Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

1
  • 5
    Important to note that security training is not ISO 27k specific and it is completely reasonable to have training even if the org is not even considering ISO 27k. A well-defined ISMS should be designed to address the org's risks, which means that the more generic approach for training design is to train based on risk rather than policy. And that's true both for procedural training as well for awareness training.
    – schroeder
    Commented Feb 19, 2019 at 11:36