ISO 27001 Information Security Management Training Course

Participants can define a defensible ISMS scope and establish governance responsibilities.

• Analyse internal and external issues affecting information security objectives
• Identify interested parties, security requirements, and contractual obligations
• Define ISMS boundaries across sites, services, data, and technologies
• Document scope exclusions with evidence-based business and risk rationale
• Assign leadership accountability, security roles, authorities, and escalation routes
• Draft an information security policy aligned with organisational direction

Participants can establish measurable ISMS objectives and an implementation plan.

• Translate strategic security needs into measurable ISMS objectives
• Set objective owners, measures, targets, due dates, and resources
• Build an implementation roadmap from clause and control gaps
• Risk acceptance criteria approved by accountable management roles
• Plan changes affecting scope, controls, suppliers, and technology
• Link security objectives to service performance and business priorities

Participants can create an information asset inventory that supports risk assessment.

• Identify information assets, supporting assets, processes, and asset owners
• Create an asset register with ownership, location, classification, and dependencies
• Apply information classification labels using sensitivity and handling requirements
• Define asset lifecycle controls from acquisition through secure disposal
• Map data flows between business processes, applications, suppliers, and locations
• Record acceptable use requirements for information and associated assets

Participants can perform a repeatable, asset-based information security risk assessment.

• ISO/IEC 27005 principles for establishing risk assessment methodology
• Define risk criteria, impact scales, likelihood scales, and thresholds
• Identify threats, vulnerabilities, existing controls, and unwanted incidents
• Write risk scenarios linking assets, threat events, consequences, and owners
• Calculate inherent and residual risk using defined scoring criteria
• Maintain a risk register with assumptions, evidence, and review dates

Participants can select risk treatments and justify control decisions.

• Choose risk avoidance, modification, sharing, retention, or acceptance
• Match treatment options to risk owners and decision authority
• Select Annex A controls against documented risk scenarios
• Distinguish control design, implementation status, and operating effectiveness
• Prepare risk treatment actions with resources, dates, and dependencies
• Obtain recorded approval for residual risk and treatment plans

Participants can produce a traceable Statement of Applicability and control ownership model.

• Structure a Statement of Applicability using Annex A control themes
• Document inclusion, exclusion, implementation status, and control justification
• Trace each applicable control to identified risks and treatment actions
• Assign control owners, operators, reviewers, and evidence custodians
• Build a control library linking policies, procedures, records, and systems
• Review control applicability following material organisational or technology changes

Participants can define people-focused controls and evidence their operation.

• Screening, contractual terms, and employment responsibilities for personnel security
• Security awareness programme based on role-specific threat and policy needs
• Define disciplinary processes for information security policy violations
• Manage joiners, movers, leavers, access changes, and asset returns
• Write operational policies with approval, review, communication, and version control
• Measure awareness outcomes through simulations, assessments, and incident trends

Participants can specify access-control requirements and evidence for key systems.

• Access control policy covering least privilege and segregation of duties
• Role-based access control mapped to business roles and systems
• Privileged access management, emergency access, and session monitoring requirements
• Multi-factor authentication selection based on risk and service criticality
• Access recertification procedures using owner attestations and exception records
• Cryptographic key management covering generation, storage, rotation, and revocation

Participants can establish operational security controls for managed technology services.

• Configuration baselines for servers, endpoints, network devices, and cloud services
• Change management records including security assessment, approval, testing, and rollback
• Vulnerability management from discovery through remediation verification and reporting
• Patch management priorities based on exploitability, exposure, and asset criticality
• Logging requirements, retention periods, time synchronisation, and review responsibilities
• Malware protection, endpoint detection, and response operational evidence

Participants can apply ISMS control requirements to software delivery and cloud services.

• Secure development lifecycle stages from requirements through release and maintenance
• Threat modelling using STRIDE for applications and service interfaces
• Security requirements embedded within user stories, acceptance criteria, and designs
• Code review, dependency scanning, and security testing evidence
• Cloud shared-responsibility matrices for infrastructure, platform, and software services
• Protect production data through environment separation and controlled test data

Participants can manage supplier security risks and contractual control requirements.

• Supplier due diligence using risk-based security assessment criteria
• Security clauses covering confidentiality, breach notification, audit, and subcontractors
• Define service-level security measures and supplier reporting requirements
• Third-party access approval, monitoring, review, and termination controls
• Information transfer agreements for email, file exchange, and APIs
• Supplier assurance evidence including certifications, reports, and remediation records

Participants can establish an incident management process aligned to ISMS requirements.

• Incident management policy defining reporting channels and classification criteria
• Triage incidents by business impact, urgency, scope, and legal obligations
• Escalation matrices connecting incident severity to decision-makers and communications
• Preserve digital evidence using chain-of-custody records and forensic principles
• Root cause analysis using five whys and fishbone diagrams
• Post-incident lessons translated into corrective actions and control improvements

Participants can connect information security controls to continuity and recovery arrangements.

• Business impact analysis identifying recovery priorities and maximum tolerable downtime
• Recovery time and recovery point objectives for critical information services
• Information security continuity requirements during disruptive events and recovery
• Backup policy covering scope, retention, encryption, restoration, and testing
• Crisis communication procedures for customers, regulators, staff, and suppliers
• Test continuity arrangements through tabletop scenarios and recovery evidence

Participants can manage documented information and assemble evidence of ISMS operation.

• Document control procedures for approval, versioning, distribution, and retention
• Mandatory and useful ISMS records under ISO/IEC 27001
• Evidence matrices linking clauses, controls, owners, records, and systems
• Operational procedures for recurring security activities and control checks
• Define record retention periods from legal, contractual, and risk requirements
• Assess evidence quality using sufficiency, relevance, reliability, and traceability

Participants can measure ISMS performance and prepare management review inputs.

• Design key performance indicators for security objectives and control operation
• Use key risk indicators to monitor changing threat and exposure conditions
• Set measurement methods, data sources, frequency, owners, and thresholds
• Analyse security trends, exceptions, overdue actions, and recurring incidents
• Prepare management review inputs required by ISO/IEC 27001
• Record management review decisions, resource commitments, and improvement actions

Participants can plan a risk-based internal ISMS audit programme.

• ISO 19011 principles of integrity, fair presentation, and confidentiality
• Build an audit programme using risk, change, performance, and prior findings
• Define audit objectives, scope, criteria, methods, and audit team competence
• Prepare audit plans, interview schedules, sampling approaches, and working papers
• Develop clause-based and process-based audit checklists for ISMS evidence
• Maintain auditor independence when auditing owned processes or controls

Participants can gather audit evidence, write findings and follow up corrective actions.

• Open audit meetings with scope, methods, confidentiality, and logistics
• Interview process owners using open questions and evidence follow-up
• Sample records to test control operation over defined periods
• Classify conformity, nonconformity, observation, and opportunity for improvement
• Write nonconformities using requirement, evidence, gap, and impact statements
• Close audits with agreed findings, deadlines, owners, and follow-up actions

Participants can manage nonconformities and drive evidence-based ISMS improvement.

• Log nonconformities with containment, owner, due date, and status
• Determine root causes using causal analysis rather than symptom correction
• Create corrective action plans with verification criteria and accountable owners
• Verify action effectiveness through evidence, testing, and follow-up audit
• Use risk, incidents, metrics, and audits to prioritise improvements
• Prepare certification-readiness reviews against ISO/IEC 27001 requirements

Participants can build, review and present a complete ISO/IEC 27001 ISMS implementation package for a defined organisation.

• Define organisational context, ISMS scope, interested parties, and governance structure
• Present asset inventory, risk assessment, and risk treatment decisions
• Complete Statement of Applicability with control ownership and implementation evidence
• Assemble policies, procedures, metrics, audit plan, and management review inputs
• Review peer challenge on scope, risk rationale, controls, and evidence
• Present phased implementation roadmap, priorities, dependencies, and executive decisions