Description

This curriculum spans the design and implementation of foundational information security controls across policy, access, asset, and operational management, comparable in scope to a multi-phase advisory engagement supporting ISO 27001 compliance across global enterprise functions.

Module 1: Information Security Policies (A.5.1)

Select whether to maintain a single overarching information security policy or multiple subordinate policies aligned to business units or risk profiles.
Define review cycles for policy updates based on regulatory changes, audit findings, or shifts in business strategy.
Establish approval workflows requiring sign-off from legal, compliance, and executive stakeholders before policy publication.
Determine how policies will be distributed and acknowledged across global offices with differing employment laws.
Decide on the integration of policy references into employee onboarding and contractor agreements.
Implement version control and archival procedures to support audit traceability of policy changes.
Assess the need for policy exception management procedures with documented justification and risk acceptance.
Map policy clauses directly to relevant Annex A controls for internal audit and compliance reporting.

Module 2: Organizational Roles and Responsibilities (A.5.2)

Assign formal information security roles to existing positions or create dedicated roles such as Data Protection Officer or CISO.
Define segregation of duties between system administration, security monitoring, and audit functions.
Document role-specific access rights and ensure they are reviewed quarterly or after role changes.
Integrate security responsibilities into job descriptions and performance evaluation criteria.
Establish escalation paths for reporting security incidents outside normal management channels.
Designate backup personnel for critical security roles to maintain continuity during absences.
Implement role-based training requirements tied to access privileges and data handling responsibilities.
Review third-party contracts to include explicit security responsibilities for vendors and partners.

Module 3: Inventory of Information and Other Assets (A.5.3)

Select criteria for classifying assets as critical, sensitive, or non-essential based on business impact.
Decide between automated discovery tools and manual asset registers for different asset types.
Define ownership for each asset category and assign responsibility for maintenance and classification.
Integrate asset tagging with procurement and decommissioning processes to maintain accuracy.
Establish procedures for identifying shadow IT assets not managed through standard IT channels.
Link asset records to data protection requirements such as GDPR or HIPAA where applicable.
Implement periodic validation cycles to reconcile asset registers with network scans and CMDBs.
Enforce labeling requirements for physical and digital assets based on classification levels.

Module 4: Acceptable Use of Assets (A.5.4)

Define permitted and prohibited uses of company devices, networks, and cloud services.
Implement technical controls such as URL filtering or application whitelisting to enforce usage policies.
Specify personal use allowances for corporate devices, considering legal and privacy implications.
Require signed acceptable use agreements from employees and contractors before system access.
Configure monitoring mechanisms to detect policy violations without infringing on privacy laws.
Define disciplinary actions for misuse, aligned with HR policies and labor regulations.
Update acceptable use rules when introducing new technologies such as IoT or remote work tools.
Conduct periodic reviews of usage logs to identify emerging risks or policy gaps.

Module 5: Classification and Labeling of Information (A.5.5)

Develop an information classification model with categories such as public, internal, confidential, and restricted.
Assign classification responsibilities to data owners during data creation or acquisition.
Implement automated labeling through data loss prevention (DLP) tools based on content analysis.
Define labeling requirements for emails, documents, databases, and backups.
Train staff on classification criteria and consequences of misclassification.
Establish rules for downgrading classification after retention periods expire.
Enforce handling and transmission rules based on classification level (e.g., encryption for confidential data).
Integrate classification labels into document management and collaboration platforms.

Module 6: Media Handling (A.5.6)

Define secure handling procedures for removable media such as USB drives and external disks.
Implement encryption requirements for all portable storage devices containing sensitive data.
Establish approval workflows for media transfer between secure and unsecured environments.
Design physical storage and access controls for backup tapes and archival media.
Specify sanitization methods for media prior to disposal or reuse (e.g., degaussing, secure wipe).
Document chain-of-custody procedures for media transported offsite.
Restrict media use in high-risk areas such as guest zones or shared workspaces.
Conduct periodic audits of media logs and disposal records for compliance verification.

Module 7: Access Control Policy (A.5.7)

Define access principles such as least privilege, need-to-know, and role-based access control (RBAC).
Map access rights to job functions and ensure alignment with organizational structure.
Establish procedures for granting, modifying, and revoking access during onboarding, transfers, and offboarding.
Implement automated provisioning and deprovisioning through identity management systems.
Define multi-factor authentication requirements based on system sensitivity and access location.
Set password complexity and rotation policies in line with current NIST or equivalent guidance.
Enforce session timeouts and re-authentication for high-risk transactions.
Conduct regular access reviews for privileged accounts and shared credentials.

Module 8: Identity and Access Management (A.5.8)

Select an identity provider (IdP) and determine integration scope with on-premises and cloud systems.
Implement single sign-on (SSO) while managing associated risk of centralized authentication failure.
Define lifecycle management procedures for user identities across systems and applications.
Establish privileged access management (PAM) for administrative and root accounts.
Configure logging and alerting for anomalous login attempts or privilege escalation.
Integrate access requests with ticketing systems and require managerial approval.
Enforce separation between development, testing, and production environment access.
Conduct quarterly access recertification for all users with elevated privileges.

Module 9: Physical and Environmental Security (A.5.9)

Define physical access zones based on asset sensitivity and operational requirements.
Implement access control systems such as keycards, biometrics, or mantraps for data centers.
Establish visitor management procedures including escort requirements and logging.
Design environmental controls for temperature, humidity, and power redundancy in server rooms.
Deploy surveillance systems with defined retention periods and access restrictions.
Secure cabling and network ports to prevent unauthorized physical connections.
Define procedures for responding to physical security incidents such as tailgating or theft.
Conduct regular physical security audits and vulnerability assessments.

Module 10: Operational Security Procedures (A.5.10)

Document standard operating procedures for system backups, patching, and monitoring.
Define change management workflows requiring risk assessment and approval for production changes.
Implement segregation between development, testing, and operational environments.
Establish backup schedules and retention periods based on data criticality and recovery objectives.
Validate backup integrity through periodic restoration tests and document results.
Define logging requirements for systems and applications, including log retention and protection.
Configure centralized log management with access controls and tamper protection.
Conduct periodic reviews of operational procedures to reflect system updates and threat intelligence.