Which action is an organization required to take to ensure that personnel are competent to perform their assigned tasks within the ISMS?

ISO/IEC 27001, Clause 7.2 (Competence), mandates that an organization must determine the necessary competence of personnel performing work that affects its information security performance. The standard requires the organization to ensure these persons are competent based on appropriate education, training, or experience. A key and explicit requirement within this clause is to "retain appropriate documented information as evidence of competence." Therefore, holding up-to-date records on training, skills, experience, and qualifications is a required action to demonstrate and ensure that personnel are competent to perform their assigned ISMS tasks.

A. Identifying products relates to resource management or continual improvement, not the direct assessment or documentation of personnel competence.

B. The standard requires competence appropriate to the role; it does not mandate a specific, universal certification for all personnel.

C. Implementing compliance controls is an operational activity (Clause 8), not the specific action of ensuring and documenting personnel competence (Clause 7.2).

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 7.2 Competence: This clause states the organization shall: "d) retain appropriate documented information as evidence of competence." This directly supports option D as a mandatory action.

2. von Solms, R., & von Solms, B. (2018). "Information Security Governance." In Cybersecurity, pp. 27-50. Springer, Cham.

In discussing the "Support" clauses of ISO 27001, the authors emphasize that for an ISMS to be effective, the organization must not only ensure competence but also maintain records as proof. This aligns with the requirement to hold documented information on qualifications and training. (DOI: https://doi.org/10.1007/978-3-319-95189-82)

3. University of Oslo, Department of Informatics. (n.d.). IN5250 – Security in operating systems and software: Lecture on ISMS.

Course materials covering ISO/IEC 27001 implementation detail the requirements of Clause 7.2. They explain that competence can be achieved through various means (training, experience) and highlight that evidence of this competence must be documented and retained by the organization. This directly validates the action described in option D.