A tailored course, built for your situation
Mastering ISO 27001 for Transition and Transformation Leaders
Build trusted, reusable compliance artefacts that scale across programs and stakeholders
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Audit packages that demand last-minute fixes and cross-program coordination
The situation this course is for
In complex transformation environments, compliance evidence is often rebuilt from scratch each cycle, creating duplication, stakeholder fatigue, and review delays. The lack of standardized, reusable artefacts means teams restart instead of scaling what works.
Who this is for
Senior project leader in consulting or systems integration, managing multi-phase transitions with compliance dependencies across regions or clients
Who this is not for
Entry-level auditors, standalone security specialists not tied to transformation delivery, or practitioners focused only on technical implementation without cross-functional coordination
What you walk away with
- Produce ISO 27001-compliant evidence packages in under 10 hours using reusable templates
- Standardize control mappings across transformation programs to reduce rework by 70%
- Become the go-to integrator for compliance readiness in multi-vendor delivery
- Reduce stakeholder follow-up cycles by pre-validating evidence with auditor-grade precision
- Scale assurance practices across regions without adding headcount
The 12 modules (with all 144 chapters)
Module 1. Understanding ISO 27001 in Transformation Contexts
Lay the foundation for applying ISO 27001 principles specifically within transition and transformation programs, focusing on integration with existing project governance and stakeholder alignment.
12 chapters in this module
- Defining information security scope in multi-client environments
- Aligning ISO 27001 with CGI’s transformation delivery lifecycle
- Mapping compliance requirements to program milestones
- Integrating risk assessments into change planning phases
- Identifying key stakeholders across business units and regions
- Establishing baseline security controls for new systems
- Documenting asset inventories in hybrid environments
- Setting measurable objectives for information security
- Linking transformation goals to ISO 27001 clauses
- Creating evidence trails that satisfy auditor expectations
- Avoiding common gaps in transformation-related SoA documents
- Using ISO 27001 to strengthen client trust during transitions
Module 2. Scoping Information Security Across Programs
Learn how to define and justify the scope of information security management systems when multiple transformation initiatives overlap across departments and geographies.
12 chapters in this module
- Determining boundaries for integrated transformation projects
- Excluding systems with valid justification and documentation
- Handling shared infrastructure across client engagements
- Documenting scope decisions for internal and external review
- Aligning scope with contractual security obligations
- Managing scope changes during program evolution
- Using architecture diagrams to support scoping decisions
- Ensuring cloud assets are appropriately scoped
- Avoiding over-scoping that increases audit burden
- Leveraging past audits to streamline current scoping
- Securing leadership sign-off on scope statements
- Presenting scope rationale to compliance reviewers
Module 3. Risk Assessment Tailored to Transformation
Adapt ISO 27001 risk assessment methods to the dynamic nature of transition projects, ensuring risks are identified early and managed proactively.
12 chapters in this module
- Integrating risk identification into project kickoffs
- Using threat modeling for new system deployments
- Assessing third-party risks in vendor-led transformations
- Documenting risk treatment plans with clear ownership
- Prioritizing risks based on business impact and likelihood
- Linking risk outcomes to control implementation timelines
- Validating risk assessments with cross-functional input
- Updating risk registers during program pivots
- Aligning risk criteria with organizational risk appetite
- Producing auditor-ready risk assessment reports
- Avoiding generic risk statements in favor of specifics
- Using historical data to inform current risk judgments
Module 4. Building Reusable Control Frameworks
Develop standardized, repeatable control implementations that can be deployed across multiple transformation programs and clients.
12 chapters in this module
- Identifying common control requirements across projects
- Creating modular control implementation guides
- Standardizing access control configurations
- Documenting control evidence for reuse
- Designing templates for policy exception tracking
- Ensuring controls meet ISO 27001 Annex A requirements
- Integrating control testing into QA cycles
- Using automation to maintain control consistency
- Versioning control documentation for audit trails
- Training teams on standardized control application
- Reducing control setup time through reuse
- Validating controls against auditor checklists
Module 5. Managing Vendor and Third-Party Risks
Apply ISO 27001 controls to third-party relationships common in transformation projects, ensuring compliance extends beyond internal teams.
12 chapters in this module
- Assessing vendor security posture during selection
- Incorporating ISO 27001 requirements into RFPs
- Monitoring vendor compliance throughout engagement
- Managing subcontractor access and controls
- Conducting vendor security assessments remotely
- Documenting third-party risk treatment decisions
- Ensuring cloud providers meet control obligations
- Using SIG questionnaires effectively
- Tracking vendor exceptions and remediation
- Aligning vendor SLAs with security requirements
- Reporting vendor risks to program leadership
- Maintaining oversight without direct control
Module 6. Documenting the Statement of Applicability
Create a robust, defensible SoA that clearly justifies control selection and exclusions, tailored to transformation program needs.
12 chapters in this module
- Structuring the SoA for multi-program clarity
- Justifying exclusions with evidence and rationale
- Linking controls to risk treatment decisions
- Using tables to enhance readability for auditors
- Maintaining version history for compliance tracking
- Incorporating feedback from internal reviewers
- Aligning SoA content with organizational policies
- Ensuring all Annex A controls are addressed
- Avoiding vague or boilerplate language
- Using color coding to highlight changes across versions
- Preparing SoA for external audit scrutiny
- Training team members to update the SoA accurately
Module 7. Internal Audit and Readiness Testing
Prepare for certification audits by conducting realistic internal reviews that simulate external assessor behavior.
