Cyber Essentials and ISO 27001: The People Behind Your Certificate
Cyber Essentials and ISO 27001 both depend on named, trained people. Since April 2026, Cyber Essentials automatically fails firms that skip MFA on cloud services or leave critical updates for more than 14 days. ISO 27001 clauses 7.2 and 7.3 require evidence that staff are competent and aware.
Your Cyber Essentials or ISO 27001 certificate sits on your website, but the work behind it usually sits with a few people. When firms come to us for cybersecurity and resilience training, it's often the admin who set up multi-factor authentication (MFA) and the engineer patching the firewall on a Friday afternoon. Lose one of them before renewal, and the gap shows quickly.
We've been training IT and security teams since 2010, and the same questions come up whenever a client security questionnaire lands or the FCA asks how you know your controls work. Who runs them? And how do you know they can?
This guide covers what the 2026 Cyber Essentials update asks of your IT team, what ISO 27001 says about staff training and competence, and a checklist of the people evidence worth keeping. If you'd rather talk it through, you can book a free consultation with our team
Written by
Based in our Johannesburg office, Jeanne is Learning People's expert in B2B technical training, professional certifications and workforce capability operations across the UK, Africa, Australia and New Zealand. Having worked in certification training for over a decade, she is our resident expert on workforce empowerment and transformation, helping organisations identify the right learning pathways across our B2B offering.
What Does the 2026 Cyber Essentials Update Ask of Your IT Team?
The 2026 Cyber Essentials update makes two everyday IT tasks automatic fails: missing MFA on any cloud service that offers it, and critical updates left for more than 14 days. It applies to assessment accounts created after 26 April 2026 (Requirements v3.3 and the Danzell question set).
The five technical controls haven't changed, and there's still no staff training control. But each change lands on someone specific:
|
What changed |
Who it lands on |
Training that helps |
|---|---|---|
|
MFA on every cloud service (automatic fail) |
IT admins |
Microsoft certifications covering identity and access |
|
Critical updates within 14 days (automatic fail) |
Infrastructure team |
IT service management training for patch and change planning |
|
Cloud services can't be left out of scope |
Cloud admins |
If the person behind any row is new or about to leave, your next assessment is at risk, therefore we'd suggest naming a deputy for each before your renewal date.
What Does ISO 27001 Say About Staff Training and Competence?
ISO 27001:2022 requires competence in every role that affects information security (clause 7.2) and security awareness for all staff (clause 7.3). Annex A control 6.3 covers awareness, education and training.
Clause 7.2 asks you to define what each role needs, close any gaps, check that the training worked and keep evidence. That third step is the one teams skip most. A completion log shows who finished a module, so pair it with a before-and-after knowledge check or a certification with a pass date your auditor can see.
What Training Supports Cyber Essentials and ISO 27001?
Awareness training for all staff supports ISO 27001 clause 7.3, while certifications give your security team dated evidence for clause 7.2.
The awareness gap is wide. The UK Government's Cyber Security Breaches Survey 2025/26 found phishing was involved in 93% of attacks on businesses that identified one. Yet fewer than one in five businesses (19%) trained staff on cybersecurity.
Our awareness training, part of our wider compliance training, shows staff how to spot a fake invoice or login page, with a knowledge check before and after. Reporting through our learning platform gives your auditor the record and your managers a view of who's behind.
For your security team, our CompTIA certifications for teams are a good fit:
- CompTIA Security+ for core security knowledge
- CompTIA CySA+ for threat detection and incident response
- EC-Council's Certified Ethical Hacker (CEH) for whoever tests your defences
If you're FCA-regulated, the same records support your operational resilience self-assessment. Our FCA operational resilience checklist covers that side.
We train the people, and certification stays with the certification bodies: IASME-licensed bodies for Cyber Essentials, and UKAS-accredited bodies for ISO 27001.
Get Your People Ready for Your Next Cyber Essentials or ISO 27001 Audit
Your next renewal or ISO 27001 surveillance audit (the yearly check between full recertifications) is when the people evidence gets tested. We'll benchmark your team's skills against the controls they run, then build a training plan around the gaps.
If you'd like to know which roles carry your controls today, book a free consultation and we'll talk it through.
FAQs About Cyber Essentials and ISO 27001 Training
Find out more about comprehensive workplace training
Related Articles
Project ManagementHow to Get a Project Management Job With No Experience
Discover the transferable skills and certifications that can help you land a project management job with no experience.
Read More
Project ManagementThe Importance of Project Management in Cybersecurity: Expert Advice
Cybersecurity depends on more than technical skill alone. In this guide, I explain how project management supports risk reduction, communication, governance, and delivery, and why that makes it relevant for anyone considering a career in the field.
Read More
Project ManagementWhat Is Agile Project Management?
Learn what Agile project management is, how it works, and where it’s used. A simple guide to Agile methods, roles, and qualification options.
Read More
Project ManagementThe importance of Project Management in Cyber Security
Do you want to become a cyber security project manager? Here we’ll dive into why PMs play such an important role in the cyber security industry.
Read More