Personnel should be competent on the basis of appropriate education and experience. Which of the following is a best practice relating to competence?

A.
Appropriate records of education, training, skills and experience need to be maintained.

B.
At least two employees should be suitably trained for each role.

C.
Employees should have at least a relevantbachelors degree.

D.
Personnel should all have a relevant Security training according to ISO/IEC 27002.

Explanation:
A: Correct. This is a best practice according to the standard.
B: Incorrect. This is relevant to availability of resources, however not a best practice for competency.
C: Incorrect. A bachelors degree is not a requirement, relevant training for the role is.
D: Incorrect. This is a specific training for Security, but not a best practice for competency in general.