001 is possible but partial. SOC 2 is an attestation examination performed by a CPA firm under SSAE 18 resulting in a report, while ISO 27001 is a certification against a management system standard. Awareness evidence may overlap, but satisfying one framework does not automatically satisfy the other.
A SOC 2 report or an ISO 27001 certificate confirms that awareness efforts prevent security incidents.
A SOC 2 report attests only to the controls and period covered and does not guarantee freedom from breaches, and an ISO 27001 certificate covers only the defined scope of the ISMS. Awareness activities reduce risk but do not, on their own, guarantee any particular security outcome.

Best practices

Clarify the distinction between awareness, training, and competence in your program documentation so evidence maps clearly to the relevant ISO 27001 ISMS requirements or the applicable SOC 2 Common Criteria controls.
Maintain records of awareness activities and personnel acknowledgments, since evidence expectations vary by auditor, certification body, and scope, and having clear records supports either engagement.
For ISO 27001, tie awareness content to the controls selected in your Statement of Applicability and to the roles and responsibilities defined for the ISMS scope, specifying the Annex A version referenced.
For SOC 2, confirm which awareness-related controls fall within the Security category scope of your examination, and align evidence to the specific controls your service organization has designed.
Avoid treating awareness evidence as interchangeable between frameworks; where you pursue both, map overlapping evidence deliberately and recognize the mapping is partial.
Frame awareness outcomes qualitatively rather than as guarantees, acknowledging that they reduce risk within the covered scope and period but do not ensure freedom from incidents.