Skip to content
Keel Docs

Competence & people

An ISMS depends on people knowing what they’re responsible for and being competent to do it. Keel covers the people side with a competence matrix, a staff-facing security digest, and a RACI matrix.

Competence matrix (Clause 7.2)

Section titled “Competence matrix (Clause 7.2)”

In Competence, record each person’s required competence with the basis for it (education, training, experience, or certification), a status of Met / In progress / Gap, the evidence, and an expiry date for certifications. This is the Clause 7.2 requirement: determine the competence security work needs, make sure people have it, and keep proof.

The list view flags gaps, in-progress items, and certifications expiring within 60 days. It pairs with the Training module, which handles awareness training itself.

Picking the person

Section titled “Picking the person”

The Person field lists everyone in People, so a record is tied to that person rather than to a typed name. Each person’s page has a Competence panel listing their records, with an Add competence button that opens the form with them already picked. If People is empty, the field takes a typed name instead. Records made before the picker keep their typed name until you pick someone.

Attaching files

Section titled “Attaching files”

Attach a certificate, screenshot or PDF when you add a record, or later from the record’s Evidence files panel. Each file is stored as evidence, so it also shows in Evidence and follows the same file type and storage limits. Detach removes the file from the record and leaves it in Evidence.

Importing from CSV

Section titled “Importing from CSV”

Import CSV on the Competence page loads many records at once. Start from Download template. The header row can be in any order:

Column Required Values
email email or name Must match someone in People.
name email or name Links when exactly one person in People has that name; otherwise kept as typed.
role No Defaults to the person’s title in People.
competence Yes The required competence.
basis No education, training, experience or certification. Default training.
status No met, in_progress or gap. Default gap.
expires No A date as YYYY-MM-DD.
evidence No Notes, such as a certificate number.

The import is all or nothing. If any row has a problem, nothing is imported and the page lists the first rows to fix. Files are attached per record after import.

Export CSV downloads every record in the same columns, plus the review and created dates, so an auditor gets the register as a file and an export imports back cleanly. A record past its expiry exports as gap.

Required competences

Section titled “Required competences”

The Requirements tab says what each job title must have, for example “every Security Engineer needs Secure coding”. The job title is matched against the title in People, ignoring case. Choose Everyone for a competence all staff need, such as security awareness. When Everyone and a job title both require the same competence, people with that title get the job-title requirement only.

A requirement can name a training course under Met by course. Anyone who completes that course in Training meets the requirement without a separate record.

Matrix view

Section titled “Matrix view”

The Matrix tab shows one row per active person and one column per required competence. Each cell reads Met, In progress, Gap, Expired or No record, and a cell met by a course says so. Former staff are left out. Open gaps only hides people with nothing open.

Create gap records adds a Gap record for every required competence with no record yet, so each one has a row to attach evidence to and a status to move. Each person’s page lists the competences their title requires, with the same button for just that person, an Add record link for each missing one, and Assign for a missing one that a course can meet.

Expiry reminders

Section titled “Expiry reminders”

Owners and admins get an email when a record is within 30 days of its expiry date, and again after it expires. The person the record is about gets it too when they are a member of the workspace. Each record is emailed at most once a week. A record past its expiry date reads as Expired right away, and the daily run then sets it to Gap.

Staff security rules

Section titled “Staff security rules”

Staff security rules is a plain-language digest of what everyone needs to do to keep the company and its customers secure, grouped by topic and printable as a one-pager. Share it in onboarding or pin it on your intranet. It backs the security-awareness expectations behind ISO 27001 and SOC 2. It’s a general awareness digest, so adapt it to your own policies rather than treating it as a substitute for them.

RACI matrix

Section titled “RACI matrix”

In RACI, map who is Responsible, Accountable, Consulted, and Informed across your controls, policies, and risks, which is the “who owns what” auditors ask for. Each item should have exactly one Accountable owner; Keel warns you when any item has none, and selecting a new Accountable replaces the previous one. Switch between the Controls, Policies, and Risks tabs, and export or print the matrix.

Next steps

Section titled “Next steps”