---
notetype: reference
standard: ISO 27001
version: 2022
language: EN
type: clause
id: "C.7.2"
title: "Competence"
tags:
- iso27001/2022/EN
- sourcetext
status: active
---
## 7.2 Competence

The organization shall:

a\) determine the necessary competence of person(s) doing work under its control that affects its information security performance;

b\) ensure that these persons are competent on the basis of appropriate education, training, or experience;

c\) where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken; and

d\) retain appropriate documented information as evidence of competence.

NOTE Applicable actions can include, for example: the provision of training to, the mentoring of, or the re-assignment of current employees; or the hiring or contracting of competent persons.
