A tailored course, built for your situation
Deeper command of the ISO 27001 control mapping
A 199 tailored course for Chad Holmes building total fluency in ISO 27001 control implementation at the practitioner level
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Spending too many cycles explaining control mappings or redoing audit outputs
The situation this course is for
Even strong practitioners lose time when control logic isn't internalized. Teams default to templates without understanding the 'why' behind controls, leading to inconsistent mappings, audit rework, and delays in sign-off. The gap isn't knowledge, it's mastery of the framework at a granular level.
Who this is for
Mid-level compliance and risk practitioner at a consulting firm, contributing to ISO 27001 implementations and audit support across federal and commercial clients
Who this is not for
Executives looking for board-level summaries or vendors selling ISO 27001 tooling
What you walk away with
- Map ISO 27001 controls to technical and procedural controls with confidence
- Produce audit-ready statements of applicability without senior review
- Justify control exclusions with source-backed, defensible logic
- Reduce time spent reconciling control evidence by 50%
- Become the reference point for peers on nuanced control interpretation
The 12 modules (with all 144 chapters)
Module 1. Introduction to ISO 27001 control logic
Understand the structure and intent of ISO 27001 Annex A controls. Learn how control groupings relate to real-world risk domains and organizational boundaries.
12 chapters in this module
- Control purpose vs implementation
- Mapping scope to Annex A sections
- Understanding control hierarchies
- Common misinterpretations of control 5.1
- Control 5.2 documentation essentials
- Control 5.3 roles and responsibilities
- Control 5.4 alignment with business objectives
- Control 5.5 due diligence specifics
- Control 5.6 risk assessment criteria
- Control 5.7 risk treatment planning
- Control 5.8 statement of applicability
- Control 5.9 policy maintenance
Module 2. Control 6.1 to 6.3 in practice
Break down access control, asset management, and classification in complex environments. Apply control logic to hybrid cloud, federal systems, and third-party vendors.
12 chapters in this module
- Control 6.1 access control policy
- User access provisioning workflows
- Privileged account controls
- Control 6.2 asset ownership rules
- Asset inventory completeness
- Asset classification tiers
- Control 6.3 media handling procedures
- Classification labels in practice
- Cross-domain data flows
- Handling off-site media
- Media disposal compliance
- User equipment policies
Module 3. Control 7.1 to 7.4 implementation
Address cryptography, network security, and secure configuration with real client examples. Build repeatable artefacts for audit defense.
12 chapters in this module
- Control 7.1 cryptographic usage policy
- Key management lifecycle
- Encrypted data in transit
- Encrypted data at rest
- Control 7.2 network controls
- Segmentation design
- Firewall rule documentation
- Remote access controls
- Secure configuration baselines
- Control 7.3 vulnerability management
- Patch management frequency
- Configuration drift tracking
Module 4. Control 8.1 to 8.3 audit readiness
Prepare for third-party assessments by building evidence trails, control narratives, and exception justifications that stand up under scrutiny.
12 chapters in this module
- Control 8.1 event logging policy
- Log retention duration
- Log access controls
- Log review frequency
- Control 8.2 monitoring tools
- Incident detection thresholds
- Control 8.3 test procedures
- Penetration testing scope
- Vulnerability scanning cadence
- Audit trail completeness
- Log correlation examples
- Monitoring exception tracking
Module 5. Control 9.1 to 9.4 personnel practices
Apply controls to onboarding, offboarding, and role changes. Create defensible HR security processes.
12 chapters in this module
- Control 9.1 screening procedures
- Background checks scope
- Reference verification
- Control 9.2 confidentiality agreements
- NDAs and compliance
- Role-specific agreements
- Control 9.3 onboarding training
- Security awareness delivery
- Role-based training
- Control 9.4 offboarding steps
- Access revocation workflows
- Exit interview documentation
Module 6. Control 10.1 to 10.5 physical security
Map physical and environmental controls to data centers, office spaces, and remote work policies. Handle hybrid setups with precision.
