With training, you ensure that employees are aware of information security and have the necessary competence, and you record attendance as evidence (ISO/IEC 27001, clauses 7.2 and 7.3). This includes the acknowledgement of policies and the competence evidence for key roles. This guide is aimed at ISMS managers and at everyone who completes training.

Before you start

  • You will find training under ISMS management › Training. People who only attend see My training there.
  • People with the “Training: Manage” permission may create training sessions and record attendance for others; by default, these are the ISMS managers. With “Training: View”, you can see training sessions, attendance and acknowledgements.
  • Training is included in all plans.

Creating a training session

  1. Open Training and click Create training.
  2. Name the Training session, for example “Security Awareness 2026 (e-learning)”, and under Content and delivery, describe what it is about, where to find it and how long it takes.
  3. Choose the Target group: All members or a functional role, for example for specialist training.
  4. Optionally, set the date by which it is to be completed under Complete by.
  5. Leave Mandatory training ticked if the target group should receive a task. Without the tick, the training is voluntary: the target group sees it but does not receive a task.
  6. Click Save.

A training session applies once. For annual training, create a new one every year.

Confirming attendance

  • Yourself: open the training session and click Confirm attendance. Enter when you completed it under Completed on, optionally with a Note.
  • For others: anyone who manages training uses Record attendance to record the attendance of a Person afterwards, for example after a classroom session with an attendance list.

The training page shows for each person whether attendance is Open or confirmed, and who confirmed it.

Once a training session is over, edit it and select Completed (archive). After that, no more tasks are created, and the attendance records are kept as evidence. You can also delete a training session without any attendance.

Acknowledgement of policies

If a policy requires acknowledgement, it appears for all members with access to the policies under Training in the Policies for acknowledgement section and as a task. How to require acknowledgement is described in Managing policies with an approval workflow.

Competence of key roles

For key roles such as ISMS manager, ISO/IEC 27001 requires evidence of competence (7.2). Whoever manages functional roles defines which competence a role requires, see Defining functional roles and permissions.

You record your own evidence in the menu with your initials under My competence evidence:

  1. For the key role, click Add competence evidence.
  2. Choose a Document from “Documents & evidence”, for example a certificate, or the Attendance at a training session for the role.
  3. Enter the Date of evidence and optionally a Comment, and save.

Only you and whoever manages functional roles can see your evidence.

What happens next

  • For mandatory training, the target group receives the task Complete training: immediately if there is no due date, otherwise 30 days before the due date.
  • For policies, the task Read and acknowledge policy is created.
  • The status of mandatory training and acknowledgements feeds into the management review, see Preparing and conducting the management review.

Frequently asked questions

How do I evidence training of employees without access to Varmo?

Tasks and acknowledgement only reach people with access. Otherwise, record attendance outside Varmo, for example with an attendance list in “Documents & evidence”.

How do I create a training session only for certain people?

Choose a functional role as the target group. If there is no suitable one, create your own functional role and assign the people to it.