7.2 Competence
anDREa ensures that all personnel performing work that affects our information security performance possess the necessary competence. We systematically evaluate, develop, and document this competence to satisfy ISO/IEC 27001 Clause 7.2 requirements.
7.2.1 Defining Competence Baselines
- Role Profiling: Baseline competencies, technical prerequisites, and security responsibilities are defined for each position within individual Employee Contracts, the HR Manual, and the anDREa Roles and Responsibilities Matrix.
- Cultural Alignment: While specialized technical skills are required, anDREa highly values professional attitude and an active eagerness to learn. Consequently, non-executive personnel are not universally required to hold advanced security certifications immediately upon onboarding, provided they demonstrate equivalent foundational experience.
7.2.2 Competence Development & Certification
To adapt to changing threat landscapes and promote professional development, anDREa actively supports and requires targeted competence expansion:
- Continuous Skill Acquisition: Based on organizational requirements, architectural evolutions, and individual career trajectories, employees may be required to obtain formal professional certifications during their tenure.
- Targeted Certifications: Recommended and mandatory certification benchmarks (such as cloud security, secure development practices, or audit credentials) are mapped to specific positions within the anDREa Roles and Responsibilities Matrix.
- Training Verification: The Management Team evaluates the effectiveness of professional training initiatives annually during performance reviews to ensure that newly acquired skills translate into improved operational security outcomes.
7.2.3 Evidence of Competence
To maintain verifiable compliance and auditability:
- Official evidence of professional competence—including academic degrees, professional certifications, training course completions, and past experience validations—is stored securely within each employee's confidential Employee Contracts.