A tailored course, built for your situation
Deeper command of the ISO 27001 control mapping
A course for practitioners mastering information security governance within global delivery models
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Unclear control ownership slows audits and weakens client confidence
The situation this course is for
In complex engagements, overlapping responsibilities lead to inconsistent control application. Practitioners lack a systematic way to document decisions, resulting in rework during audits and diminished standing when control disputes arise.
Who this is for
Mid-career IC in global services firm, responsible for implementing or governing compliance controls across client projects
Who this is not for
Entry-level auditors, compliance administrators, or those not directly involved in control design or validation
What you walk away with
- Complete ISO 27001 control mappings with documented rationale for each control decision
- Faster consensus across delivery, security, and client teams on control scope
- Higher confidence during audit cycles due to pre-built, defensible documentation
- Clearer role as the internal reference on control ownership
- Reusable templates that accelerate future control deployments
The 12 modules (with all 144 chapters)
Module 1. Scoping the ISO 27001 universe
Define the boundaries of your ISMS with precision, aligning client needs and delivery scope. Learn to document inclusion and exclusion justifications that stand up to scrutiny.
12 chapters in this module
- Understanding ISO 27001 context
- Mapping organizational boundaries
- Identifying external stakeholders
- Defining scope statements
- Documenting justification for exclusions
- Aligning scope with client contracts
- Avoiding over-scope creep
- Using prior audits as reference
- Stakeholder sign-off timing
- Versioning scope documents
- Common scope pitfalls
- Checklist for final approval
Module 2. Asset identification and classification
Build a defensible asset inventory tied to client environments. Focus on consistency, ownership, and sensitivity levels that inform control selection.
12 chapters in this module
- Defining information assets
- Categorizing by client type
- Ownership assignment rules
- Classification levels explained
- Mapping to regulatory needs
- Handling multi-client environments
- Automating asset tracking
- Review cycles for accuracy
- Linking assets to processing activities
- Documenting classification rationale
- Handling shadow assets
- Template for asset register
Module 3. Risk assessment methodology
Adopt a repeatable risk assessment model aligned to ISO 27001:the current cycle. Move beyond checklist thinking to prioritize risks meaningful to delivery outcomes.
12 chapters in this module
- Choosing risk criteria
- Threat source identification
- Vulnerability assessment inputs
- Impact scoring system
- Likelihood rating scale
- Risk treatment options
- Risk acceptance thresholds
- Linking to client SLAs
- Maintaining risk register
- Updating for new projects
- Peer review process
- Audit-ready reporting
Module 4. Control selection and tailoring
Select controls that match actual delivery models. Learn to justify inclusion, exclusion, and adaptation with precision.
12 chapters in this module
- Understanding Annex A controls
- Mapping controls to risks
- Tailoring for client needs
- Documenting deviations
- Justifying control omissions
- Leveraging existing safeguards
- Integration with SOC 2
- Handling shared responsibilities
- Control overlap management
- Version control for mappings
- Client-specific adaptations
- Approval workflow design
Module 5. Statement of Applicability
Build a complete, defensible SoA that withstands internal and external scrutiny. Turn control decisions into narrative clarity.
12 chapters in this module
- SoA structure explained
- Control-by-control justification
- Linking to risk assessment
- Formatting for readability
- Version control strategy
- Client-specific appendices
- Automated SoA generation
- Cross-referencing policies
- Handling auditor questions
- Updating for scope changes
- Sign-off authority levels
- Template and checklist
Module 6. Security policy documentation
Develop modular, reusable policies that scale across engagements. Focus on clarity, ownership, and enforceability.
12 chapters in this module
- Policy structure standards
- Role-based access rules
- Acceptable use clauses
- Incident response commitments
- Third-party obligations
- Client co-signature needs
- Versioning and distribution
- Review cycle management
- Enforcement tracking
- Linking to training
- Audit evidence collection
- Policy exception process
Module 7. Internal audit execution
Run audits that improve control maturity, not just check boxes. Focus on consistency, evidence quality, and actionable follow-up.
12 chapters in this module
- Audit planning calendar
- Checklist development
- Sampling methodology
- Evidence collection standards
- Interview techniques
- Finding severity levels
- Reporting structure
- Follow-up tracking
- Management review inputs
- Audit scope alignment
- Vendor audit coordination
- Audit automation tools
Module 8. Management review and reporting
Prepare concise, decision-ready reports for leadership. Turn audit findings and risk updates into strategic inputs.
12 chapters in this module
- Review meeting frequency
- Agenda structure
- Key metrics to report
- Risk status updates
- Control performance trends
- Resource needs identification
- Client-specific risks
- Regulatory change alerts
- Decision log maintenance
- Action item tracking
- Stakeholder communication
- Template for leadership deck
Module 9. Continuous improvement planning
Embed improvement into operational rhythm. Move beyond annual cycles to real-time control enhancement.
12 chapters in this module
- Identifying improvement triggers
- Feedback loop design
- KPIs for control health
- Root cause analysis
- Change approval workflow
- Impact assessment for updates
- Version control for documents
- Training update cycle
- Client communication plan
- Lessons learned process
- Benchmarking against peers
- Automation opportunities
Module 10. Vendor and third-party oversight
Extend control rigor to partners and suppliers. Ensure downstream compliance without overextending internal teams.
12 chapters in this module
- Vendor risk classification
- Pre-contract assessments
- Due diligence checklist
- Contractual control clauses
- Audit rights negotiation
- Ongoing monitoring plan
- Subcontractor oversight
- Incident response coordination
- Performance review cadence
- Termination triggers
- Centralized vendor register
- Automation for vendor tracking
Module 11. Incident response integration
Align incident response with ISO 27001 requirements. Ensure timely detection, reporting, and remediation that supports certification goals.
12 chapters in this module
- Incident definition standards
- Classification levels
- Reporting workflow
- Escalation paths
- Evidence preservation
- Post-incident review
- Corrective action logging
- Client notification rules
- Regulatory reporting links
- Testing response plans
- Metrics for improvement
- Integration with SIEM
Module 12. Certification readiness and maintenance
Prepare for external audits with confidence. Assemble all required evidence and documentation into a coherent, inspectable package.
12 chapters in this module
- Choosing certification body
- Stage 1 audit prep
- Stage 2 audit prep
- Evidence compilation
- Gap assessment method
- Internal mock audit
- Corrective action plan
- Management review timing
- Continuous surveillance
- Surveillance audit prep
- Re-certification cycle
- Lessons from past audits
How this maps to your situation
- After a new client engagement starts
- Before internal audit cycle
- During ISO certification push
- Following control failure or incident
Before vs. after
Before
Control decisions are inconsistent, documentation is scattered, and ownership is unclear during audits.
After
You produce complete, auditable ISO 27001 control mappings with confidence, becoming the go-to reference across teams.
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 3 hours per module, designed to fit around delivery commitments.
If nothing changes
Without structured control mapping, audits take longer, client trust erodes, and practitioners remain reactive rather than authoritative.
How this compares to the alternatives
Unlike generic online courses, this program delivers field-tested templates and decision trails used in global services firms, tailored to the realities of multi-client, multi-jurisdiction delivery.
Frequently asked
Is this course specific to ISO 27001:the current cycle?
Yes, all content aligns with the ISO 27001:the current cycle update, including new clauses on threat intelligence and information security in project management.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Do you cover integration with other frameworks?
Yes, we include mappings to SOC 2, NIST CSF, and COBIT where relevant, but the focus remains on ISO 27001 mastery.
$199 one-time. Approximately 3 hours per module, designed to fit around delivery commitments..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours