ISO IEC 27001 A Complete Guide
You're under pressure. Data breaches are making headlines. Audits are looming. Your organisation needs proof of compliance, not just promises. But where do you start? The ISO/IEC 27001 standard is dense, complex, and intimidating - especially if you’re leading security efforts without a roadmap. Uncertainty costs money, time, and credibility. Without clarity, even experienced professionals stall when trying to build or maintain an Information Security Management System (ISMS). You need more than theory. You need a step-by-step blueprint that turns regulatory language into real-world action. ISO IEC 27001 A Complete Guide is your proven path from confusion to confidence. This is not just a course - it’s your strategic implementation engine. It delivers everything you need to design, deploy, and sustain a fully compliant ISMS, aligned with global best practices and tailored to your organisation’s risk profile. Imagine walking into your next audit with documentation ready, controls justified, and evidence on hand. One senior compliance officer used this course to drive certification in under 100 days, navigating a complex multinational structure with confidence. “I went from overwhelmed to auditor-ready in weeks,” she said. “This course structured my entire project.” This guide is built for results. You’ll go from zero knowledge to board-level assurance in a matter of weeks, with a clear, repeatable methodology that produces a mature, audit-ready ISMS backed by formal documentation and decision traceability. No fluff. No guesswork. Just actionable frameworks, tested checklists, and practical templates used by top-tier enterprises. The barrier to entry isn’t technical skill - it’s having the right structure. Here’s how this course is structured to help you get there.Course Format & Delivery Details Learn On Your Terms - With Zero Risk
The ISO IEC 27001 A Complete Guide course is self-paced, on-demand, and immediately accessible online. There are no fixed start dates, no time zones to track, and no live sessions to miss. You control your schedule, your progress, and your learning rhythm - ideal for busy professionals leading compliance initiatives across departments and geographies. Most learners complete the core curriculum in 28 to 40 hours, with tangible results visible within the first 10 hours. You’ll document your first risk assessment, define your scope, and begin building your Statement of Applicability before week two. Lifetime Access. Zero Extra Cost. Always Updated.
You receive lifetime access to all course materials, including every future update at no additional cost. As ISO/IEC 27001 evolves and new guidance emerges, your access automatically includes revised templates, updated checklists, and expanded best practices. All content is mobile-friendly and fully compatible with desktop, tablet, and smartphone devices. Learn during commutes, review frameworks before meetings, or reference templates during implementation - your knowledge stays with you, wherever you work. Structured Support. Real Confidence.
Your learning includes dedicated instructor support via a responsive feedback channel. Whether you’re clarifying control boundaries, reviewing risk treatment plans, or finalising documentation, you gain access to expert guidance grounded in real implementation experience, not theoretical abstraction. Certificate of Completion - Globally Recognised
Upon successful completion, you’ll earn a formal Certificate of Completion issued by The Art of Service. This credential is trusted by professionals in over 140 countries and signals to employers, auditors, and stakeholders that you’ve mastered end-to-end ISMS implementation according to the ISO/IEC 27001 standard. Organisations hiring for compliance, risk, and governance roles consistently cite The Art of Service certifications as evidence of practical expertise and structured thinking. This is not a participation badge - it’s career acceleration. Simple, Transparent Pricing. No Hidden Fees.
The course fee is straightforward, with no recurring charges, surprise fees, or upsells. What you see is what you pay. The entire program - curriculum, tools, templates, support, and certificate - is included in one flat rate. We accept all major payment methods, including Visa, Mastercard, and PayPal, ensuring secure global transactions with instant confirmation. Try It Risk-Free: 30-Day Satisfaction Guarantee
If you’re not satisfied with the course for any reason, return it within 30 days for a full refund. No questions, no forms, no hassle. This is our promise to you: you take zero financial risk. Fully Committed to Your Success - Even If You’re Starting From Zero
“Will this work for me?” Yes - especially if you’re: - A compliance officer needing to lead an ISO 27001 project without external consultants
- An IT manager responsible for security controls but lacking formal training
- A risk professional required to demonstrate governance alignment
- A consultant preparing to deliver ISMS implementations for clients
- A business leader accountable for data protection and audit readiness
This works even if: You’ve never written a risk treatment plan, you’re unsure how to define your ISMS scope, or your organisation lacks documented policies. This course walks you through every decision with precision, clarity, and audit-proof documentation. After enrollment, you’ll receive an automated confirmation email. Your access details and login instructions will follow in a separate communication once your learning environment is prepared - ensuring a secure and structured onboarding experience. You’re not just enrolling in a course. You’re gaining a permanent, upgradable reference system for ISMS excellence - backed by guarantees, global recognition, and lifelong access.
Module 1: Foundations of ISO/IEC 27001 - Understanding the purpose and global relevance of ISO/IEC 27001
- Core principles of information security: confidentiality, integrity, availability
- Overview of the Plan-Do-Check-Act (PDCA) methodology
- Difference between ISO/IEC 27001 and ISO/IEC 27002
- Aligning ISMS objectives with business strategy
- Key terms and definitions in the ISO/IEC 27001 standard
- Understanding the role of risk in information security
- Benefits of certification for compliance, contracts, and reputation
- Common misconceptions and myths about ISO/IEC 27001
- Initial self-assessment: where your organisation currently stands
Module 2: Leadership, Governance, and Management Commitment - Defining top management’s responsibilities under clause 5
- Establishing an ISMS steering committee
- Setting the information security policy with measurable objectives
- Linking security goals to business performance indicators
- Role of the ISMS manager and governance structure
- Appointing accountability for information security roles
- Integrating ISMS into existing management systems
- Securing budget and resources for implementation
- Creating a culture of security awareness
- Documenting leadership involvement and oversight
Module 3: Scope Definition and Context Analysis - How to define the scope of your ISMS accurately
- Internal and external issues affecting information security
- Identifying interested parties and their requirements
- Legal, regulatory, and contractual obligations mapping
- Methods for conducting context analysis
- Using PESTLE analysis for external context
- Stakeholder analysis and engagement planning
- Scope documentation template and criteria
- Common scope errors and how to avoid them
- Presenting scope justification to auditors
Module 4: Risk Assessment and Methodology Design - Principles of information security risk management
- Selecting an appropriate risk assessment methodology
- Defining risk criteria: likelihood, impact, and thresholds
- Identifying assets, threats, vulnerabilities, and consequences
- Asset classification and criticality analysis
- Threat modelling techniques tailored to ISMS
- Vulnerability evaluation based on current controls
- Risk estimation using qualitative and semi-quantitative methods
- Risk evaluation and prioritisation matrix
- Documenting the risk assessment process for audit
Module 5: Risk Treatment Planning and Statement of Applicability - Understanding the four risk treatment options: avoid, transfer, mitigate, accept
- Developing a risk treatment plan with action owners
- Selecting controls from Annex A based on risk findings
- Creating a Statement of Applicability (SoA)
- Justifying inclusion and exclusion of Annex A controls
- Aligning control selection with business risk appetite
- Mapping controls to risk treatment actions
- Setting timelines and milestones for implementation
- Reviewing and approving the SoA by management
- Auditor expectations for SoA completeness and justification
Module 6: Documentation and Record Management - Required documentation per clause 7.5 of ISO/IEC 27001
- Information security policy documentation
- Risk assessment and treatment methodology documents
- Statement of Applicability structure and formatting
- ISMS scope document templates
- Record retention policies and legal compliance
- Version control and document approval workflows
- Secure storage and access to ISMS records
- Creating a documentation hierarchy
- Linking records to audit trails and evidence
Module 7: Control Implementation – Access Control - User registration and de-registration procedures
- Managing privileged access rights
- Password management policies and enforcement
- Multi-factor authentication implementation
- Access control to network and operating systems
- Secure log-on procedures and session timeouts
- User access provisioning and revocation
- Review of user access rights every six months
- Restricting access to source code
- Access control to applications and data files
Module 8: Control Implementation – Cryptography - Use of cryptography to protect information
- Key management policies and lifecycle
- Encryption of data at rest and in transit
- Selecting cryptographic algorithms and standards
- Secure storage and destruction of keys
- Enforcing encryption in cloud environments
- Certificate management and renewal processes
- Protecting intellectual property with cryptographic controls
- Compliance with cryptographic regulations
- Monitoring cryptographic control effectiveness
Module 9: Control Implementation – Physical and Environmental Security - Securing physical entry to offices and data centres
- Protecting against environmental threats (fire, flood, power loss)
- Equipment siting and protection
- Securing cabling and wireless networks
- Handling and disposal of sensitive equipment
- Support utilities and uninterrupted power supplies
- Surveillance and intrusion detection systems
- Secure areas and restricted zones
- Visitor access and escort procedures
- Physical security monitoring and logging
Module 10: Control Implementation – Operations Security - Change management procedures for IT systems
- Capacity management and system performance monitoring
- Protection from malware and malicious code
- Back-up policy and recovery testing
- Logging and monitoring of system activities
- Privileged operations procedures
- Separation of duties in critical systems
- Network configuration and security
- Monitoring the use of utility programs
- Handling technical vulnerabilities and patches
Module 11: Control Implementation – Communications Security - Network security management policies
- Segregation of networks by function and risk
- Web filtering and content inspection tools
- Email security and attachment controls
- Secure use of social media and external networks
- Secure network design and topology
- Monitoring third-party network connections
- Remote access security policies
- Virtual private network (VPN) implementation
- Mobile device communication protection
Module 12: Control Implementation – Supplier Relationships - Information security in supplier agreements
- Assessing supplier security capabilities
- Managing risks in third-party service delivery
- Supplier audit and monitoring procedures
- Service level agreements with security clauses
- Cloud service provider security assessments
- Managing outsourced development and support
- Supplier access to organisational systems
- Incident response coordination with suppliers
- Reviewing supplier compliance annually
Module 13: Control Implementation – Incident Management - Reporting information security events
- Assessing the impact of security incidents
- Responsibilities for incident handling
- Escalation procedures and communication plans
- Containment, eradication, and recovery steps
- Learning from incidents through root cause analysis
- Maintaining incident records and logs
- Testing incident response plans regularly
- Coordinating with law enforcement when necessary
- Improving controls based on incident data
Module 14: Control Implementation – Business Continuity - Planning business continuity for information systems
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Backup strategies and offsite storage
- Disaster recovery planning and site restoration
- Testing and exercising business continuity plans
- Maintaining continuity during system outages
- Roles and responsibilities during disruption
- Alignment with overall organisational resilience
- Updating plans based on organisational changes
Module 15: Control Implementation – Compliance - Identifying applicable legal and regulatory requirements
- Protecting personal and sensitive data (GDPR, CCPA, etc.)
- Intellectual property rights and licensing compliance
- Preventing unauthorised software installation
- Conducting internal compliance monitoring
- Technical compliance with cryptography laws
- Records of regulatory adherence and audits
- Independent reviews of compliance status
- Ensuring protection of records
- Preventing misuse of information processing facilities
Module 16: Internal Audit and Management Review - Planning and conducting internal ISMS audits
- Selecting competent internal auditors
- Creating audit checklists from ISO/IEC 27001 clauses
- Reporting audit findings and non-conformities
- Corrective action tracking and closure
- Management review inputs and agenda
- Presenting performance metrics and audit results
- Reviewing risk treatment plan progress
- Updating ISMS objectives and policies
- Documenting management review decisions
Module 17: Certification Readiness and External Audit Preparation - Selecting a certification body and understanding accreditation
- Preparing for Stage 1 (documentation review) audit
- Preparing for Stage 2 (compliance and implementation) audit
- Common audit findings and how to avoid them
- Responding to non-conformities during audit
- Conducting a pre-certification gap analysis
- Organising evidence for each control
- Training staff for auditor interviews
- Final readiness checklist before audit
- Post-certification maintenance planning
Module 18: Continuous Improvement and ISMS Monitoring - Setting up ISMS performance metrics and KPIs
- Monitoring control effectiveness over time
- Using dashboards for real-time ISMS visibility
- Analysing trends in incidents and risks
- Updating risk assessments annually or after major changes
- Revising the Statement of Applicability as needed
- Integrating new technologies into the ISMS
- Handling organisational changes like mergers or restructures
- Conducting periodic ISMS reviews
- Feeding lessons learned into future planning
Module 19: Advanced Topics and Specialised Environments - Applying ISO/IEC 27001 in cloud computing environments
- Scaling ISMS for small and medium enterprises
- Implementing ISMS in highly regulated industries (finance, healthcare)
- Extending ISMS to supply chain and partners
- Integration with other management systems (ISO 9001, ISO 22301)
- Using ISO/IEC 27001 for cyber insurance applications
- Aligning ISMS with NIST CSF and other frameworks
- Handling multi-jurisdictional compliance
- Managing ISMS in remote and hybrid work environments
- Extending ISMS to IoT and operational technology (OT)
Module 20: Certification, Career Advancement, and Next Steps - How to list your Certificate of Completion on LinkedIn
- Using the certification in job applications and promotions
- Demonstrating ISMS experience in client proposals
- Preparing for advanced certifications (Lead Implementer, Lead Auditor)
- Transitioning from practitioner to consultant
- Building a personal portfolio of ISMS documentation
- Presenting to executives and boards on ISMS value
- Mentoring others in ISO/IEC 27001 implementation
- Staying updated with ISO committee developments
- Accessing The Art of Service alumni resources and updates
- Understanding the purpose and global relevance of ISO/IEC 27001
- Core principles of information security: confidentiality, integrity, availability
- Overview of the Plan-Do-Check-Act (PDCA) methodology
- Difference between ISO/IEC 27001 and ISO/IEC 27002
- Aligning ISMS objectives with business strategy
- Key terms and definitions in the ISO/IEC 27001 standard
- Understanding the role of risk in information security
- Benefits of certification for compliance, contracts, and reputation
- Common misconceptions and myths about ISO/IEC 27001
- Initial self-assessment: where your organisation currently stands
Module 2: Leadership, Governance, and Management Commitment - Defining top management’s responsibilities under clause 5
- Establishing an ISMS steering committee
- Setting the information security policy with measurable objectives
- Linking security goals to business performance indicators
- Role of the ISMS manager and governance structure
- Appointing accountability for information security roles
- Integrating ISMS into existing management systems
- Securing budget and resources for implementation
- Creating a culture of security awareness
- Documenting leadership involvement and oversight
Module 3: Scope Definition and Context Analysis - How to define the scope of your ISMS accurately
- Internal and external issues affecting information security
- Identifying interested parties and their requirements
- Legal, regulatory, and contractual obligations mapping
- Methods for conducting context analysis
- Using PESTLE analysis for external context
- Stakeholder analysis and engagement planning
- Scope documentation template and criteria
- Common scope errors and how to avoid them
- Presenting scope justification to auditors
Module 4: Risk Assessment and Methodology Design - Principles of information security risk management
- Selecting an appropriate risk assessment methodology
- Defining risk criteria: likelihood, impact, and thresholds
- Identifying assets, threats, vulnerabilities, and consequences
- Asset classification and criticality analysis
- Threat modelling techniques tailored to ISMS
- Vulnerability evaluation based on current controls
- Risk estimation using qualitative and semi-quantitative methods
- Risk evaluation and prioritisation matrix
- Documenting the risk assessment process for audit
Module 5: Risk Treatment Planning and Statement of Applicability - Understanding the four risk treatment options: avoid, transfer, mitigate, accept
- Developing a risk treatment plan with action owners
- Selecting controls from Annex A based on risk findings
- Creating a Statement of Applicability (SoA)
- Justifying inclusion and exclusion of Annex A controls
- Aligning control selection with business risk appetite
- Mapping controls to risk treatment actions
- Setting timelines and milestones for implementation
- Reviewing and approving the SoA by management
- Auditor expectations for SoA completeness and justification
Module 6: Documentation and Record Management - Required documentation per clause 7.5 of ISO/IEC 27001
- Information security policy documentation
- Risk assessment and treatment methodology documents
- Statement of Applicability structure and formatting
- ISMS scope document templates
- Record retention policies and legal compliance
- Version control and document approval workflows
- Secure storage and access to ISMS records
- Creating a documentation hierarchy
- Linking records to audit trails and evidence
Module 7: Control Implementation – Access Control - User registration and de-registration procedures
- Managing privileged access rights
- Password management policies and enforcement
- Multi-factor authentication implementation
- Access control to network and operating systems
- Secure log-on procedures and session timeouts
- User access provisioning and revocation
- Review of user access rights every six months
- Restricting access to source code
- Access control to applications and data files
Module 8: Control Implementation – Cryptography - Use of cryptography to protect information
- Key management policies and lifecycle
- Encryption of data at rest and in transit
- Selecting cryptographic algorithms and standards
- Secure storage and destruction of keys
- Enforcing encryption in cloud environments
- Certificate management and renewal processes
- Protecting intellectual property with cryptographic controls
- Compliance with cryptographic regulations
- Monitoring cryptographic control effectiveness
Module 9: Control Implementation – Physical and Environmental Security - Securing physical entry to offices and data centres
- Protecting against environmental threats (fire, flood, power loss)
- Equipment siting and protection
- Securing cabling and wireless networks
- Handling and disposal of sensitive equipment
- Support utilities and uninterrupted power supplies
- Surveillance and intrusion detection systems
- Secure areas and restricted zones
- Visitor access and escort procedures
- Physical security monitoring and logging
Module 10: Control Implementation – Operations Security - Change management procedures for IT systems
- Capacity management and system performance monitoring
- Protection from malware and malicious code
- Back-up policy and recovery testing
- Logging and monitoring of system activities
- Privileged operations procedures
- Separation of duties in critical systems
- Network configuration and security
- Monitoring the use of utility programs
- Handling technical vulnerabilities and patches
Module 11: Control Implementation – Communications Security - Network security management policies
- Segregation of networks by function and risk
- Web filtering and content inspection tools
- Email security and attachment controls
- Secure use of social media and external networks
- Secure network design and topology
- Monitoring third-party network connections
- Remote access security policies
- Virtual private network (VPN) implementation
- Mobile device communication protection
Module 12: Control Implementation – Supplier Relationships - Information security in supplier agreements
- Assessing supplier security capabilities
- Managing risks in third-party service delivery
- Supplier audit and monitoring procedures
- Service level agreements with security clauses
- Cloud service provider security assessments
- Managing outsourced development and support
- Supplier access to organisational systems
- Incident response coordination with suppliers
- Reviewing supplier compliance annually
Module 13: Control Implementation – Incident Management - Reporting information security events
- Assessing the impact of security incidents
- Responsibilities for incident handling
- Escalation procedures and communication plans
- Containment, eradication, and recovery steps
- Learning from incidents through root cause analysis
- Maintaining incident records and logs
- Testing incident response plans regularly
- Coordinating with law enforcement when necessary
- Improving controls based on incident data
Module 14: Control Implementation – Business Continuity - Planning business continuity for information systems
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Backup strategies and offsite storage
- Disaster recovery planning and site restoration
- Testing and exercising business continuity plans
- Maintaining continuity during system outages
- Roles and responsibilities during disruption
- Alignment with overall organisational resilience
- Updating plans based on organisational changes
Module 15: Control Implementation – Compliance - Identifying applicable legal and regulatory requirements
- Protecting personal and sensitive data (GDPR, CCPA, etc.)
- Intellectual property rights and licensing compliance
- Preventing unauthorised software installation
- Conducting internal compliance monitoring
- Technical compliance with cryptography laws
- Records of regulatory adherence and audits
- Independent reviews of compliance status
- Ensuring protection of records
- Preventing misuse of information processing facilities
Module 16: Internal Audit and Management Review - Planning and conducting internal ISMS audits
- Selecting competent internal auditors
- Creating audit checklists from ISO/IEC 27001 clauses
- Reporting audit findings and non-conformities
- Corrective action tracking and closure
- Management review inputs and agenda
- Presenting performance metrics and audit results
- Reviewing risk treatment plan progress
- Updating ISMS objectives and policies
- Documenting management review decisions
Module 17: Certification Readiness and External Audit Preparation - Selecting a certification body and understanding accreditation
- Preparing for Stage 1 (documentation review) audit
- Preparing for Stage 2 (compliance and implementation) audit
- Common audit findings and how to avoid them
- Responding to non-conformities during audit
- Conducting a pre-certification gap analysis
- Organising evidence for each control
- Training staff for auditor interviews
- Final readiness checklist before audit
- Post-certification maintenance planning
Module 18: Continuous Improvement and ISMS Monitoring - Setting up ISMS performance metrics and KPIs
- Monitoring control effectiveness over time
- Using dashboards for real-time ISMS visibility
- Analysing trends in incidents and risks
- Updating risk assessments annually or after major changes
- Revising the Statement of Applicability as needed
- Integrating new technologies into the ISMS
- Handling organisational changes like mergers or restructures
- Conducting periodic ISMS reviews
- Feeding lessons learned into future planning
Module 19: Advanced Topics and Specialised Environments - Applying ISO/IEC 27001 in cloud computing environments
- Scaling ISMS for small and medium enterprises
- Implementing ISMS in highly regulated industries (finance, healthcare)
- Extending ISMS to supply chain and partners
- Integration with other management systems (ISO 9001, ISO 22301)
- Using ISO/IEC 27001 for cyber insurance applications
- Aligning ISMS with NIST CSF and other frameworks
- Handling multi-jurisdictional compliance
- Managing ISMS in remote and hybrid work environments
- Extending ISMS to IoT and operational technology (OT)
Module 20: Certification, Career Advancement, and Next Steps - How to list your Certificate of Completion on LinkedIn
- Using the certification in job applications and promotions
- Demonstrating ISMS experience in client proposals
- Preparing for advanced certifications (Lead Implementer, Lead Auditor)
- Transitioning from practitioner to consultant
- Building a personal portfolio of ISMS documentation
- Presenting to executives and boards on ISMS value
- Mentoring others in ISO/IEC 27001 implementation
- Staying updated with ISO committee developments
- Accessing The Art of Service alumni resources and updates
- How to define the scope of your ISMS accurately
- Internal and external issues affecting information security
- Identifying interested parties and their requirements
- Legal, regulatory, and contractual obligations mapping
- Methods for conducting context analysis
- Using PESTLE analysis for external context
- Stakeholder analysis and engagement planning
- Scope documentation template and criteria
- Common scope errors and how to avoid them
- Presenting scope justification to auditors
Module 4: Risk Assessment and Methodology Design - Principles of information security risk management
- Selecting an appropriate risk assessment methodology
- Defining risk criteria: likelihood, impact, and thresholds
- Identifying assets, threats, vulnerabilities, and consequences
- Asset classification and criticality analysis
- Threat modelling techniques tailored to ISMS
- Vulnerability evaluation based on current controls
- Risk estimation using qualitative and semi-quantitative methods
- Risk evaluation and prioritisation matrix
- Documenting the risk assessment process for audit
Module 5: Risk Treatment Planning and Statement of Applicability - Understanding the four risk treatment options: avoid, transfer, mitigate, accept
- Developing a risk treatment plan with action owners
- Selecting controls from Annex A based on risk findings
- Creating a Statement of Applicability (SoA)
- Justifying inclusion and exclusion of Annex A controls
- Aligning control selection with business risk appetite
- Mapping controls to risk treatment actions
- Setting timelines and milestones for implementation
- Reviewing and approving the SoA by management
- Auditor expectations for SoA completeness and justification
Module 6: Documentation and Record Management - Required documentation per clause 7.5 of ISO/IEC 27001
- Information security policy documentation
- Risk assessment and treatment methodology documents
- Statement of Applicability structure and formatting
- ISMS scope document templates
- Record retention policies and legal compliance
- Version control and document approval workflows
- Secure storage and access to ISMS records
- Creating a documentation hierarchy
- Linking records to audit trails and evidence
Module 7: Control Implementation – Access Control - User registration and de-registration procedures
- Managing privileged access rights
- Password management policies and enforcement
- Multi-factor authentication implementation
- Access control to network and operating systems
- Secure log-on procedures and session timeouts
- User access provisioning and revocation
- Review of user access rights every six months
- Restricting access to source code
- Access control to applications and data files
Module 8: Control Implementation – Cryptography - Use of cryptography to protect information
- Key management policies and lifecycle
- Encryption of data at rest and in transit
- Selecting cryptographic algorithms and standards
- Secure storage and destruction of keys
- Enforcing encryption in cloud environments
- Certificate management and renewal processes
- Protecting intellectual property with cryptographic controls
- Compliance with cryptographic regulations
- Monitoring cryptographic control effectiveness
Module 9: Control Implementation – Physical and Environmental Security - Securing physical entry to offices and data centres
- Protecting against environmental threats (fire, flood, power loss)
- Equipment siting and protection
- Securing cabling and wireless networks
- Handling and disposal of sensitive equipment
- Support utilities and uninterrupted power supplies
- Surveillance and intrusion detection systems
- Secure areas and restricted zones
- Visitor access and escort procedures
- Physical security monitoring and logging
Module 10: Control Implementation – Operations Security - Change management procedures for IT systems
- Capacity management and system performance monitoring
- Protection from malware and malicious code
- Back-up policy and recovery testing
- Logging and monitoring of system activities
- Privileged operations procedures
- Separation of duties in critical systems
- Network configuration and security
- Monitoring the use of utility programs
- Handling technical vulnerabilities and patches
Module 11: Control Implementation – Communications Security - Network security management policies
- Segregation of networks by function and risk
- Web filtering and content inspection tools
- Email security and attachment controls
- Secure use of social media and external networks
- Secure network design and topology
- Monitoring third-party network connections
- Remote access security policies
- Virtual private network (VPN) implementation
- Mobile device communication protection
Module 12: Control Implementation – Supplier Relationships - Information security in supplier agreements
- Assessing supplier security capabilities
- Managing risks in third-party service delivery
- Supplier audit and monitoring procedures
- Service level agreements with security clauses
- Cloud service provider security assessments
- Managing outsourced development and support
- Supplier access to organisational systems
- Incident response coordination with suppliers
- Reviewing supplier compliance annually
Module 13: Control Implementation – Incident Management - Reporting information security events
- Assessing the impact of security incidents
- Responsibilities for incident handling
- Escalation procedures and communication plans
- Containment, eradication, and recovery steps
- Learning from incidents through root cause analysis
- Maintaining incident records and logs
- Testing incident response plans regularly
- Coordinating with law enforcement when necessary
- Improving controls based on incident data
Module 14: Control Implementation – Business Continuity - Planning business continuity for information systems
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Backup strategies and offsite storage
- Disaster recovery planning and site restoration
- Testing and exercising business continuity plans
- Maintaining continuity during system outages
- Roles and responsibilities during disruption
- Alignment with overall organisational resilience
- Updating plans based on organisational changes
Module 15: Control Implementation – Compliance - Identifying applicable legal and regulatory requirements
- Protecting personal and sensitive data (GDPR, CCPA, etc.)
- Intellectual property rights and licensing compliance
- Preventing unauthorised software installation
- Conducting internal compliance monitoring
- Technical compliance with cryptography laws
- Records of regulatory adherence and audits
- Independent reviews of compliance status
- Ensuring protection of records
- Preventing misuse of information processing facilities
Module 16: Internal Audit and Management Review - Planning and conducting internal ISMS audits
- Selecting competent internal auditors
- Creating audit checklists from ISO/IEC 27001 clauses
- Reporting audit findings and non-conformities
- Corrective action tracking and closure
- Management review inputs and agenda
- Presenting performance metrics and audit results
- Reviewing risk treatment plan progress
- Updating ISMS objectives and policies
- Documenting management review decisions
Module 17: Certification Readiness and External Audit Preparation - Selecting a certification body and understanding accreditation
- Preparing for Stage 1 (documentation review) audit
- Preparing for Stage 2 (compliance and implementation) audit
- Common audit findings and how to avoid them
- Responding to non-conformities during audit
- Conducting a pre-certification gap analysis
- Organising evidence for each control
- Training staff for auditor interviews
- Final readiness checklist before audit
- Post-certification maintenance planning
Module 18: Continuous Improvement and ISMS Monitoring - Setting up ISMS performance metrics and KPIs
- Monitoring control effectiveness over time
- Using dashboards for real-time ISMS visibility
- Analysing trends in incidents and risks
- Updating risk assessments annually or after major changes
- Revising the Statement of Applicability as needed
- Integrating new technologies into the ISMS
- Handling organisational changes like mergers or restructures
- Conducting periodic ISMS reviews
- Feeding lessons learned into future planning
Module 19: Advanced Topics and Specialised Environments - Applying ISO/IEC 27001 in cloud computing environments
- Scaling ISMS for small and medium enterprises
- Implementing ISMS in highly regulated industries (finance, healthcare)
- Extending ISMS to supply chain and partners
- Integration with other management systems (ISO 9001, ISO 22301)
- Using ISO/IEC 27001 for cyber insurance applications
- Aligning ISMS with NIST CSF and other frameworks
- Handling multi-jurisdictional compliance
- Managing ISMS in remote and hybrid work environments
- Extending ISMS to IoT and operational technology (OT)
Module 20: Certification, Career Advancement, and Next Steps - How to list your Certificate of Completion on LinkedIn
- Using the certification in job applications and promotions
- Demonstrating ISMS experience in client proposals
- Preparing for advanced certifications (Lead Implementer, Lead Auditor)
- Transitioning from practitioner to consultant
- Building a personal portfolio of ISMS documentation
- Presenting to executives and boards on ISMS value
- Mentoring others in ISO/IEC 27001 implementation
- Staying updated with ISO committee developments
- Accessing The Art of Service alumni resources and updates
- Understanding the four risk treatment options: avoid, transfer, mitigate, accept
- Developing a risk treatment plan with action owners
- Selecting controls from Annex A based on risk findings
- Creating a Statement of Applicability (SoA)
- Justifying inclusion and exclusion of Annex A controls
- Aligning control selection with business risk appetite
- Mapping controls to risk treatment actions
- Setting timelines and milestones for implementation
- Reviewing and approving the SoA by management
- Auditor expectations for SoA completeness and justification
Module 6: Documentation and Record Management - Required documentation per clause 7.5 of ISO/IEC 27001
- Information security policy documentation
- Risk assessment and treatment methodology documents
- Statement of Applicability structure and formatting
- ISMS scope document templates
- Record retention policies and legal compliance
- Version control and document approval workflows
- Secure storage and access to ISMS records
- Creating a documentation hierarchy
- Linking records to audit trails and evidence
Module 7: Control Implementation – Access Control - User registration and de-registration procedures
- Managing privileged access rights
- Password management policies and enforcement
- Multi-factor authentication implementation
- Access control to network and operating systems
- Secure log-on procedures and session timeouts
- User access provisioning and revocation
- Review of user access rights every six months
- Restricting access to source code
- Access control to applications and data files
Module 8: Control Implementation – Cryptography - Use of cryptography to protect information
- Key management policies and lifecycle
- Encryption of data at rest and in transit
- Selecting cryptographic algorithms and standards
- Secure storage and destruction of keys
- Enforcing encryption in cloud environments
- Certificate management and renewal processes
- Protecting intellectual property with cryptographic controls
- Compliance with cryptographic regulations
- Monitoring cryptographic control effectiveness
Module 9: Control Implementation – Physical and Environmental Security - Securing physical entry to offices and data centres
- Protecting against environmental threats (fire, flood, power loss)
- Equipment siting and protection
- Securing cabling and wireless networks
- Handling and disposal of sensitive equipment
- Support utilities and uninterrupted power supplies
- Surveillance and intrusion detection systems
- Secure areas and restricted zones
- Visitor access and escort procedures
- Physical security monitoring and logging
Module 10: Control Implementation – Operations Security - Change management procedures for IT systems
- Capacity management and system performance monitoring
- Protection from malware and malicious code
- Back-up policy and recovery testing
- Logging and monitoring of system activities
- Privileged operations procedures
- Separation of duties in critical systems
- Network configuration and security
- Monitoring the use of utility programs
- Handling technical vulnerabilities and patches
Module 11: Control Implementation – Communications Security - Network security management policies
- Segregation of networks by function and risk
- Web filtering and content inspection tools
- Email security and attachment controls
- Secure use of social media and external networks
- Secure network design and topology
- Monitoring third-party network connections
- Remote access security policies
- Virtual private network (VPN) implementation
- Mobile device communication protection
Module 12: Control Implementation – Supplier Relationships - Information security in supplier agreements
- Assessing supplier security capabilities
- Managing risks in third-party service delivery
- Supplier audit and monitoring procedures
- Service level agreements with security clauses
- Cloud service provider security assessments
- Managing outsourced development and support
- Supplier access to organisational systems
- Incident response coordination with suppliers
- Reviewing supplier compliance annually
Module 13: Control Implementation – Incident Management - Reporting information security events
- Assessing the impact of security incidents
- Responsibilities for incident handling
- Escalation procedures and communication plans
- Containment, eradication, and recovery steps
- Learning from incidents through root cause analysis
- Maintaining incident records and logs
- Testing incident response plans regularly
- Coordinating with law enforcement when necessary
- Improving controls based on incident data
Module 14: Control Implementation – Business Continuity - Planning business continuity for information systems
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Backup strategies and offsite storage
- Disaster recovery planning and site restoration
- Testing and exercising business continuity plans
- Maintaining continuity during system outages
- Roles and responsibilities during disruption
- Alignment with overall organisational resilience
- Updating plans based on organisational changes
Module 15: Control Implementation – Compliance - Identifying applicable legal and regulatory requirements
- Protecting personal and sensitive data (GDPR, CCPA, etc.)
- Intellectual property rights and licensing compliance
- Preventing unauthorised software installation
- Conducting internal compliance monitoring
- Technical compliance with cryptography laws
- Records of regulatory adherence and audits
- Independent reviews of compliance status
- Ensuring protection of records
- Preventing misuse of information processing facilities
Module 16: Internal Audit and Management Review - Planning and conducting internal ISMS audits
- Selecting competent internal auditors
- Creating audit checklists from ISO/IEC 27001 clauses
- Reporting audit findings and non-conformities
- Corrective action tracking and closure
- Management review inputs and agenda
- Presenting performance metrics and audit results
- Reviewing risk treatment plan progress
- Updating ISMS objectives and policies
- Documenting management review decisions
Module 17: Certification Readiness and External Audit Preparation - Selecting a certification body and understanding accreditation
- Preparing for Stage 1 (documentation review) audit
- Preparing for Stage 2 (compliance and implementation) audit
- Common audit findings and how to avoid them
- Responding to non-conformities during audit
- Conducting a pre-certification gap analysis
- Organising evidence for each control
- Training staff for auditor interviews
- Final readiness checklist before audit
- Post-certification maintenance planning
Module 18: Continuous Improvement and ISMS Monitoring - Setting up ISMS performance metrics and KPIs
- Monitoring control effectiveness over time
- Using dashboards for real-time ISMS visibility
- Analysing trends in incidents and risks
- Updating risk assessments annually or after major changes
- Revising the Statement of Applicability as needed
- Integrating new technologies into the ISMS
- Handling organisational changes like mergers or restructures
- Conducting periodic ISMS reviews
- Feeding lessons learned into future planning
Module 19: Advanced Topics and Specialised Environments - Applying ISO/IEC 27001 in cloud computing environments
- Scaling ISMS for small and medium enterprises
- Implementing ISMS in highly regulated industries (finance, healthcare)
- Extending ISMS to supply chain and partners
- Integration with other management systems (ISO 9001, ISO 22301)
- Using ISO/IEC 27001 for cyber insurance applications
- Aligning ISMS with NIST CSF and other frameworks
- Handling multi-jurisdictional compliance
- Managing ISMS in remote and hybrid work environments
- Extending ISMS to IoT and operational technology (OT)
Module 20: Certification, Career Advancement, and Next Steps - How to list your Certificate of Completion on LinkedIn
- Using the certification in job applications and promotions
- Demonstrating ISMS experience in client proposals
- Preparing for advanced certifications (Lead Implementer, Lead Auditor)
- Transitioning from practitioner to consultant
- Building a personal portfolio of ISMS documentation
- Presenting to executives and boards on ISMS value
- Mentoring others in ISO/IEC 27001 implementation
- Staying updated with ISO committee developments
- Accessing The Art of Service alumni resources and updates
- User registration and de-registration procedures
- Managing privileged access rights
- Password management policies and enforcement
- Multi-factor authentication implementation
- Access control to network and operating systems
- Secure log-on procedures and session timeouts
- User access provisioning and revocation
- Review of user access rights every six months
- Restricting access to source code
- Access control to applications and data files
Module 8: Control Implementation – Cryptography - Use of cryptography to protect information
- Key management policies and lifecycle
- Encryption of data at rest and in transit
- Selecting cryptographic algorithms and standards
- Secure storage and destruction of keys
- Enforcing encryption in cloud environments
- Certificate management and renewal processes
- Protecting intellectual property with cryptographic controls
- Compliance with cryptographic regulations
- Monitoring cryptographic control effectiveness
Module 9: Control Implementation – Physical and Environmental Security - Securing physical entry to offices and data centres
- Protecting against environmental threats (fire, flood, power loss)
- Equipment siting and protection
- Securing cabling and wireless networks
- Handling and disposal of sensitive equipment
- Support utilities and uninterrupted power supplies
- Surveillance and intrusion detection systems
- Secure areas and restricted zones
- Visitor access and escort procedures
- Physical security monitoring and logging
Module 10: Control Implementation – Operations Security - Change management procedures for IT systems
- Capacity management and system performance monitoring
- Protection from malware and malicious code
- Back-up policy and recovery testing
- Logging and monitoring of system activities
- Privileged operations procedures
- Separation of duties in critical systems
- Network configuration and security
- Monitoring the use of utility programs
- Handling technical vulnerabilities and patches
Module 11: Control Implementation – Communications Security - Network security management policies
- Segregation of networks by function and risk
- Web filtering and content inspection tools
- Email security and attachment controls
- Secure use of social media and external networks
- Secure network design and topology
- Monitoring third-party network connections
- Remote access security policies
- Virtual private network (VPN) implementation
- Mobile device communication protection
Module 12: Control Implementation – Supplier Relationships - Information security in supplier agreements
- Assessing supplier security capabilities
- Managing risks in third-party service delivery
- Supplier audit and monitoring procedures
- Service level agreements with security clauses
- Cloud service provider security assessments
- Managing outsourced development and support
- Supplier access to organisational systems
- Incident response coordination with suppliers
- Reviewing supplier compliance annually
Module 13: Control Implementation – Incident Management - Reporting information security events
- Assessing the impact of security incidents
- Responsibilities for incident handling
- Escalation procedures and communication plans
- Containment, eradication, and recovery steps
- Learning from incidents through root cause analysis
- Maintaining incident records and logs
- Testing incident response plans regularly
- Coordinating with law enforcement when necessary
- Improving controls based on incident data
Module 14: Control Implementation – Business Continuity - Planning business continuity for information systems
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Backup strategies and offsite storage
- Disaster recovery planning and site restoration
- Testing and exercising business continuity plans
- Maintaining continuity during system outages
- Roles and responsibilities during disruption
- Alignment with overall organisational resilience
- Updating plans based on organisational changes
Module 15: Control Implementation – Compliance - Identifying applicable legal and regulatory requirements
- Protecting personal and sensitive data (GDPR, CCPA, etc.)
- Intellectual property rights and licensing compliance
- Preventing unauthorised software installation
- Conducting internal compliance monitoring
- Technical compliance with cryptography laws
- Records of regulatory adherence and audits
- Independent reviews of compliance status
- Ensuring protection of records
- Preventing misuse of information processing facilities
Module 16: Internal Audit and Management Review - Planning and conducting internal ISMS audits
- Selecting competent internal auditors
- Creating audit checklists from ISO/IEC 27001 clauses
- Reporting audit findings and non-conformities
- Corrective action tracking and closure
- Management review inputs and agenda
- Presenting performance metrics and audit results
- Reviewing risk treatment plan progress
- Updating ISMS objectives and policies
- Documenting management review decisions
Module 17: Certification Readiness and External Audit Preparation - Selecting a certification body and understanding accreditation
- Preparing for Stage 1 (documentation review) audit
- Preparing for Stage 2 (compliance and implementation) audit
- Common audit findings and how to avoid them
- Responding to non-conformities during audit
- Conducting a pre-certification gap analysis
- Organising evidence for each control
- Training staff for auditor interviews
- Final readiness checklist before audit
- Post-certification maintenance planning
Module 18: Continuous Improvement and ISMS Monitoring - Setting up ISMS performance metrics and KPIs
- Monitoring control effectiveness over time
- Using dashboards for real-time ISMS visibility
- Analysing trends in incidents and risks
- Updating risk assessments annually or after major changes
- Revising the Statement of Applicability as needed
- Integrating new technologies into the ISMS
- Handling organisational changes like mergers or restructures
- Conducting periodic ISMS reviews
- Feeding lessons learned into future planning
Module 19: Advanced Topics and Specialised Environments - Applying ISO/IEC 27001 in cloud computing environments
- Scaling ISMS for small and medium enterprises
- Implementing ISMS in highly regulated industries (finance, healthcare)
- Extending ISMS to supply chain and partners
- Integration with other management systems (ISO 9001, ISO 22301)
- Using ISO/IEC 27001 for cyber insurance applications
- Aligning ISMS with NIST CSF and other frameworks
- Handling multi-jurisdictional compliance
- Managing ISMS in remote and hybrid work environments
- Extending ISMS to IoT and operational technology (OT)
Module 20: Certification, Career Advancement, and Next Steps - How to list your Certificate of Completion on LinkedIn
- Using the certification in job applications and promotions
- Demonstrating ISMS experience in client proposals
- Preparing for advanced certifications (Lead Implementer, Lead Auditor)
- Transitioning from practitioner to consultant
- Building a personal portfolio of ISMS documentation
- Presenting to executives and boards on ISMS value
- Mentoring others in ISO/IEC 27001 implementation
- Staying updated with ISO committee developments
- Accessing The Art of Service alumni resources and updates
- Securing physical entry to offices and data centres
- Protecting against environmental threats (fire, flood, power loss)
- Equipment siting and protection
- Securing cabling and wireless networks
- Handling and disposal of sensitive equipment
- Support utilities and uninterrupted power supplies
- Surveillance and intrusion detection systems
- Secure areas and restricted zones
- Visitor access and escort procedures
- Physical security monitoring and logging
Module 10: Control Implementation – Operations Security - Change management procedures for IT systems
- Capacity management and system performance monitoring
- Protection from malware and malicious code
- Back-up policy and recovery testing
- Logging and monitoring of system activities
- Privileged operations procedures
- Separation of duties in critical systems
- Network configuration and security
- Monitoring the use of utility programs
- Handling technical vulnerabilities and patches
Module 11: Control Implementation – Communications Security - Network security management policies
- Segregation of networks by function and risk
- Web filtering and content inspection tools
- Email security and attachment controls
- Secure use of social media and external networks
- Secure network design and topology
- Monitoring third-party network connections
- Remote access security policies
- Virtual private network (VPN) implementation
- Mobile device communication protection
Module 12: Control Implementation – Supplier Relationships - Information security in supplier agreements
- Assessing supplier security capabilities
- Managing risks in third-party service delivery
- Supplier audit and monitoring procedures
- Service level agreements with security clauses
- Cloud service provider security assessments
- Managing outsourced development and support
- Supplier access to organisational systems
- Incident response coordination with suppliers
- Reviewing supplier compliance annually
Module 13: Control Implementation – Incident Management - Reporting information security events
- Assessing the impact of security incidents
- Responsibilities for incident handling
- Escalation procedures and communication plans
- Containment, eradication, and recovery steps
- Learning from incidents through root cause analysis
- Maintaining incident records and logs
- Testing incident response plans regularly
- Coordinating with law enforcement when necessary
- Improving controls based on incident data
Module 14: Control Implementation – Business Continuity - Planning business continuity for information systems
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Backup strategies and offsite storage
- Disaster recovery planning and site restoration
- Testing and exercising business continuity plans
- Maintaining continuity during system outages
- Roles and responsibilities during disruption
- Alignment with overall organisational resilience
- Updating plans based on organisational changes
Module 15: Control Implementation – Compliance - Identifying applicable legal and regulatory requirements
- Protecting personal and sensitive data (GDPR, CCPA, etc.)
- Intellectual property rights and licensing compliance
- Preventing unauthorised software installation
- Conducting internal compliance monitoring
- Technical compliance with cryptography laws
- Records of regulatory adherence and audits
- Independent reviews of compliance status
- Ensuring protection of records
- Preventing misuse of information processing facilities
Module 16: Internal Audit and Management Review - Planning and conducting internal ISMS audits
- Selecting competent internal auditors
- Creating audit checklists from ISO/IEC 27001 clauses
- Reporting audit findings and non-conformities
- Corrective action tracking and closure
- Management review inputs and agenda
- Presenting performance metrics and audit results
- Reviewing risk treatment plan progress
- Updating ISMS objectives and policies
- Documenting management review decisions
Module 17: Certification Readiness and External Audit Preparation - Selecting a certification body and understanding accreditation
- Preparing for Stage 1 (documentation review) audit
- Preparing for Stage 2 (compliance and implementation) audit
- Common audit findings and how to avoid them
- Responding to non-conformities during audit
- Conducting a pre-certification gap analysis
- Organising evidence for each control
- Training staff for auditor interviews
- Final readiness checklist before audit
- Post-certification maintenance planning
Module 18: Continuous Improvement and ISMS Monitoring - Setting up ISMS performance metrics and KPIs
- Monitoring control effectiveness over time
- Using dashboards for real-time ISMS visibility
- Analysing trends in incidents and risks
- Updating risk assessments annually or after major changes
- Revising the Statement of Applicability as needed
- Integrating new technologies into the ISMS
- Handling organisational changes like mergers or restructures
- Conducting periodic ISMS reviews
- Feeding lessons learned into future planning
Module 19: Advanced Topics and Specialised Environments - Applying ISO/IEC 27001 in cloud computing environments
- Scaling ISMS for small and medium enterprises
- Implementing ISMS in highly regulated industries (finance, healthcare)
- Extending ISMS to supply chain and partners
- Integration with other management systems (ISO 9001, ISO 22301)
- Using ISO/IEC 27001 for cyber insurance applications
- Aligning ISMS with NIST CSF and other frameworks
- Handling multi-jurisdictional compliance
- Managing ISMS in remote and hybrid work environments
- Extending ISMS to IoT and operational technology (OT)
Module 20: Certification, Career Advancement, and Next Steps - How to list your Certificate of Completion on LinkedIn
- Using the certification in job applications and promotions
- Demonstrating ISMS experience in client proposals
- Preparing for advanced certifications (Lead Implementer, Lead Auditor)
- Transitioning from practitioner to consultant
- Building a personal portfolio of ISMS documentation
- Presenting to executives and boards on ISMS value
- Mentoring others in ISO/IEC 27001 implementation
- Staying updated with ISO committee developments
- Accessing The Art of Service alumni resources and updates
- Network security management policies
- Segregation of networks by function and risk
- Web filtering and content inspection tools
- Email security and attachment controls
- Secure use of social media and external networks
- Secure network design and topology
- Monitoring third-party network connections
- Remote access security policies
- Virtual private network (VPN) implementation
- Mobile device communication protection
Module 12: Control Implementation – Supplier Relationships - Information security in supplier agreements
- Assessing supplier security capabilities
- Managing risks in third-party service delivery
- Supplier audit and monitoring procedures
- Service level agreements with security clauses
- Cloud service provider security assessments
- Managing outsourced development and support
- Supplier access to organisational systems
- Incident response coordination with suppliers
- Reviewing supplier compliance annually
Module 13: Control Implementation – Incident Management - Reporting information security events
- Assessing the impact of security incidents
- Responsibilities for incident handling
- Escalation procedures and communication plans
- Containment, eradication, and recovery steps
- Learning from incidents through root cause analysis
- Maintaining incident records and logs
- Testing incident response plans regularly
- Coordinating with law enforcement when necessary
- Improving controls based on incident data
Module 14: Control Implementation – Business Continuity - Planning business continuity for information systems
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Backup strategies and offsite storage
- Disaster recovery planning and site restoration
- Testing and exercising business continuity plans
- Maintaining continuity during system outages
- Roles and responsibilities during disruption
- Alignment with overall organisational resilience
- Updating plans based on organisational changes
Module 15: Control Implementation – Compliance - Identifying applicable legal and regulatory requirements
- Protecting personal and sensitive data (GDPR, CCPA, etc.)
- Intellectual property rights and licensing compliance
- Preventing unauthorised software installation
- Conducting internal compliance monitoring
- Technical compliance with cryptography laws
- Records of regulatory adherence and audits
- Independent reviews of compliance status
- Ensuring protection of records
- Preventing misuse of information processing facilities
Module 16: Internal Audit and Management Review - Planning and conducting internal ISMS audits
- Selecting competent internal auditors
- Creating audit checklists from ISO/IEC 27001 clauses
- Reporting audit findings and non-conformities
- Corrective action tracking and closure
- Management review inputs and agenda
- Presenting performance metrics and audit results
- Reviewing risk treatment plan progress
- Updating ISMS objectives and policies
- Documenting management review decisions
Module 17: Certification Readiness and External Audit Preparation - Selecting a certification body and understanding accreditation
- Preparing for Stage 1 (documentation review) audit
- Preparing for Stage 2 (compliance and implementation) audit
- Common audit findings and how to avoid them
- Responding to non-conformities during audit
- Conducting a pre-certification gap analysis
- Organising evidence for each control
- Training staff for auditor interviews
- Final readiness checklist before audit
- Post-certification maintenance planning
Module 18: Continuous Improvement and ISMS Monitoring - Setting up ISMS performance metrics and KPIs
- Monitoring control effectiveness over time
- Using dashboards for real-time ISMS visibility
- Analysing trends in incidents and risks
- Updating risk assessments annually or after major changes
- Revising the Statement of Applicability as needed
- Integrating new technologies into the ISMS
- Handling organisational changes like mergers or restructures
- Conducting periodic ISMS reviews
- Feeding lessons learned into future planning
Module 19: Advanced Topics and Specialised Environments - Applying ISO/IEC 27001 in cloud computing environments
- Scaling ISMS for small and medium enterprises
- Implementing ISMS in highly regulated industries (finance, healthcare)
- Extending ISMS to supply chain and partners
- Integration with other management systems (ISO 9001, ISO 22301)
- Using ISO/IEC 27001 for cyber insurance applications
- Aligning ISMS with NIST CSF and other frameworks
- Handling multi-jurisdictional compliance
- Managing ISMS in remote and hybrid work environments
- Extending ISMS to IoT and operational technology (OT)
Module 20: Certification, Career Advancement, and Next Steps - How to list your Certificate of Completion on LinkedIn
- Using the certification in job applications and promotions
- Demonstrating ISMS experience in client proposals
- Preparing for advanced certifications (Lead Implementer, Lead Auditor)
- Transitioning from practitioner to consultant
- Building a personal portfolio of ISMS documentation
- Presenting to executives and boards on ISMS value
- Mentoring others in ISO/IEC 27001 implementation
- Staying updated with ISO committee developments
- Accessing The Art of Service alumni resources and updates
- Reporting information security events
- Assessing the impact of security incidents
- Responsibilities for incident handling
- Escalation procedures and communication plans
- Containment, eradication, and recovery steps
- Learning from incidents through root cause analysis
- Maintaining incident records and logs
- Testing incident response plans regularly
- Coordinating with law enforcement when necessary
- Improving controls based on incident data
Module 14: Control Implementation – Business Continuity - Planning business continuity for information systems
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Backup strategies and offsite storage
- Disaster recovery planning and site restoration
- Testing and exercising business continuity plans
- Maintaining continuity during system outages
- Roles and responsibilities during disruption
- Alignment with overall organisational resilience
- Updating plans based on organisational changes
Module 15: Control Implementation – Compliance - Identifying applicable legal and regulatory requirements
- Protecting personal and sensitive data (GDPR, CCPA, etc.)
- Intellectual property rights and licensing compliance
- Preventing unauthorised software installation
- Conducting internal compliance monitoring
- Technical compliance with cryptography laws
- Records of regulatory adherence and audits
- Independent reviews of compliance status
- Ensuring protection of records
- Preventing misuse of information processing facilities
Module 16: Internal Audit and Management Review - Planning and conducting internal ISMS audits
- Selecting competent internal auditors
- Creating audit checklists from ISO/IEC 27001 clauses
- Reporting audit findings and non-conformities
- Corrective action tracking and closure
- Management review inputs and agenda
- Presenting performance metrics and audit results
- Reviewing risk treatment plan progress
- Updating ISMS objectives and policies
- Documenting management review decisions
Module 17: Certification Readiness and External Audit Preparation - Selecting a certification body and understanding accreditation
- Preparing for Stage 1 (documentation review) audit
- Preparing for Stage 2 (compliance and implementation) audit
- Common audit findings and how to avoid them
- Responding to non-conformities during audit
- Conducting a pre-certification gap analysis
- Organising evidence for each control
- Training staff for auditor interviews
- Final readiness checklist before audit
- Post-certification maintenance planning
Module 18: Continuous Improvement and ISMS Monitoring - Setting up ISMS performance metrics and KPIs
- Monitoring control effectiveness over time
- Using dashboards for real-time ISMS visibility
- Analysing trends in incidents and risks
- Updating risk assessments annually or after major changes
- Revising the Statement of Applicability as needed
- Integrating new technologies into the ISMS
- Handling organisational changes like mergers or restructures
- Conducting periodic ISMS reviews
- Feeding lessons learned into future planning
Module 19: Advanced Topics and Specialised Environments - Applying ISO/IEC 27001 in cloud computing environments
- Scaling ISMS for small and medium enterprises
- Implementing ISMS in highly regulated industries (finance, healthcare)
- Extending ISMS to supply chain and partners
- Integration with other management systems (ISO 9001, ISO 22301)
- Using ISO/IEC 27001 for cyber insurance applications
- Aligning ISMS with NIST CSF and other frameworks
- Handling multi-jurisdictional compliance
- Managing ISMS in remote and hybrid work environments
- Extending ISMS to IoT and operational technology (OT)
Module 20: Certification, Career Advancement, and Next Steps - How to list your Certificate of Completion on LinkedIn
- Using the certification in job applications and promotions
- Demonstrating ISMS experience in client proposals
- Preparing for advanced certifications (Lead Implementer, Lead Auditor)
- Transitioning from practitioner to consultant
- Building a personal portfolio of ISMS documentation
- Presenting to executives and boards on ISMS value
- Mentoring others in ISO/IEC 27001 implementation
- Staying updated with ISO committee developments
- Accessing The Art of Service alumni resources and updates
- Identifying applicable legal and regulatory requirements
- Protecting personal and sensitive data (GDPR, CCPA, etc.)
- Intellectual property rights and licensing compliance
- Preventing unauthorised software installation
- Conducting internal compliance monitoring
- Technical compliance with cryptography laws
- Records of regulatory adherence and audits
- Independent reviews of compliance status
- Ensuring protection of records
- Preventing misuse of information processing facilities
Module 16: Internal Audit and Management Review - Planning and conducting internal ISMS audits
- Selecting competent internal auditors
- Creating audit checklists from ISO/IEC 27001 clauses
- Reporting audit findings and non-conformities
- Corrective action tracking and closure
- Management review inputs and agenda
- Presenting performance metrics and audit results
- Reviewing risk treatment plan progress
- Updating ISMS objectives and policies
- Documenting management review decisions
Module 17: Certification Readiness and External Audit Preparation - Selecting a certification body and understanding accreditation
- Preparing for Stage 1 (documentation review) audit
- Preparing for Stage 2 (compliance and implementation) audit
- Common audit findings and how to avoid them
- Responding to non-conformities during audit
- Conducting a pre-certification gap analysis
- Organising evidence for each control
- Training staff for auditor interviews
- Final readiness checklist before audit
- Post-certification maintenance planning
Module 18: Continuous Improvement and ISMS Monitoring - Setting up ISMS performance metrics and KPIs
- Monitoring control effectiveness over time
- Using dashboards for real-time ISMS visibility
- Analysing trends in incidents and risks
- Updating risk assessments annually or after major changes
- Revising the Statement of Applicability as needed
- Integrating new technologies into the ISMS
- Handling organisational changes like mergers or restructures
- Conducting periodic ISMS reviews
- Feeding lessons learned into future planning
Module 19: Advanced Topics and Specialised Environments - Applying ISO/IEC 27001 in cloud computing environments
- Scaling ISMS for small and medium enterprises
- Implementing ISMS in highly regulated industries (finance, healthcare)
- Extending ISMS to supply chain and partners
- Integration with other management systems (ISO 9001, ISO 22301)
- Using ISO/IEC 27001 for cyber insurance applications
- Aligning ISMS with NIST CSF and other frameworks
- Handling multi-jurisdictional compliance
- Managing ISMS in remote and hybrid work environments
- Extending ISMS to IoT and operational technology (OT)
Module 20: Certification, Career Advancement, and Next Steps - How to list your Certificate of Completion on LinkedIn
- Using the certification in job applications and promotions
- Demonstrating ISMS experience in client proposals
- Preparing for advanced certifications (Lead Implementer, Lead Auditor)
- Transitioning from practitioner to consultant
- Building a personal portfolio of ISMS documentation
- Presenting to executives and boards on ISMS value
- Mentoring others in ISO/IEC 27001 implementation
- Staying updated with ISO committee developments
- Accessing The Art of Service alumni resources and updates
- Selecting a certification body and understanding accreditation
- Preparing for Stage 1 (documentation review) audit
- Preparing for Stage 2 (compliance and implementation) audit
- Common audit findings and how to avoid them
- Responding to non-conformities during audit
- Conducting a pre-certification gap analysis
- Organising evidence for each control
- Training staff for auditor interviews
- Final readiness checklist before audit
- Post-certification maintenance planning
Module 18: Continuous Improvement and ISMS Monitoring - Setting up ISMS performance metrics and KPIs
- Monitoring control effectiveness over time
- Using dashboards for real-time ISMS visibility
- Analysing trends in incidents and risks
- Updating risk assessments annually or after major changes
- Revising the Statement of Applicability as needed
- Integrating new technologies into the ISMS
- Handling organisational changes like mergers or restructures
- Conducting periodic ISMS reviews
- Feeding lessons learned into future planning
Module 19: Advanced Topics and Specialised Environments - Applying ISO/IEC 27001 in cloud computing environments
- Scaling ISMS for small and medium enterprises
- Implementing ISMS in highly regulated industries (finance, healthcare)
- Extending ISMS to supply chain and partners
- Integration with other management systems (ISO 9001, ISO 22301)
- Using ISO/IEC 27001 for cyber insurance applications
- Aligning ISMS with NIST CSF and other frameworks
- Handling multi-jurisdictional compliance
- Managing ISMS in remote and hybrid work environments
- Extending ISMS to IoT and operational technology (OT)
Module 20: Certification, Career Advancement, and Next Steps - How to list your Certificate of Completion on LinkedIn
- Using the certification in job applications and promotions
- Demonstrating ISMS experience in client proposals
- Preparing for advanced certifications (Lead Implementer, Lead Auditor)
- Transitioning from practitioner to consultant
- Building a personal portfolio of ISMS documentation
- Presenting to executives and boards on ISMS value
- Mentoring others in ISO/IEC 27001 implementation
- Staying updated with ISO committee developments
- Accessing The Art of Service alumni resources and updates
- Applying ISO/IEC 27001 in cloud computing environments
- Scaling ISMS for small and medium enterprises
- Implementing ISMS in highly regulated industries (finance, healthcare)
- Extending ISMS to supply chain and partners
- Integration with other management systems (ISO 9001, ISO 22301)
- Using ISO/IEC 27001 for cyber insurance applications
- Aligning ISMS with NIST CSF and other frameworks
- Handling multi-jurisdictional compliance
- Managing ISMS in remote and hybrid work environments
- Extending ISMS to IoT and operational technology (OT)