A tailored course, built for your situation
Mastering ISO 27001 for Social Impact Organization Leaders
Build influence through information governance excellence in mission-driven environments
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Who this is for
C-level leaders in mission-driven organizations responsible for cross-program data integrity, compliance alignment, and external stakeholder trust
Who this is not for
Individuals focused solely on IT security implementation or technical audit execution without strategic oversight
What you walk away with
- Confidently lead ISO 27001 scoping discussions without deferring to consultants
- Own the information classification framework used across teams and partners
- Shape vendor selection criteria with specific controls mapped to ISO 27001 Annex A
- Produce audit-ready statements of applicability (SoA) tailored to nonprofit operations
- Represent your organization as the recognized authority on data governance in cross-sector collaborations
The 12 modules (with all 144 chapters)
Module 1. Understanding ISO 27001 in the Social Sector
Explore how information security applies uniquely to nonprofit operations, including donor data, service delivery records, and cross-agency reporting. Learn the value of formal governance in mission-driven environments.
12 chapters in this module
- Defining information assets in community services
- Why ISO 27001 matters beyond the private sector
- Mapping stakeholder trust requirements
- Compliance culture in nonprofit leadership
- Roles in governance: leader vs. implementer
- How regulators view nonprofit data practices
- Funder expectations on data handling
- Third-party risk in shared service models
- Incident response without IT teams
- Documenting policies for non-technical staff
- Aligning with provincial privacy laws
- Setting governance expectations early
Module 2. Leadership’s Role in Information Governance
Clarify how executive decisions shape security posture. Learn to set tone from the top, allocate resources, and demonstrate commitment through documented actions.
12 chapters in this module
- Executive sponsorship defined
- Setting the information security policy
- Resource allocation for compliance
- Measuring leadership accountability
- Annual review cadence planning
- Linking governance to mission outcomes
- Board communication rhythm
- Reporting progress to stakeholders
- Managing oversight without micromanaging
- Delegating implementation securely
- Recognizing team contributions
- Building governance into performance goals
Module 3. Scope Definition for Nonprofits
Define the boundaries of your information security management system with attention to outsourced programs, shared data systems, and partner dependencies.
12 chapters in this module
- Identifying core service areas
- Mapping data flows across partners
- Including mobile outreach teams
- Excluding non-critical systems
- Documenting scope rationale
- Handling multi-tenant platforms
- Privacy vs. security boundaries
- Scope review with legal counsel
- Updating scope after mergers
- Involving frontline staff
- Visualizing scope for clarity
- Preparing for external audit scrutiny
Module 4. Risk Assessment for Mission-Critical Services
Conduct a practical risk assessment that reflects both operational reality and compliance needs, focusing on data confidentiality and service continuity.
12 chapters in this module
- Identifying information assets
- Classifying data sensitivity levels
- Threat modeling for outreach programs
- Vulnerability in paper-based workflows
- Third-party risk assessment
- Using heat maps effectively
- Prioritizing risks by impact
- Documenting assumptions
- Involving program managers
- Reviewing with external partners
- Updating assessments annually
- Linking risks to controls
Module 5. Statement of Applicability Development
Build a tailored SoA that demonstrates thoughtful control selection, justifications for exclusions, and alignment with nonprofit operating models.
12 chapters in this module
- Downloading the ISO 27001 control set
- Reviewing all 114 controls
- Mapping controls to service areas
- Documenting exclusions clearly
- Justifying control implementation
- Using plain language explanations
- Getting sign-off from leadership
- Version control for updates
- Sharing with auditors proactively
- Benchmarking against peers
- Preparing for challenge questions
- Maintaining the SoA over time
Module 6. Vendor and Partner Security Oversight
Apply ISO 27001 principles to third-party contracts, due diligence, and ongoing monitoring, critical in decentralized service delivery.
12 chapters in this module
- Defining vendor categories
- Requiring ISO 27001 in RFPs
- Reviewing SOC 2 reports
- Assessing cloud providers
- Managing subcontractor risk
- Including data clauses in contracts
- Conducting security questionnaires
- Scheduling vendor reviews
- Documenting due diligence
- Handling non-compliance
- Building exit strategies
- Using audits as improvement tools
Module 7. Internal Audit Preparation and Readiness
Prepare for certification audits with confidence by organizing documentation, conducting pre-checks, and engaging internal teams.
12 chapters in this module
- Selecting an auditor
- Understanding certification timelines
- Organizing evidence files
- Conducting internal gap reviews
- Scheduling team interviews
- Preparing leadership statements
- Creating audit timelines
- Assigning evidence owners
- Running mock audit sessions
- Responding to findings
- Tracking corrective actions
- Maintaining readiness year-round
Module 8. Document Control and Policy Management
Establish simple, effective document management practices that meet ISO 27001 requirements without overburdening staff.
12 chapters in this module
- Defining document types
- Setting version control rules
- Naming conventions for policies
- Storage locations and access
- Review and update schedules
- Training staff on document use
- Handling paper records securely
- Archiving retired documents
- Ensuring availability
- Controlling external sharing
- Tracking access logs
- Auditing document compliance
Module 9. Incident Response for Non-Technical Leaders
Understand how to lead during data incidents with clear communication, stakeholder management, and regulatory notification planning.
12 chapters in this module
- Defining reportable incidents
- Creating response checklists
- Assigning response roles
- Notifying affected individuals
- Reporting to regulators
- Managing media inquiries
- Conducting post-mortems
- Updating policies after events
- Training staff on reporting
- Testing response plans
- Documenting breaches properly
- Learning from peer incidents
Module 10. Awareness Training Without IT Dependency
Lead security culture change through accessible training, communications, and behavior reinforcement tailored to frontline teams.
12 chapters in this module
- Identifying key risk behaviors
- Creating role-specific messages
- Using real examples wisely
- Delivering annual training
- Reinforcing through managers
- Measuring engagement
- Tracking phishing awareness
- Recognizing secure behavior
- Updating content regularly
- Involving volunteers
- Partnering with HR
- Evaluating program effectiveness
Module 11. Continuous Improvement and Management Review
Lead ongoing improvement by reviewing performance metrics, audit results, and changing threats through structured management reviews.
12 chapters in this module
- Scheduling annual reviews
- Preparing review agendas
- Collecting performance data
- Reviewing audit findings
- Assessing risk treatment
- Updating objectives
- Approving policy changes
- Tracking action items
- Involving governance committees
- Benchmarking progress
- Documenting decisions
- Communicating outcomes
Module 12. Sustaining Influence Beyond Certification
Position yourself as the enduring voice on data governance by embedding practices into strategy, funding proposals, and cross-sector initiatives.
12 chapters in this module
- Integrating ISO 27001 into strategic plans
- Referencing compliance in grant applications
- Collaborating with city agencies
- Sharing best practices publicly
- Mentoring peer organizations
- Speaking at sector events
- Updating frameworks as needed
- Balancing innovation and control
- Leading policy coalitions
- Measuring long-term impact
- Re-certification planning
- Leaving a governance legacy
How this maps to your situation
- new leadership responsibility for data governance
- preparing for first certification audit
- managing increased funder reporting demands
- leading consolidation of multiple service programs
Before vs. after
Before
Reliance on external consultants for ISO 27001 decisions and documentation
After
Confident ownership of information governance strategy, stakeholder alignment, and audit readiness
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 3, 4 hours per module, designed for completion over 12 weeks with spaced implementation.
If nothing changes
Without structured governance, organizations face inconsistent practices, increased incident risk, and diminished credibility with funders and partners, limiting growth and collaboration opportunities.
How this compares to the alternatives
Unlike generic compliance courses, this program is tailored to nonprofit leadership contexts, focusing on influence, cross-sector credibility, and practical governance, not technical implementation or audit mechanics.
Frequently asked
Do I need a technical background to benefit from this course?
No. This course is designed for executive leaders who shape policy and oversight, not technical implementers.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Will this help me pass an ISO 27001 audit?
Yes. You’ll gain the knowledge and documentation tools to lead a successful certification process with confidence.
$199 one-time. Approximately 3, 4 hours per module, designed for completion over 12 weeks with spaced implementation..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours