Description

This curriculum spans the full lifecycle of an ISMS review, equivalent in depth to a multi-phase advisory engagement, covering scope negotiation, risk methodology design, control justification, audit management, and third-party governance as performed in complex, regulated organizations.

Module 1: Scope Definition and Boundary Validation

Determine which business units, systems, and physical locations are included in the ISMS based on data sensitivity and regulatory exposure.
Document exceptions for third-party hosted environments and justify exclusions in alignment with ISO 27001 clause 4.3.
Resolve conflicts between legal departments and IT operations over inclusion of shadow IT systems in the ISMS scope.
Re-scope the ISMS following a corporate merger, incorporating newly acquired subsidiaries while maintaining audit continuity.
Validate cloud service boundaries with CSP responsibility matrices (e.g., AWS Shared Responsibility Model) to assign control ownership.
Address scope creep by establishing change control procedures for adding or removing assets from the ISMS.
Obtain formal sign-off from executive stakeholders on scope documentation to prevent disputes during certification audits.
Map data flows across geographic regions to assess cross-border data transfer implications under GDPR or similar regulations.

Module 2: Risk Assessment Methodology Design

Select between asset-based and process-based risk assessment approaches based on organizational structure and audit readiness.
Define and calibrate risk criteria (likelihood, impact scales) to reflect actual business impact tolerances, not generic templates.
Integrate threat intelligence feeds into risk assessments to ensure threat scenarios reflect current attacker behaviors.
Standardize risk scoring across departments to prevent inconsistent risk ratings due to subjective interpretation.
Justify acceptance of high-risk findings through documented risk treatment plans with time-bound mitigation milestones.
Update risk assessment methodology after significant infrastructure changes, such as migration to hybrid cloud environments.
Reconcile discrepancies between IT risk and information security risk assessments to maintain a single source of truth.
Train business process owners to identify and assess risks within their domains without over-reliance on security staff.

Module 3: Statement of Applicability (SoA) Development

Justify exclusion of Annex A controls by documenting business rationale and compensating controls in the SoA.
Align SoA control selections with sector-specific regulations such as NIST, PCI DSS, or HIPAA where applicable.
Resolve conflicts between internal audit and security teams over control inclusion based on risk treatment decisions.
Version-control the SoA to track changes across certification cycles and support audit trail requirements.
Integrate SoA updates into change management processes to reflect new technology deployments or decommissioning.
Map each SoA control to responsible roles (RACI) to ensure accountability in implementation and monitoring.
Automate SoA status reporting using GRC tools to reduce manual tracking errors and improve update frequency.
Validate control implementation evidence against SoA claims during internal audit walkthroughs.

Module 4: Risk Treatment Plan (RTP) Execution

Prioritize risk treatment actions based on cost-benefit analysis and available budget cycles.
Assign risk treatment ownership to business process managers, not just IT or security teams.
Track RTP progress using KPIs such as % of overdue actions, control maturity scores, and residual risk trends.
Escalate unresolved high-risk items to the risk committee with mitigation alternatives and business impact analysis.
Adjust RTP timelines based on resource availability and competing organizational priorities.
Integrate RTP milestones into project management tools (e.g., Jira, ServiceNow) for real-time visibility.
Conduct quarterly RTP reviews with department heads to maintain accountability and momentum.
Document risk acceptance decisions with expiration dates and re-evaluation triggers.

Module 5: Internal Audit Program Management

Develop an annual audit plan based on risk profile, regulatory requirements, and prior audit findings.
Select auditors with technical expertise relevant to the scope (e.g., cloud, OT, DevOps) to ensure audit depth.
Define audit checklists aligned with SoA and organizational policies to ensure consistent evaluation.
Manage auditor independence when using internal staff by rotating audit assignments and enforcing reporting lines.
Escalate critical non-conformities to executive management with recommended corrective actions.
Track audit findings in a centralized system with status, due dates, and root cause classifications.
Validate effectiveness of corrective actions through follow-up audits, not just documentation review.
Adjust audit frequency for high-risk areas based on incident history and control maturity.

Module 6: Management Review Meeting Preparation

Compile performance metrics such as incident rates, audit findings, training completion, and control effectiveness.
Present trends over time rather than point-in-time data to support strategic decision-making.
Include external factors such as regulatory changes, cyber threat landscape shifts, and audit outcomes.
Prepare decision papers for management on major risks, resource requests, and policy changes.
Ensure meeting minutes document decisions, action items, and assigned owners with deadlines.
Coordinate input from legal, compliance, IT, and business units to provide holistic context.
Align review agenda with ISO 27001 clause 9.3 requirements to maintain certification validity.
Archive review materials for at least three years to support auditor requests during surveillance audits.

Module 7: Continuous Improvement and Corrective Action

Use root cause analysis (e.g., 5 Whys, fishbone) for recurring incidents or audit non-conformities.
Integrate corrective actions into the organization’s issue management system to prevent tracking silos.
Prioritize improvement initiatives based on risk reduction potential and implementation feasibility.
Validate effectiveness of implemented changes through monitoring and follow-up assessments.
Update policies and procedures after corrective actions to prevent recurrence.
Measure improvement cycle time from issue identification to resolution closure.
Escalate stalled corrective actions to senior management with impact analysis and resolution options.
Link improvement outcomes to performance objectives for relevant teams.

Module 8: Certification Audit Readiness and Liaison

Conduct pre-certification gap assessments using external auditors to identify critical deficiencies.
Coordinate evidence collection across departments with defined formats and deadlines.
Prepare staff for auditor interviews by conducting mock sessions focused on control ownership.
Resolve last-minute findings from stage 1 audits before proceeding to stage 2.
Manage auditor access to systems and documentation under confidentiality agreements.
Address auditor findings with formal responses that include root cause and corrective action plans.
Negotiate finding classifications when disagreement exists, supported by documented evidence.
Maintain a post-audit action plan to close minor non-conformities before certification issuance.

Module 9: Third-Party and Supply Chain Integration

Assess supplier risks during onboarding using standardized questionnaires aligned with SoA controls.
Include information security clauses in contracts covering data handling, breach notification, and audit rights.
Monitor supplier compliance through periodic reviews, audits, or attestation reports (e.g., SOC 2).
Map critical vendors into the organization’s risk register and assign risk owners.
Enforce remediation of supplier security gaps through service level agreements (SLAs).
Extend incident response plans to include coordination procedures with key suppliers.
Review cloud provider security controls against internal requirements and update due diligence processes.
Terminate relationships with vendors that repeatedly fail to meet agreed security standards.

Module 10: Policy and Documentation Governance

Establish a document lifecycle process including review cycles, version control, and retirement procedures.
Assign document owners responsible for accuracy, updates, and stakeholder alignment.
Ensure policy language is enforceable and avoids vague terms such as “appropriate” or “reasonable.”
Align policy requirements with technical controls to avoid implementation gaps.
Conduct policy awareness assessments to verify employee understanding beyond acknowledgment.
Automate policy distribution and attestation using identity and access management systems.
Archive superseded documents with access controls to support audit evidence requirements.
Review policy effectiveness annually based on compliance metrics and incident trends.