Persons doing work under the organization’s control that affects information security shall be competent, based on education, training, or experience, and evidence shall be retained.
What this means in practice: Match roles with skills: define competencies, close gaps, and keep proof that people are qualified for security-relevant work.
To make this concrete, the organization must ensure:
a. Required competencies are defined for relevant roles (e.g., admins, developers, support, ISMS roles).
b. Competence gaps are addressed (training, mentoring, hiring) and effectiveness is evaluated.
c. Documented evidence of competence is retained (records, certificates, assessments).
