Guide · Confluence

ISO 27001 awareness for staff: how to run a quiz, and keep the evidence

Attestation Flow for Confluence 3.1.0 is the production version (30 October 2026). Last updated 29 October 2026. On the Atlassian Marketplace.

By Bartosz Stankiewicz, founder, Stanki Guild.

ISO/IEC 27001:2022 requires an organisation to make sure people doing work under its control are aware of the information security policy, of their contribution to the management system and of the consequences of not following it (clause 7.3), and Annex A includes a control for information security awareness, education and training (control 6.3). The standard does not prescribe a format. Auditors typically look for records such as training attendance, acknowledged policies or test results.

A quiz is attractive because it does two jobs at once: it delivers the key messages and it produces evidence of understanding. This guide is about that second part, proving that awareness landed, per person and per policy version.

What the evidence should contain

Whatever format your awareness programme takes, a useful record has these properties:

Per person: which named people completed it, as a list, not "all staff".
Per version: tied to the version of the policy or material that was current.
Dated: when each person completed it.
Repeated: on your chosen cycle (annual is a common choice) and after significant policy changes.
Shows understanding, if you use a quiz: the questions, the pass rule and the result.

A slide deck sent by e-mail fails 1, 3 and usually 5. A training session with an attendance sheet usually fails 2 and 5. A quiz tied to the policy version can cover all five.

Writing a quiz that means something

Awareness quizzes often fail by being trivial or patronising. Rules that keep one useful:

Few questions. A handful, around five to ten, each about a behaviour that matters. The goal is recall of what people must do, not an exam.
Ask about the policy, not the vocabulary. "Where do you report a suspected phishing e-mail?" beats "What does ISMS stand for?".
Map each question to the policy text, for example "question 3 tests section 4 of the acceptable use policy". That mapping is what makes the quiz auditable.
Write down the pass rule and the retry rule. "All answers correct, retries allowed" is common and easy to explain.
Review the questions when the policy changes. A quiz written for version 3 says little about version 5.

Running it and keeping the records

Option A, an external tool (a form builder, a survey tool or a learning management system): quick to set up, but the evidence lives outside your document system, usually without a link to the policy version. Export the results per campaign and file them with the policy version they relate to. If the tool cannot export results per person with dates, it is not fit for audit evidence.

Option B, in Confluence next to the policy: the policy page and the confirmation in the same place, with the quiz attached to the confirmation. Confluence has neither read confirmation nor quizzes natively, so this route needs a Marketplace app. Ours, Attestation Flow, can attach up to 10 multiple-choice questions to a page's acknowledgement requirement (paid feature): the reader must answer all of them correctly (or reach a pass mark you set, from 50 percent) before I have read and understood is accepted, the answers are checked on the server, a wrong attempt is told how many answers were right but not which, and the receipt records the page version, the time and the quiz result.

Option C, a workshop plus a quiz: the most effective and the most expensive. Many teams use it for onboarding groups and self-service quizzes for everyone else.

Whatever you choose, rehearse the evidence before the audit: pick one person at random and produce their record for the current policy version. If that takes more than a couple of minutes, fix the mechanics first.

Make the ask small and specific

An r/sysadmin thread on getting a whole company to acknowledge security policies (thread) collects the usual failure modes: blanket e-mails, walls of text nobody reads, policies buried several clicks deep. What helps is a small, specific ask at the right moment: one policy, a short quiz, a confirmation tied to the exact version, and a reminder that names exactly who is still outstanding.

How our app helps

Attestation Flow is our Confluence app. You name the required readers on the policy page; readers confirm with I have read and understood, and with a paid licence you can require up to 10 questions first and a minimum reading time. Each receipt is write-once, bound to the page version, and requested again after every edit. The compliance report (paid) shows who is outstanding per space, with due and overdue status and CSV, Excel and PDF export, and reminder page comments (paid) mention the outstanding readers.

It comes with 16 policy pack templates, each with starter text and quiz questions, including an information security policy (ISO 27001) and an acceptable use policy. Treat the packs' questions as a starting point and write your own from your policy text. Attestation Flow is free for up to 10 users with every feature, then from USD 0.75 per user per month for the first 100 users; without an active paid licence, one page per space can carry a requirement. See the documentation and the comparison with other apps.

Common questions

How many questions should an awareness quiz have?

Enough to cover the behaviours that matter, and few enough that people complete it without resentment; around five to ten is a reasonable target. Map each question to a policy section so the quiz is auditable.

Is a quiz required for ISO 27001?

No. The standard requires awareness and evidence that it is achieved, not a particular method. A quiz is one way to show understanding and keep per-person evidence. Ask your auditor what they expect for your scope.

How often should awareness be repeated?

Annual repetition is a common choice, plus whenever a policy changes significantly and for new starters. Version-bound records make the cycle auditable, because each new policy version asks again.

What about contractors and partners?

Include them if they work with information in the scope of your management system. To confirm in Confluence they need accounts that can open the page; for people without accounts, keep a separate record rather than none.