Description

This curriculum spans the full lifecycle of an ISO 27001-aligned information security program, equivalent in depth to a multi-phase advisory engagement covering ISMS scoping, risk assessment, control implementation across hybrid environments, third-party risk, incident response, audit, and adaptive threat defense.

Module 1: Establishing the Scope and Boundaries of the ISMS

Determining which business units, systems, and physical locations will be included in the ISMS based on risk exposure and regulatory obligations.
Documenting excluded processes or departments with formal justification to maintain ISO 27001 compliance during certification audits.
Aligning ISMS scope with existing enterprise architecture diagrams and data flow maps to ensure technical coverage.
Resolving conflicts between operational autonomy of business units and centralized security control requirements.
Managing scope creep when third-party vendors or cloud services are integrated post-scoping.
Defining boundary interfaces between in-scope and out-of-scope systems to control data exchange risks.
Obtaining documented approval from senior management on scope decisions to establish accountability.
Reassessing scope following M&A activity or major IT infrastructure changes.

Module 2: Risk Assessment Methodology Design and Execution

Selecting between qualitative and quantitative risk assessment approaches based on data availability and organizational maturity.
Customizing asset valuation criteria to reflect business criticality, legal requirements, and recovery cost implications.
Assigning ownership for high-value assets to ensure accurate threat and vulnerability input during assessments.
Choosing credible threat sources (e.g., internal reports, threat intelligence feeds, industry benchmarks) for realistic scenarios.
Calibrating the risk matrix with organization-specific likelihood and impact thresholds to avoid over- or under-estimation.
Documenting risk acceptance decisions with justification, expiration dates, and required review triggers.
Integrating findings from penetration tests and vulnerability scans into the risk register as evidence.
Scheduling recurring risk assessment cycles that align with budget planning and audit timelines.

Module 3: Statement of Applicability (SoA) Development and Maintenance

Justifying the exclusion of specific Annex A controls with documented risk treatment rationale.
Mapping selected controls to identified risks to demonstrate alignment between risk assessment and mitigation.
Resolving discrepancies between auditor expectations and internal control implementation during SoA reviews.
Updating the SoA following changes in regulatory requirements or business operations.
Ensuring control ownership is assigned and reflected in the SoA for accountability.
Using the SoA as a reference for internal audit planning and control testing frequency.
Managing version control of the SoA to track control additions, removals, or modifications over time.
Aligning SoA control selection with existing technical capabilities to avoid prescribing unimplementable measures.

Module 4: Security Control Implementation in Hybrid Environments

Deploying encryption controls consistently across on-premises databases and SaaS applications with varying API support.
Configuring identity federation to enforce multi-factor authentication without disrupting legacy system access.
Implementing data loss prevention (DLP) policies that account for encrypted traffic and personal devices.
Hardening cloud storage buckets while maintaining performance requirements for data-intensive applications.
Integrating endpoint detection and response (EDR) tools with existing patch management systems to reduce conflicts.
Enforcing access control policies across shared service accounts used by DevOps pipelines.
Applying network segmentation in virtualized environments without introducing latency in critical workflows.
Validating control effectiveness through automated configuration checks and continuous monitoring tools.

Module 5: Third-Party Risk Management and Supplier Security

Classifying vendors based on data access level and system criticality to determine assessment depth.
Negotiating contractual clauses that mandate ISO 27001 compliance or equivalent controls with cloud service providers.
Conducting on-site security audits for high-risk suppliers when remote assessments are insufficient.
Mapping supplier-provided SOC 2 or ISO reports to internal control requirements for gap analysis.
Establishing processes to monitor ongoing compliance of suppliers post-contract award.
Managing sub-processor disclosures and approvals in accordance with data protection regulations.
Defining incident notification timelines and forensic data access rights in vendor agreements.
Decommissioning access and retrieving data upon contract termination in a verifiable manner.

Module 6: Incident Response Planning and Execution

Defining escalation paths that include legal, PR, and regulatory teams for breach scenarios.
Conducting tabletop exercises with cross-functional teams to validate incident response playbooks.
Preserving forensic evidence in cloud environments where data volatility is high.
Coordinating with external CERTs or law enforcement without compromising investigation integrity.
Activating communication protocols to notify affected individuals within 72 hours under GDPR.
Documenting root cause analysis and remediation steps for audit and regulatory reporting.
Testing backup restoration procedures as part of incident recovery validation.
Updating threat intelligence feeds and detection rules based on lessons learned from incidents.

Module 7: Internal Audit and Compliance Monitoring

Selecting audit samples that represent high-risk processes and recent system changes.
Using automated compliance tools to verify configuration settings against control baselines.
Documenting non-conformities with objective evidence and linking them to specific ISO 27001 clauses.
Scheduling audits to avoid conflicts with peak business cycles or system outages.
Ensuring auditor independence when assessing teams they previously managed or designed systems for.
Tracking corrective action plans with defined owners, deadlines, and verification steps.
Reporting audit findings to the steering committee with risk-weighted prioritization.
Integrating audit results into management review meetings for strategic decision-making.

Module 8: Management Review and Continuous Improvement

Presenting key risk indicators (KRIs) and control effectiveness metrics to the executive team in a business-relevant format.
Reviewing changes in legal and regulatory landscape that may require ISMS adjustments.
Evaluating resource requests for new security tools against current risk posture and budget constraints.
Assessing performance of the information security team using SLAs and incident resolution times.
Updating information security objectives annually based on strategic business initiatives.
Documenting management review decisions and action items with traceable follow-up.
Aligning ISMS improvements with enterprise risk management (ERM) priorities.
Measuring the impact of security awareness training on phishing click rates and policy violations.

Module 9: Certification Audit Preparation and Readiness

Conducting a pre-certification gap assessment using a third party to simulate Stage 2 audit conditions.
Compiling evidence for each applicable control, including policies, logs, and approval records.
Rehearsing auditor interviews with control owners to ensure consistent and accurate responses.
Resolving major non-conformities from internal audits before engaging the certification body.
Verifying that all documentation is version-controlled, approved, and accessible to auditors.
Coordinating site access and system log retrieval procedures for remote audit components.
Preparing a formal response package for any findings raised during the audit.
Scheduling surveillance audits and maintaining readiness between certification cycles.

Module 10: Threat Intelligence Integration and Adaptive Defense

Subscribing to industry-specific ISAC feeds to prioritize threat detection rules based on active campaigns.
Mapping MITRE ATT&CK techniques to existing security controls to identify detection gaps.
Automating indicator of compromise (IoC) ingestion into SIEM and firewall blocklists.
Adjusting user access reviews based on observed credential stuffing or phishing trends.
Validating threat intelligence relevance to avoid alert fatigue from false positives.
Sharing anonymized attack data with trusted partners while complying with data privacy laws.
Updating incident response playbooks to reflect new ransomware TTPs observed in the sector.
Conducting red team exercises based on current threat actor behaviors to test detection efficacy.