October 2026. Clause 7.3 of ISO 27001 requires people to be aware of the policy and their role. Auditors like to see whether that awareness has an effect. A list of completed e-learnings proves training was offered, not that it works. These are the indicators that do matter. A broader approach is in our article on security awareness in SMEs.
Participation: necessary, not sufficient
Track the percentage of staff who completed training, including new joiners within a fixed period of starting. Aim for 100 percent on mandatory modules and explain why deviations exist. This is the basis, not the end point.
Reporting behaviour: the key indicator
Measure how many suspicious emails employees report and how quickly. A rising report rate shows trust and alertness. Also measure the time between receipt and report. An organisation where nobody reports is not safer; it is an organisation where nobody knows.
Phishing simulations: read the numbers carefully
Simulations give a click rate, but compare it with the report rate and look at the trend, not a single measurement. Do not punish individuals; use the results for targeted training. See also security awareness training.
Incidents caused by human behaviour
Count the incidents arising from behaviour, such as misdirected email or shared passwords, and link them to improvement actions. Show that an incident leads to adjusted training or rules. That ties into your incident process.
Recording it for the auditor
Include four to six indicators in your KPI dashboard, discuss them in the management review and keep the training material, attendance or result lists and simulation reports. Add per deviation what you are doing about it. An auditor prefers a modest but living measurement system over a large dashboard without follow-up.