Persons shall be aware of the information security policy, their contribution to ISMS effectiveness, benefits of improved performance, and consequences of not conforming.
In operational terms: Make security expectations stick—everyone knows the rules, their responsibility, and the consequences of nonconformance.
Auditors will typically look for evidence that the organization:
a. Ensures awareness of the policy and what it means for daily work.
b. Clarifies individual contributions (secure data handling, incident reporting, following procedures).
c. Communicates consequences of noncompliance (security, customer, contractual/disciplinary).