12 chapters in this module
- Scheduling internal audits around program milestones
- Selecting audit samples across diverse projects
- Using checklists aligned with certification bodies
- Conducting remote evidence collection efficiently
- Interviewing team members on control understanding
- Identifying gaps before external audit begins
- Prioritizing findings based on severity and effort
- Assigning remediation tasks with deadlines
- Tracking closure of audit observations
- Simulating stage 1 and stage 2 audit formats
- Preparing leadership for auditor Q&A
- Building confidence through mock audit cycles
Module 8. Evidence Collection at Scale
Implement systems to gather, organize, and validate compliance evidence across multiple programs and regions.
12 chapters in this module
- Defining evidence requirements by control
- Automating evidence capture from IT systems
- Organizing files for auditor accessibility
- Using metadata to streamline search and retrieval
- Validating evidence completeness before submission
- Standardizing naming conventions across teams
- Securing evidence storage with access controls
- Integrating evidence workflows into project plans
- Reducing manual follow-ups with status dashboards
- Training local teams on evidence submission
- Auditing evidence processes for continuous improvement
- Scaling evidence collection without adding staff
Module 9. Stakeholder Communication and Alignment
Develop communication strategies that keep executives, clients, and technical teams aligned on compliance progress and expectations.
12 chapters in this module
- Tailoring messages to different stakeholder groups
- Reporting progress using ISO 27001 metrics
- Holding compliance sync meetings with program leads
- Addressing resistance to security requirements
- Using dashboards to visualize control coverage
- Escalating blockers with clear context
- Integrating compliance updates into program reports
- Managing expectations around audit timelines
- Sharing success stories across teams
- Building trust through transparency
- Responding to stakeholder inquiries promptly
- Maintaining momentum between audit cycles
Module 10. Continuous Improvement and Surveillance
Establish routines to maintain ISO 27001 compliance between audits and adapt to evolving transformation needs.
12 chapters in this module
- Scheduling regular management reviews
- Updating risk assessments with new threats
- Incorporating lessons from past audits
- Measuring control effectiveness over time
- Adjusting policies based on feedback
- Tracking key performance indicators for security
- Conducting periodic internal audits
- Engaging leadership in continuous improvement
- Updating documentation after system changes
- Monitoring compliance across remote teams
- Using feedback loops to refine processes
- Planning for recertification efficiently
Module 11. Cross-Regional Compliance Coordination
Coordinate ISO 27001 implementation across multiple geographies, accounting for regional differences while maintaining consistency.
12 chapters in this module
- Identifying regional regulatory overlaps
- Standardizing core controls with local adaptations
- Managing time zone challenges in evidence collection
- Training regional teams on central requirements
- Using centralized templates with local inputs
- Resolving conflicts between regional practices
- Ensuring language differences don’t impact clarity
- Auditing remote sites effectively
- Leveraging regional champions for engagement
- Sharing best practices across locations
- Maintaining consistency in documentation
- Scaling compliance leadership across regions
Module 12. Sustaining Compliance Beyond Certification
Ensure ISO 27001 remains embedded in transformation culture long after initial certification, preventing regression.
12 chapters in this module
- Integrating compliance into onboarding
- Updating playbooks with new learnings
- Recognizing teams for compliance excellence
- Building internal expertise through mentoring
- Reinforcing expectations in performance reviews
- Using compliance as a differentiator in proposals
- Sharing maturity metrics with leadership
- Avoiding compliance fatigue through efficiency
- Celebrating audit successes publicly
- Linking compliance to career development
- Institutionalizing lessons in knowledge bases
- Making ISO 27001 a core part of delivery identity
How this maps to your situation
- Transition program governance
- Multi-client compliance alignment
- Vendor-led transformation oversight
- Global stakeholder coordination
Before vs. after
Before
Rebuilding compliance evidence from scratch for each transformation program, facing rework and stakeholder delays
After
Producing auditor-ready ISO 27001 packages in 10 hours using reusable, standardized frameworks across clients and regions
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: 90 minutes of focused learning, structured to fit within a single Sunday morning.
If nothing changes
Without a standardized approach, teams will continue rebuilding compliance artefacts from scratch, increasing cycle time, stakeholder fatigue, and audit risk, especially as regulatory scrutiny intensifies across transformation initiatives.
How this compares to the alternatives
Unlike generic ISO 27001 courses focused on policy writing or checklist compliance, this course is tailored to transformation leaders who must deliver assurance across programs, stakeholders, and regions, without slowing down delivery.
Frequently asked
Is this course relevant if I’m not directly responsible for certification?
Yes. This course is designed for project leaders who must integrate compliance into delivery, whether or not they own final certification.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Will the templates work for multiple clients?
Yes. Templates are designed to be adaptable across engagements while maintaining compliance integrity.
$199 one-time. 90 minutes of focused learning, structured to fit within a single Sunday morning..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours