A tailored course, built for your situation
Deeper command of the ISO 27001 control mapping
Build standards-grade artefacts with confidence in every decision
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
The situation this course is for
Who this is for
Senior Process Executive in a global services firm, responsible for designing, documenting, or overseeing compliance-critical processes aligned to information security standards
Who this is not for
Entry-level staff looking for introductory compliance overviews or professionals outside process design and governance functions
What you walk away with
- Map controls to ISO 27001 Clauses and Annex A with precision and documentation that stands up under review
- Select and justify controls using official commentary, not templates or assumptions
- Build client-facing SoA and CoC documents that reflect intent, not just compliance checkboxes
- Reduce rework by designing controls that align with both operational reality and auditor expectations
- Create repeatable templates for control packages that compound across engagements
The 12 modules (with all 144 chapters)
Module 1. ISO 27001 structure from design intent
Understand how the standard is organized not just by section, but by implementation logic, so you can navigate from clause to control with purpose.
12 chapters in this module
- Core principles of ISMS design
- Clause 4: Context of the organization
- Clause 5: Leadership commitment
- Clause 6: Risk assessment planning
- Clause 7: Support resources
- Clause 8: Operational controls
- Clause 9: Performance evaluation
- Clause 10: Continual improvement
- Annex A vs. main body roles
- How controls trace to clauses
- Intent behind control grouping
- Common misreads of structure
Module 2. Control selection with justification
Stop guessing which controls apply. Learn how to select based on scope, risk profile, and business context, with documented rationale.
12 chapters in this module
- Scoping the ISMS correctly
- Inherent vs. residual risk
- Control applicability statements
- Using risk treatment plans
- Mandatory vs. discretionary controls
- Documenting control justification
- Handling 'not applicable' cases
- Linking controls to risk owners
- Client-specific tailoring
- Auditor expectations on rationale
- Avoiding over-control
- Patterns from real client scopes
Module 3. Annex A deep-dive by domain
Walk through all 93 controls in Annex A with clarity on what each requires, common implementations, and where they intersect.
12 chapters in this module
- A.5 Information security policies
- A.6 Organization of infosec
- A.7 Human resource security
- A.8 Asset management
- A.9 Access control
- A.10 Cryptography
- A.11 Physical security
- A.12 Operations security
- A.13 Communications security
- A.14 System acquisition
- A.15 Supplier relationships
- A.16 Incident management
Module 4. Control implementation patterns
See how top-tier teams implement controls in practice, beyond checklist responses, with scalable, maintainable designs.
12 chapters in this module
- Policy vs. procedure vs. evidence
- Role-based access design
- Logging and monitoring alignment
- Change management integration
- Asset register integration
- User onboarding workflows
- Third-party risk linkages
- Incident response playbooks
- Backup frequency standards
- Patch management cycles
- Encryption key handling
- Secure development practices
Module 5. Statement of Applicability (SoA) mastery
Build SoAs that reflect real design choices, not just compliance defaults, with clean structure, justification, and audit navigation.
12 chapters in this module
- Purpose of the SoA
- Required fields in SoA
- Control status definitions
- Justification writing style
- Referencing risk assessments
- Version control for SoA
- Cross-linking to CoC
- Handling partial implementations
- SoA review cycles
- Client presentation formats
- Common auditor comments
- SoA as living document
Module 6. Control Objectives and Controls (CoC)
Design CoC documents that align with SoA and demonstrate operational reality, not just theoretical compliance.
12 chapters in this module
- Purpose of the CoC
- Structure of control descriptions
- Operational evidence mapping
- Responsibility assignment
- Integration with process docs
- Frequency of execution
- Automation indicators
- Linking to KPIs
- Version control
- Review and sign-off steps
- Handling legacy systems
- Client customization patterns
Module 7. Risk assessment to control traceability
Ensure every control maps back to a documented risk, no orphaned controls, no gaps, full defensibility.
12 chapters in this module
- Risk register structure
- Threat vs. vulnerability
- Impact and likelihood scoring
- Risk treatment options
- Mapping control to risk
- Evidence of treatment
- Risk acceptance documentation
- Review frequency
- Updating after incidents
- Linking to business continuity
- Auditor views on traceability
- Avoiding circular logic
Module 8. Audit-proofing your artefacts
Design documents that preempt auditor questions, clear, consistent, and grounded in standard language.
12 chapters in this module
- Auditor review priorities
- Common findings on controls
- Clarity in documentation
- Avoiding ambiguity traps
- Version consistency
- Evidence readiness
- Cross-referencing between docs
- Handling auditor requests
- Preparing for surprise audits
- Using internal reviews
- Peer validation checklist
- Post-audit update cycle
Module 9. Client-specific tailoring
Adapt frameworks without breaking compliance, learn how to customize while maintaining defensibility.
12 chapters in this module
- Understanding client industry
- Regulatory overlap mapping
- Tailoring without dilution
- Documenting deviations
- Client-specific controls
- Hybrid framework use
- Handling conflicting standards
- Negotiating control scope
- Sign-off workflows
- Change control process
- Reusability across clients
- Knowledge transfer patterns
Module 10. Reusability and compounding artefacts
Stop rebuilding from scratch. Create modular, reusable components that accelerate future work.
12 chapters in this module
- Modular control packaging
- Template standardization
- Version control strategy
- Naming conventions
- Centralized repository design
- Access and update permissions
- Client-specific overrides
- Automated assembly options
- Quality gate checks
- Usage tracking
- Updating after standard changes
- Sharing across teams
Module 11. Cross-functional alignment
Work effectively with IT, security, legal, and operations, translate compliance needs into shared understanding.
12 chapters in this module
- Translating controls to IT
- Working with security teams
- Legal and regulatory alignment
- HR policy integration
- Procurement coordination
- Facilities and physical security
- Change advisory boards
- Incident management roles
- Data governance overlap
- Finance and audit liaison
- Executive reporting links
- Conflict resolution patterns
Module 12. Your implementation playbook
Assemble your personal toolkit with templates, checklists, and decision guides tailored to your delivery style.
12 chapters in this module
- Selecting your core templates
- Customizing SoA format
- Building your control library
- Designing review workflows
- Setting up version tracking
- Creating justification shortcuts
- Developing client onboarding kit
- Assembling audit prep pack
- Integrating with project plans
- Defining quality gates
- Updating for new clients
- Scaling your playbook
How this maps to your situation
- When scoping a new client engagement
- During internal audit preparation
- When revising existing control documentation
- Before signing off on a compliance package
Before vs. after
Before
Control mappings based on templates or past projects, with limited confidence in defensibility under scrutiny.
After
Standards-grade artefacts built with precision, traceability, and justification, ready for audit and client review.
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 18-24 hours of focused work, designed to be completed in short sessions across three weeks.
How this compares to the alternatives
Most courses teach ISO 27001 through overview slides or certification prep. This course is built for practitioners who must produce audit-ready work, focusing on documentation, justification, and implementation design, not memorization.
Frequently asked
Is this aligned with the latest version of ISO 27001?
Yes, all content reflects ISO/IEC 27001:the current cycle requirements and implementation guidance.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Will I get templates I can use with clients?
Yes, every module includes downloadable, customizable templates and real-world examples you can adapt immediately.
$199 one-time. Approximately 18-24 hours of focused work, designed to be completed in short sessions across three weeks..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours