What it asks for. This control expects staff and relevant interested parties to receive appropriate awareness, education and training on information security, with regular updates to policies and procedures relevant to their role. The aim is to make sure people understand their security responsibilities and know how to act on them.
In practice. Good practice is a programme with general awareness for everyone, role-specific training for groups such as developers, administrators and managers, and onboarding content for new joiners. Content is refreshed as threats and policies change, and effectiveness is measured. Auditors look for a training plan, completion records and evidence that the content matches roles and current risks.
Common gaps. Typical gaps are a single annual module for all staff, contractors left out and no measure of whether behaviour actually changes.