12 chapters in this module
- Control 10.1 secure areas policy
- Access control to servers
- Visitor management
- Control 10.2 equipment protection
- Environmental controls
- UPS and power redundancy
- Fire suppression systems
- Control 10.3 maintenance procedures
- Equipment disposal
- Leased equipment handling
- Control 10.4 downgrading procedures
- Secure sanitization
Module 7. Control 11.1 to 11.3 operations security
Implement change management, backup, and logging at scale. Avoid common drift and reversion issues.
12 chapters in this module
- Control 11.1 change management
- Change approval workflows
- Rollback procedures
- Control 11.2 backup policies
- Backup frequency
- Test restoration
- Data retention alignment
- Control 11.3 event logs
- Log integrity checks
- Time synchronization
- Clock source accuracy
- Log correlation across systems
Module 8. Control 12.1 to 12.4 system acquisition
Apply security throughout the system lifecycle. Influence vendor selection and development practices with confidence.
12 chapters in this module
- Control 12.1 security requirements
- Procurement specifications
- Vendor questionnaires
- Control 12.2 development lifecycle
- Security by design
- Code review practices
- Control 12.3 test data protection
- Masking production data
- Test environment isolation
- Control 12.4 secure deployment
- Deployment window controls
- Post-deployment validation
Module 9. Control 13.1 to 13.3 supplier relationships
Manage third-party risk with structured agreements and monitoring. Drive accountability without overstepping.
12 chapters in this module
- Control 13.1 supplier policies
- Third-party risk categories
- Due diligence depth
- Control 13.2 agreements with security
- SLA security clauses
- Audit rights inclusion
- Control 13.3 monitoring performance
- KPIs for security
- Supplier review meetings
- Incident reporting expectations
- Contract termination clauses
- Onsite audit rights
Module 10. Control 14.1 to 14.3 incident management
Build playbooks that accelerate response and reduce reporting fatigue. Become the anchor in high-pressure situations.
12 chapters in this module
- Control 14.1 incident reporting
- Reporting channels
- Mandatory events
- Control 14.2 response procedures
- Incident triage
- Containment steps
- Eradication workflows
- Recovery validation
- Control 14.3 forensic readiness
- Evidence preservation
- Chain of custody
- Legal hold procedures
Module 11. Control 15.1 to 15.2 business continuity
Align ISO 27001 with BC/DR planning. Ensure controls support resilience without duplication.
12 chapters in this module
- Control 15.1 business continuity
- BCP integration
- Impact analysis
- Recovery time objectives
- Control 15.2 testing frequency
- DR test scheduling
- Tabletop exercise design
- Failover validation
- Recovery point objectives
- Test result documentation
- Improvement tracking
- Stakeholder communication
Module 12. Control 16.1 to 16.2 compliance assurance
Own the compliance narrative end to end. Deliver clean, defensible reports that close loops quickly.
12 chapters in this module
- Control 16.1 legal compliance
- Applicable regulations
- License tracking
- Control 16.2 intellectual property
- Software audits
- Compliance checks
- Control 16.3 personal data
- GDPR alignment
- PII handling
- Control 16.4 proof of compliance
- Audit evidence packaging
- Compliance dashboards
How this maps to your situation
- When onboarding to a new client engagement
- Before audit fieldwork begins
- During control gap assessment
- When building a new statement of applicability
Before vs. after
Before
Relying on team leads for control interpretation and spending cycles reconciling evidence requests
After
Producing audit-ready outputs independently with confidence in every control mapping
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 3 hours per module, designed to fit around client work. Most complete the course in under 6 weeks.
If nothing changes
Continuing to depend on senior reviewers for control justification slows your impact and keeps you out of high-visibility engagements where deep framework mastery is expected
How this compares to the alternatives
Generic ISO 27001 training covers broad policy. This course focuses on the 23% of controls that drive 80% of audit friction and gives you concrete, reusable implementation patterns.
Frequently asked
Is this course only for auditors?
No. It's designed for practitioners implementing controls, writing policies, and preparing for audits, especially in consulting or client-facing roles.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Will I receive a certification?
No. This is a mastery-building course focused on practical implementation, not exam prep.
$199 one-time. Approximately 3 hours per module, designed to fit around client work. Most complete the course in under 6 weeks..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours