COURSE FORMAT & DELIVERY DETAILS Enroll in Mastering ISO IEC 27001 Implementation and Compliance with complete confidence, knowing you are investing in the most trusted, comprehensive, and results-driven learning experience available for information security professionals. Every element of this course has been designed to eliminate uncertainty, maximise value, and accelerate your ability to implement, manage, and sustain an ISO IEC 27001-compliant Information Security Management System (ISMS) with precision and authority. Fully Self-Paced with Immediate Online Access
This course is structured for professionals who need flexibility without compromise. From the moment you complete your enrollment, you gain secure online access to the full curriculum. There are no rigid schedules, no live sessions to attend, and no time zones to manage. You control when, where, and how you learn - making this ideal for busy consultants, auditors, compliance officers, and IT managers across industries and geographies. On-Demand Learning, Zero Time Commitment Pressure
The entire course is hosted on a 24/7 access platform. There are no fixed start or end dates. You learn at your own pace, fitting study seamlessly into your schedule. Whether you prefer deep-dive sessions on weekends or 30-minute increments during lunch breaks, this format adapts to you - not the other way around. Typical Completion Time & Fast-Track Results
Most learners complete the full course in 25 to 30 hours, depending on their prior knowledge and application speed. Many report implementing foundational ISMS controls and conducting preliminary risk assessments within the first two weeks. You can begin applying what you learn immediately, with actionable frameworks and real-world templates that translate directly into workplace impact. Lifetime Access & Ongoing Free Updates
Your enrollment includes unlimited, lifetime access to all course materials. As ISO IEC 27001 standards evolve and best practices shift, you will receive every update at no extra cost. This is not a one-time snapshot of knowledge - it’s a living, evolving resource that grows with you throughout your career. Global 24/7 Access & Mobile-Friendly Design
Access the course from any device - desktop, tablet, or smartphone - with a seamless, responsive interface. Whether you're commuting, traveling, or working remotely, your progress syncs across all platforms. The system works flawlessly in low-bandwidth environments, ensuring uninterrupted learning for professionals in every region. Direct Instructor Support & Expert Guidance
You are not learning in isolation. Throughout the course, you’ll have access to direct instructor support via secure messaging. Whether you're clarifying audit documentation requirements, refining risk treatment plans, or aligning controls with your organisational context, expert feedback is available to ensure you stay on track and build confidence in your implementation. Certificate of Completion by The Art of Service
Upon finishing the course, you’ll receive a Certificate of Completion issued by The Art of Service - a globally recognised leader in professional training for standards, compliance, and governance. This certificate verifies your mastery of ISO IEC 27001 implementation and carries weight with employers, clients, and regulators worldwide. It's a tangible, career-advancing credential that demonstrates your technical depth, disciplined methodology, and commitment to excellence. Transparent Pricing, No Hidden Fees
The investment is straightforward, with no upsells, no subscriptions, and no surprise charges. What you see is what you get - one all-inclusive fee for lifetime access, unlimited updates, expert support, and your certificate. There are no annual renewal costs or premium tiers. You pay once and retain full access forever. Accepted Payment Methods
We accept Visa, Mastercard, and PayPal - ensuring fast, secure, and globally accessible transactions. All payments are processed through encrypted gateways to protect your financial data and provide peace of mind. 100% Satisfied or Refunded Guarantee
We stand behind the value of this course with a strong satisfaction guarantee. If at any point within the first 30 days you find the content does not meet your expectations, simply contact our support team for a full refund - no questions asked. You take zero financial risk by enrolling today. Confirmation & Access Workflow
After enrollment, you’ll receive an email confirmation. Your access credentials and login details will be sent in a separate email once your course materials are fully configured in the learning environment. This ensures your onboarding is secure, accurate, and tailored to your learning journey. Will This Work for Me?
Yes - regardless of your current role, industry, or experience level. This course has been successfully completed by IT managers in financial services, compliance leads in healthcare, consultants in cybersecurity firms, and internal auditors in government agencies. The structured, step-by-step guides, real-world templates, and repeatable workflows are designed to close knowledge gaps fast. Social proof: “I went from knowing the basics of ISO 27001 to leading a full audit within three months. The templates alone saved my team over 80 hours of work.” – L. Chen, Compliance Director, Australia. Role-specific example: For project managers, the course delivers a proven implementation roadmap with timeline benchmarks and stakeholder communication frameworks. For CISOs, it provides executive-level reporting models and risk oversight dashboards. This works even if: you have never written a Statement of Applicability, have limited budget for consultants, or lead a small team without dedicated compliance staff. The tools you receive are scalable, modular, and designed for real organisational constraints. Zero-Risk Enrollment with Full Confidence
We’ve removed every barrier to your success. With lifetime access, expert support, real templates, a globally recognised certificate, and a full refund option, there is no downside to beginning today. This is not just a course - it’s your personal implementation partner, your long-term compliance ally, and your competitive advantage, guaranteed.
EXTENSIVE & DETAILED COURSE CURRICULUM
Module 1: Foundations of Information Security and ISO IEC 27001 - Understanding the purpose and global relevance of ISO IEC 27001
- Core principles of information security: confidentiality, integrity, availability
- Differentiating between ISO IEC 27001 and other security standards
- Historical evolution of the standard and its key revisions
- Benefits of implementing an ISMS: operational, legal, and commercial
- Common misconceptions about certification and compliance
- Identifying organisational drivers for ISO 27001 adoption
- Overview of the Plan-Do-Check-Act (PDCA) model in ISMS
- The role of top management in information security governance
- Establishing the business case for an ISMS
- Understanding legal, regulatory, and contractual requirements
- Linking security objectives to organisational strategy
- Key terminology and definitions used in the standard
- Introduction to risk-based thinking in information security
- Mapping ISO IEC 27001 to other management system standards
- Fundamentals of confidentiality, integrity, and availability (CIA triad)
- Glossary of 50 essential ISO 27001 terms and acronyms
Module 2: Initiating the ISMS Project - Defining the ISMS scope and boundaries
- Identifying internal and external issues affecting information security
- Stakeholder identification and engagement planning
- Establishing an ISMS project team and roles
- Developing a project charter and governance structure
- Creating a high-level implementation timeline
- Securing executive sponsorship and budget approval
- Conducting a current state assessment
- Gap analysis methodology and tools
- Documenting the organisational context
- Developing the ISMS policy framework
- Setting measurable information security objectives
- Defining success criteria and KPIs
- Identifying resource needs and skill gaps
- Developing a communication plan for all stakeholders
- Creating templates for project documentation
- Using a stage-gate approach for project control
Module 3: Risk Assessment and Treatment Fundamentals - Understanding the risk management process in ISO IEC 27001
- Difference between risk assessment and risk evaluation
- Selecting a risk assessment methodology: qualitative vs quantitative
- Defining risk criteria and risk appetite
- Identifying information assets and their value
- Likelihood and impact scales for risk scoring
- Developing a comprehensive risk register
- Identifying threats, vulnerabilities, and existing controls
- Calculating risk levels and prioritising risks
- Conducting asset-based risk assessments
- Process-based vs system-based risk assessment approaches
- Creating risk assessment workbooks
- Using risk heat maps for visualisation
- Legal, regulatory, and compliance risk identification
- Third-party and supply chain risk considerations
- Documenting risk assessment findings
- Auditing risk assessment processes for credibility
Module 4: Statement of Applicability (SoA) Development - Purpose and structure of the Statement of Applicability
- Mapping Annex A controls to identified risks
- Justifying inclusion and exclusion of controls
- Documenting control objectives and implementation status
- Integrating risk treatment decisions into the SoA
- Version control and change management for the SoA
- Presenting the SoA to auditors and management
- Using automated templates to maintain accuracy
- Linking SoA entries to risk treatment plans
- Best practices for audit readiness
- Ensuring traceability between risks and controls
- Handling partial implementation of controls
- Reporting on control maturity levels
- Reviewing and updating the SoA annually
- Using the SoA in gap analysis and audits
- Working with consultants on SoA validation
- Checklist for SoA finalisation and approval
Module 5: Risk Treatment Planning - Four risk treatment options: avoid, transfer, mitigate, accept
- Selecting appropriate treatment strategies per risk
- Creating detailed risk treatment action plans
- Assigning ownership and accountability
- Setting timelines and milestones
- Linking treatments to resource allocation
- Budgeting for control implementation
- Creating a risk treatment register
- Defining success criteria for each treatment
- Monitoring progress using dashboards
- Integrating treatments into project plans
- Using pilot projects for high-impact controls
- Documenting risk acceptance criteria and approvals
- Ensuring legal review for risk transfers
- Obtaining management sign-off on treatments
- Reviewing treatment effectiveness post-implementation
- Updating the ISMS documentation accordingly
Module 6: Annex A Controls Deep Dive: Organisational Controls - A.5.1 Policies for information security
- A.5.2 Segregation of duties
- A.5.3 Management responsibilities
- A.5.4 Contact with authorities
- A.5.5 Contact with special interest groups
- A.5.6 Information security in project management
- Establishing roles and responsibilities
- Defining access control policy
- Developing acceptable use policies
- Implementing disciplinary processes
- Supplier security policies
- Remote working security policies
- Mobile device security frameworks
- Cloud security governance
- Third-party risk management frameworks
- Confidentiality agreements and NDAs
- Security awareness programme oversight
Module 7: Annex A Controls Deep Dive: People Controls - A.6.1 Screening of candidates
- A.6.2 Terms and conditions of employment
- A.6.3 Information security awareness and training
- A.6.4 Disciplinary process
- A.6.5 Termination responsibilities
- A.6.6 Access rights management
- A.6.7 Return of assets
- Onboarding security checklists
- Role-based training plans
- Phishing simulation and response
- Insider threat detection frameworks
- Post-employment access revocation
- Security induction programmes
- Measuring training effectiveness
- Security competency frameworks
- Conducting security knowledge assessments
- Managing temporary and contract staff access
Module 8: Annex A Controls Deep Dive: Physical and Environmental Controls - A.7.1 Secure areas
- A.7.2 Equipment security
- A.7.3 Secure disposal or reuse of equipment
- A.7.4 Assets outside organisational premises
- Designing secure server rooms and data centres
- Visitor access control procedures
- Physical security monitoring systems
- Environmental controls: fire, water, temperature
- Equipment labeling and tracking
- Secure transportation of devices
- Protection against natural disasters
- Remote work device security standards
- Disposal certification for hardware
- Inventory management for physical assets
- Secure storage for backup media
- Lockdown procedures for breaches
- Physical access logs and audit trails
Module 9: Annex A Controls Deep Dive: Communication and Operations - A.8.1 Operational procedures and responsibilities
- A.8.2 Protection from malware
- A.8.3 Backup
- A.8.4 Logging and monitoring
- A.8.5 Control of operational software
- A.8.6 Technical vulnerability management
- A.8.7 Information systems audit controls
- A.8.8 Network security management
- A.8.9 Security of system engineering principles
- A.8.10 Secure development policy
- A.8.11 System security testing
- A.8.12 Protection of information during exchange
- A.8.13 Electronic messaging security
- A.8.14 Confidentiality of information
- A.8.15 Secure system architecture
- Change management procedures
- Incident response planning
- Privileged access review schedules
- Configuration management databases
- Secure API design
- Network segmentation strategies
- Log retention and analysis
- SOAR integration basics
- Automated alert systems
- Secure code review checklists
- Penetration testing coordination
- Secure configuration baselines
Module 10: Access Control and Identity Management - A.9.1 Access control policy
- A.9.2 User access management
- A.9.3 User responsibilities
- A.9.4 System and application access control
- Principle of least privilege implementation
- Role-based access control (RBAC) design
- Identity and access management (IAM) tools
- Multi-factor authentication rollout
- Service account governance
- Password policy standards
- Emergency access procedures
- Access review and recertification
- Single sign-on (SSO) integration
- Just-in-time access models
- Privileged identity management
- Segregation of duties conflict detection
- Access request workflows
Module 11: Cryptography and Data Security - A.10.1 Cryptographic controls policy
- A.10.2 Key management
- Data classification framework development
- Encryption at rest and in transit
- Email and file encryption tools
- Key lifecycle management
- Secure key storage solutions
- Quantum-safe cryptography awareness
- Tokenisation and data masking
- Database encryption strategies
- Cloud key management (e.g., AWS KMS, Azure Key Vault)
- Hardware security modules (HSMs)
- Digital signatures and non-repudiation
- End-to-end encryption design
- Decrypting without compromising security
- Compliance with encryption export laws
- Key recovery policies
Module 12: Supplier Relationships and Third-Party Security - A.11.1 Supplier relationship information security
- A.11.2 Supplier service delivery management
- Third-party risk assessment templates
- Due diligence checklists for vendors
- Contractual security clauses
- Cloud service provider assessments
- Outsourcing risk management
- Third-party audit rights and access
- Service level agreement (SLA) security metrics
- Penetration testing of supplier systems
- Supply chain vulnerability mapping
- Managed service provider oversight
- Subcontractor risk management
- Onsite supplier access control
- Security questionnaires and assessments (SIG, CAIQ)
- Continuous monitoring of supplier risks
- Exit strategies and data recovery
Module 13: Incident Management and Business Continuity - A.12.1 Management of information security incidents
- A.12.2 Information security event reporting
- A.12.3 Response to information security events
- A.12.4 Learning from information security events
- A.12.5 Collection of evidence
- Incident response team structure
- Incident classification and prioritisation
- Containment, eradication, recovery steps
- Forensic data collection procedures
- Regulatory breach reporting timelines
- Customer and stakeholder notification plans
- Post-incident reviews and root cause analysis
- Incident playbooks for common scenarios
- Threat intelligence integration
- Coordination with law enforcement
- Simulated incident drills
- Business continuity integration
Module 14: Business Continuity and Resilience - A.13.1 Information security in business continuity
- A.13.2 Redundancies in information system
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Critical system identification
- Data backup strategies and frequency
- Disaster recovery site options
- Cloud-based continuity solutions
- War gaming and tabletop exercises
- Failover and failback procedures
- Backup integrity verification
- Testing frequency and documentation
- Ensuring control availability post-disruption
- Third-party continuity planning
- Legal obligations during outages
- Insurance and risk transfer
- Maintaining ISMS during crises
Module 15: Compliance, Legal, and Regulatory Alignment - A.14.1 Compliance with legal and contractual requirements
- Identifying applicable laws (GDPR, HIPAA, CCPA, etc.)
- Regulatory mapping to ISO controls
- Conducting compliance gap assessments
- Freedom of information and privacy laws
- Data sovereignty requirements
- Intellectual property protection
- Monitoring legislative changes
- Records retention and disposal policies
- Evidence collection for auditors
- Penalty avoidance strategies
- Industry-specific regulatory checklists
- International data transfer mechanisms
- Lawful processing grounds
- Regulatory reporting obligations
- Working with data protection officers (DPOs)
- Legal hold procedures
Module 16: Information Security Policies and Documentation - Developing the Information Security Policy
- Acceptable Use Policy (AUP) creation
- Remote Access Policy
- Incident Response Policy
- Acceptable Encryption Policy
- Data Handling Policy
- Physical Security Policy
- Mobile Device Policy
- Cloud Security Policy
- Vendor Security Policy
- Policy review and approval workflows
- Digital policy distribution and attestation
- Version control and change logs
- Policy compliance monitoring
- Automated reminders for reviews
- Policy exception management
- Integration with HR and legal teams
Module 17: Internal Audit and Management Review - A.15.1 Internal audit process
- A.15.2 Management review
- Creating an audit schedule
- Competency requirements for auditors
- Audit checklists aligned with Annex A
- Conducting document reviews
- Interviewing staff during audits
- Reporting audit findings and non-conformities
- Root cause analysis of audit gaps
- Corrective action planning
- Tracking closure of audit actions
- Preparing for external audits
- Presenting audit reports to leadership
- Scheduling regular management reviews
- Demonstrating continual improvement
- Using audit results to update risk assessments
- Integrating audits with other management systems
Module 18: Certification Audit Preparation - Stages of certification: Stage 1 and Stage 2 audits
- Selecting a certification body
- Understanding audit criteria and scoring
- Preparing audit evidence binders
- Organising documentation for auditors
- Conducting pre-certification readiness assessments
- Mock audits and gap closure
- Handling auditor questions and requests
- Responding to non-conformities
- Correcting major and minor findings
- Auditor communication etiquette
- Legal and contractual considerations with CBs
- Post-certification surveillance audits
- Maintaining certification over time
- Re-certification cycle management
- Using certification in marketing and proposals
- Handling adverse audit outcomes
Module 19: Post-Certification Sustainment - Integrating ISMS into daily operations
- Monthly ISMS performance reviews
- Annual internal audit scheduling
- Updating the risk assessment annually
- Reviewing and revising the SoA
- Tracking control effectiveness
- Updating policies and procedures
- Conducting management review meetings
- Reporting to the board or executive team
- Handling organisational changes (M&A, restructuring)
- Scaling the ISMS across departments
- Extending scope for multi-site operations
- Automation of ISMS workflows
- Using GRC platforms for sustainment
- Continuous improvement through feedback loops
- KPI dashboards for leadership
- Renewal planning for certification
Module 20: Advanced Topics and Career Advancement - Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
Module 1: Foundations of Information Security and ISO IEC 27001 - Understanding the purpose and global relevance of ISO IEC 27001
- Core principles of information security: confidentiality, integrity, availability
- Differentiating between ISO IEC 27001 and other security standards
- Historical evolution of the standard and its key revisions
- Benefits of implementing an ISMS: operational, legal, and commercial
- Common misconceptions about certification and compliance
- Identifying organisational drivers for ISO 27001 adoption
- Overview of the Plan-Do-Check-Act (PDCA) model in ISMS
- The role of top management in information security governance
- Establishing the business case for an ISMS
- Understanding legal, regulatory, and contractual requirements
- Linking security objectives to organisational strategy
- Key terminology and definitions used in the standard
- Introduction to risk-based thinking in information security
- Mapping ISO IEC 27001 to other management system standards
- Fundamentals of confidentiality, integrity, and availability (CIA triad)
- Glossary of 50 essential ISO 27001 terms and acronyms
Module 2: Initiating the ISMS Project - Defining the ISMS scope and boundaries
- Identifying internal and external issues affecting information security
- Stakeholder identification and engagement planning
- Establishing an ISMS project team and roles
- Developing a project charter and governance structure
- Creating a high-level implementation timeline
- Securing executive sponsorship and budget approval
- Conducting a current state assessment
- Gap analysis methodology and tools
- Documenting the organisational context
- Developing the ISMS policy framework
- Setting measurable information security objectives
- Defining success criteria and KPIs
- Identifying resource needs and skill gaps
- Developing a communication plan for all stakeholders
- Creating templates for project documentation
- Using a stage-gate approach for project control
Module 3: Risk Assessment and Treatment Fundamentals - Understanding the risk management process in ISO IEC 27001
- Difference between risk assessment and risk evaluation
- Selecting a risk assessment methodology: qualitative vs quantitative
- Defining risk criteria and risk appetite
- Identifying information assets and their value
- Likelihood and impact scales for risk scoring
- Developing a comprehensive risk register
- Identifying threats, vulnerabilities, and existing controls
- Calculating risk levels and prioritising risks
- Conducting asset-based risk assessments
- Process-based vs system-based risk assessment approaches
- Creating risk assessment workbooks
- Using risk heat maps for visualisation
- Legal, regulatory, and compliance risk identification
- Third-party and supply chain risk considerations
- Documenting risk assessment findings
- Auditing risk assessment processes for credibility
Module 4: Statement of Applicability (SoA) Development - Purpose and structure of the Statement of Applicability
- Mapping Annex A controls to identified risks
- Justifying inclusion and exclusion of controls
- Documenting control objectives and implementation status
- Integrating risk treatment decisions into the SoA
- Version control and change management for the SoA
- Presenting the SoA to auditors and management
- Using automated templates to maintain accuracy
- Linking SoA entries to risk treatment plans
- Best practices for audit readiness
- Ensuring traceability between risks and controls
- Handling partial implementation of controls
- Reporting on control maturity levels
- Reviewing and updating the SoA annually
- Using the SoA in gap analysis and audits
- Working with consultants on SoA validation
- Checklist for SoA finalisation and approval
Module 5: Risk Treatment Planning - Four risk treatment options: avoid, transfer, mitigate, accept
- Selecting appropriate treatment strategies per risk
- Creating detailed risk treatment action plans
- Assigning ownership and accountability
- Setting timelines and milestones
- Linking treatments to resource allocation
- Budgeting for control implementation
- Creating a risk treatment register
- Defining success criteria for each treatment
- Monitoring progress using dashboards
- Integrating treatments into project plans
- Using pilot projects for high-impact controls
- Documenting risk acceptance criteria and approvals
- Ensuring legal review for risk transfers
- Obtaining management sign-off on treatments
- Reviewing treatment effectiveness post-implementation
- Updating the ISMS documentation accordingly
Module 6: Annex A Controls Deep Dive: Organisational Controls - A.5.1 Policies for information security
- A.5.2 Segregation of duties
- A.5.3 Management responsibilities
- A.5.4 Contact with authorities
- A.5.5 Contact with special interest groups
- A.5.6 Information security in project management
- Establishing roles and responsibilities
- Defining access control policy
- Developing acceptable use policies
- Implementing disciplinary processes
- Supplier security policies
- Remote working security policies
- Mobile device security frameworks
- Cloud security governance
- Third-party risk management frameworks
- Confidentiality agreements and NDAs
- Security awareness programme oversight
Module 7: Annex A Controls Deep Dive: People Controls - A.6.1 Screening of candidates
- A.6.2 Terms and conditions of employment
- A.6.3 Information security awareness and training
- A.6.4 Disciplinary process
- A.6.5 Termination responsibilities
- A.6.6 Access rights management
- A.6.7 Return of assets
- Onboarding security checklists
- Role-based training plans
- Phishing simulation and response
- Insider threat detection frameworks
- Post-employment access revocation
- Security induction programmes
- Measuring training effectiveness
- Security competency frameworks
- Conducting security knowledge assessments
- Managing temporary and contract staff access
Module 8: Annex A Controls Deep Dive: Physical and Environmental Controls - A.7.1 Secure areas
- A.7.2 Equipment security
- A.7.3 Secure disposal or reuse of equipment
- A.7.4 Assets outside organisational premises
- Designing secure server rooms and data centres
- Visitor access control procedures
- Physical security monitoring systems
- Environmental controls: fire, water, temperature
- Equipment labeling and tracking
- Secure transportation of devices
- Protection against natural disasters
- Remote work device security standards
- Disposal certification for hardware
- Inventory management for physical assets
- Secure storage for backup media
- Lockdown procedures for breaches
- Physical access logs and audit trails
Module 9: Annex A Controls Deep Dive: Communication and Operations - A.8.1 Operational procedures and responsibilities
- A.8.2 Protection from malware
- A.8.3 Backup
- A.8.4 Logging and monitoring
- A.8.5 Control of operational software
- A.8.6 Technical vulnerability management
- A.8.7 Information systems audit controls
- A.8.8 Network security management
- A.8.9 Security of system engineering principles
- A.8.10 Secure development policy
- A.8.11 System security testing
- A.8.12 Protection of information during exchange
- A.8.13 Electronic messaging security
- A.8.14 Confidentiality of information
- A.8.15 Secure system architecture
- Change management procedures
- Incident response planning
- Privileged access review schedules
- Configuration management databases
- Secure API design
- Network segmentation strategies
- Log retention and analysis
- SOAR integration basics
- Automated alert systems
- Secure code review checklists
- Penetration testing coordination
- Secure configuration baselines
Module 10: Access Control and Identity Management - A.9.1 Access control policy
- A.9.2 User access management
- A.9.3 User responsibilities
- A.9.4 System and application access control
- Principle of least privilege implementation
- Role-based access control (RBAC) design
- Identity and access management (IAM) tools
- Multi-factor authentication rollout
- Service account governance
- Password policy standards
- Emergency access procedures
- Access review and recertification
- Single sign-on (SSO) integration
- Just-in-time access models
- Privileged identity management
- Segregation of duties conflict detection
- Access request workflows
Module 11: Cryptography and Data Security - A.10.1 Cryptographic controls policy
- A.10.2 Key management
- Data classification framework development
- Encryption at rest and in transit
- Email and file encryption tools
- Key lifecycle management
- Secure key storage solutions
- Quantum-safe cryptography awareness
- Tokenisation and data masking
- Database encryption strategies
- Cloud key management (e.g., AWS KMS, Azure Key Vault)
- Hardware security modules (HSMs)
- Digital signatures and non-repudiation
- End-to-end encryption design
- Decrypting without compromising security
- Compliance with encryption export laws
- Key recovery policies
Module 12: Supplier Relationships and Third-Party Security - A.11.1 Supplier relationship information security
- A.11.2 Supplier service delivery management
- Third-party risk assessment templates
- Due diligence checklists for vendors
- Contractual security clauses
- Cloud service provider assessments
- Outsourcing risk management
- Third-party audit rights and access
- Service level agreement (SLA) security metrics
- Penetration testing of supplier systems
- Supply chain vulnerability mapping
- Managed service provider oversight
- Subcontractor risk management
- Onsite supplier access control
- Security questionnaires and assessments (SIG, CAIQ)
- Continuous monitoring of supplier risks
- Exit strategies and data recovery
Module 13: Incident Management and Business Continuity - A.12.1 Management of information security incidents
- A.12.2 Information security event reporting
- A.12.3 Response to information security events
- A.12.4 Learning from information security events
- A.12.5 Collection of evidence
- Incident response team structure
- Incident classification and prioritisation
- Containment, eradication, recovery steps
- Forensic data collection procedures
- Regulatory breach reporting timelines
- Customer and stakeholder notification plans
- Post-incident reviews and root cause analysis
- Incident playbooks for common scenarios
- Threat intelligence integration
- Coordination with law enforcement
- Simulated incident drills
- Business continuity integration
Module 14: Business Continuity and Resilience - A.13.1 Information security in business continuity
- A.13.2 Redundancies in information system
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Critical system identification
- Data backup strategies and frequency
- Disaster recovery site options
- Cloud-based continuity solutions
- War gaming and tabletop exercises
- Failover and failback procedures
- Backup integrity verification
- Testing frequency and documentation
- Ensuring control availability post-disruption
- Third-party continuity planning
- Legal obligations during outages
- Insurance and risk transfer
- Maintaining ISMS during crises
Module 15: Compliance, Legal, and Regulatory Alignment - A.14.1 Compliance with legal and contractual requirements
- Identifying applicable laws (GDPR, HIPAA, CCPA, etc.)
- Regulatory mapping to ISO controls
- Conducting compliance gap assessments
- Freedom of information and privacy laws
- Data sovereignty requirements
- Intellectual property protection
- Monitoring legislative changes
- Records retention and disposal policies
- Evidence collection for auditors
- Penalty avoidance strategies
- Industry-specific regulatory checklists
- International data transfer mechanisms
- Lawful processing grounds
- Regulatory reporting obligations
- Working with data protection officers (DPOs)
- Legal hold procedures
Module 16: Information Security Policies and Documentation - Developing the Information Security Policy
- Acceptable Use Policy (AUP) creation
- Remote Access Policy
- Incident Response Policy
- Acceptable Encryption Policy
- Data Handling Policy
- Physical Security Policy
- Mobile Device Policy
- Cloud Security Policy
- Vendor Security Policy
- Policy review and approval workflows
- Digital policy distribution and attestation
- Version control and change logs
- Policy compliance monitoring
- Automated reminders for reviews
- Policy exception management
- Integration with HR and legal teams
Module 17: Internal Audit and Management Review - A.15.1 Internal audit process
- A.15.2 Management review
- Creating an audit schedule
- Competency requirements for auditors
- Audit checklists aligned with Annex A
- Conducting document reviews
- Interviewing staff during audits
- Reporting audit findings and non-conformities
- Root cause analysis of audit gaps
- Corrective action planning
- Tracking closure of audit actions
- Preparing for external audits
- Presenting audit reports to leadership
- Scheduling regular management reviews
- Demonstrating continual improvement
- Using audit results to update risk assessments
- Integrating audits with other management systems
Module 18: Certification Audit Preparation - Stages of certification: Stage 1 and Stage 2 audits
- Selecting a certification body
- Understanding audit criteria and scoring
- Preparing audit evidence binders
- Organising documentation for auditors
- Conducting pre-certification readiness assessments
- Mock audits and gap closure
- Handling auditor questions and requests
- Responding to non-conformities
- Correcting major and minor findings
- Auditor communication etiquette
- Legal and contractual considerations with CBs
- Post-certification surveillance audits
- Maintaining certification over time
- Re-certification cycle management
- Using certification in marketing and proposals
- Handling adverse audit outcomes
Module 19: Post-Certification Sustainment - Integrating ISMS into daily operations
- Monthly ISMS performance reviews
- Annual internal audit scheduling
- Updating the risk assessment annually
- Reviewing and revising the SoA
- Tracking control effectiveness
- Updating policies and procedures
- Conducting management review meetings
- Reporting to the board or executive team
- Handling organisational changes (M&A, restructuring)
- Scaling the ISMS across departments
- Extending scope for multi-site operations
- Automation of ISMS workflows
- Using GRC platforms for sustainment
- Continuous improvement through feedback loops
- KPI dashboards for leadership
- Renewal planning for certification
Module 20: Advanced Topics and Career Advancement - Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
- Defining the ISMS scope and boundaries
- Identifying internal and external issues affecting information security
- Stakeholder identification and engagement planning
- Establishing an ISMS project team and roles
- Developing a project charter and governance structure
- Creating a high-level implementation timeline
- Securing executive sponsorship and budget approval
- Conducting a current state assessment
- Gap analysis methodology and tools
- Documenting the organisational context
- Developing the ISMS policy framework
- Setting measurable information security objectives
- Defining success criteria and KPIs
- Identifying resource needs and skill gaps
- Developing a communication plan for all stakeholders
- Creating templates for project documentation
- Using a stage-gate approach for project control
Module 3: Risk Assessment and Treatment Fundamentals - Understanding the risk management process in ISO IEC 27001
- Difference between risk assessment and risk evaluation
- Selecting a risk assessment methodology: qualitative vs quantitative
- Defining risk criteria and risk appetite
- Identifying information assets and their value
- Likelihood and impact scales for risk scoring
- Developing a comprehensive risk register
- Identifying threats, vulnerabilities, and existing controls
- Calculating risk levels and prioritising risks
- Conducting asset-based risk assessments
- Process-based vs system-based risk assessment approaches
- Creating risk assessment workbooks
- Using risk heat maps for visualisation
- Legal, regulatory, and compliance risk identification
- Third-party and supply chain risk considerations
- Documenting risk assessment findings
- Auditing risk assessment processes for credibility
Module 4: Statement of Applicability (SoA) Development - Purpose and structure of the Statement of Applicability
- Mapping Annex A controls to identified risks
- Justifying inclusion and exclusion of controls
- Documenting control objectives and implementation status
- Integrating risk treatment decisions into the SoA
- Version control and change management for the SoA
- Presenting the SoA to auditors and management
- Using automated templates to maintain accuracy
- Linking SoA entries to risk treatment plans
- Best practices for audit readiness
- Ensuring traceability between risks and controls
- Handling partial implementation of controls
- Reporting on control maturity levels
- Reviewing and updating the SoA annually
- Using the SoA in gap analysis and audits
- Working with consultants on SoA validation
- Checklist for SoA finalisation and approval
Module 5: Risk Treatment Planning - Four risk treatment options: avoid, transfer, mitigate, accept
- Selecting appropriate treatment strategies per risk
- Creating detailed risk treatment action plans
- Assigning ownership and accountability
- Setting timelines and milestones
- Linking treatments to resource allocation
- Budgeting for control implementation
- Creating a risk treatment register
- Defining success criteria for each treatment
- Monitoring progress using dashboards
- Integrating treatments into project plans
- Using pilot projects for high-impact controls
- Documenting risk acceptance criteria and approvals
- Ensuring legal review for risk transfers
- Obtaining management sign-off on treatments
- Reviewing treatment effectiveness post-implementation
- Updating the ISMS documentation accordingly
Module 6: Annex A Controls Deep Dive: Organisational Controls - A.5.1 Policies for information security
- A.5.2 Segregation of duties
- A.5.3 Management responsibilities
- A.5.4 Contact with authorities
- A.5.5 Contact with special interest groups
- A.5.6 Information security in project management
- Establishing roles and responsibilities
- Defining access control policy
- Developing acceptable use policies
- Implementing disciplinary processes
- Supplier security policies
- Remote working security policies
- Mobile device security frameworks
- Cloud security governance
- Third-party risk management frameworks
- Confidentiality agreements and NDAs
- Security awareness programme oversight
Module 7: Annex A Controls Deep Dive: People Controls - A.6.1 Screening of candidates
- A.6.2 Terms and conditions of employment
- A.6.3 Information security awareness and training
- A.6.4 Disciplinary process
- A.6.5 Termination responsibilities
- A.6.6 Access rights management
- A.6.7 Return of assets
- Onboarding security checklists
- Role-based training plans
- Phishing simulation and response
- Insider threat detection frameworks
- Post-employment access revocation
- Security induction programmes
- Measuring training effectiveness
- Security competency frameworks
- Conducting security knowledge assessments
- Managing temporary and contract staff access
Module 8: Annex A Controls Deep Dive: Physical and Environmental Controls - A.7.1 Secure areas
- A.7.2 Equipment security
- A.7.3 Secure disposal or reuse of equipment
- A.7.4 Assets outside organisational premises
- Designing secure server rooms and data centres
- Visitor access control procedures
- Physical security monitoring systems
- Environmental controls: fire, water, temperature
- Equipment labeling and tracking
- Secure transportation of devices
- Protection against natural disasters
- Remote work device security standards
- Disposal certification for hardware
- Inventory management for physical assets
- Secure storage for backup media
- Lockdown procedures for breaches
- Physical access logs and audit trails
Module 9: Annex A Controls Deep Dive: Communication and Operations - A.8.1 Operational procedures and responsibilities
- A.8.2 Protection from malware
- A.8.3 Backup
- A.8.4 Logging and monitoring
- A.8.5 Control of operational software
- A.8.6 Technical vulnerability management
- A.8.7 Information systems audit controls
- A.8.8 Network security management
- A.8.9 Security of system engineering principles
- A.8.10 Secure development policy
- A.8.11 System security testing
- A.8.12 Protection of information during exchange
- A.8.13 Electronic messaging security
- A.8.14 Confidentiality of information
- A.8.15 Secure system architecture
- Change management procedures
- Incident response planning
- Privileged access review schedules
- Configuration management databases
- Secure API design
- Network segmentation strategies
- Log retention and analysis
- SOAR integration basics
- Automated alert systems
- Secure code review checklists
- Penetration testing coordination
- Secure configuration baselines
Module 10: Access Control and Identity Management - A.9.1 Access control policy
- A.9.2 User access management
- A.9.3 User responsibilities
- A.9.4 System and application access control
- Principle of least privilege implementation
- Role-based access control (RBAC) design
- Identity and access management (IAM) tools
- Multi-factor authentication rollout
- Service account governance
- Password policy standards
- Emergency access procedures
- Access review and recertification
- Single sign-on (SSO) integration
- Just-in-time access models
- Privileged identity management
- Segregation of duties conflict detection
- Access request workflows
Module 11: Cryptography and Data Security - A.10.1 Cryptographic controls policy
- A.10.2 Key management
- Data classification framework development
- Encryption at rest and in transit
- Email and file encryption tools
- Key lifecycle management
- Secure key storage solutions
- Quantum-safe cryptography awareness
- Tokenisation and data masking
- Database encryption strategies
- Cloud key management (e.g., AWS KMS, Azure Key Vault)
- Hardware security modules (HSMs)
- Digital signatures and non-repudiation
- End-to-end encryption design
- Decrypting without compromising security
- Compliance with encryption export laws
- Key recovery policies
Module 12: Supplier Relationships and Third-Party Security - A.11.1 Supplier relationship information security
- A.11.2 Supplier service delivery management
- Third-party risk assessment templates
- Due diligence checklists for vendors
- Contractual security clauses
- Cloud service provider assessments
- Outsourcing risk management
- Third-party audit rights and access
- Service level agreement (SLA) security metrics
- Penetration testing of supplier systems
- Supply chain vulnerability mapping
- Managed service provider oversight
- Subcontractor risk management
- Onsite supplier access control
- Security questionnaires and assessments (SIG, CAIQ)
- Continuous monitoring of supplier risks
- Exit strategies and data recovery
Module 13: Incident Management and Business Continuity - A.12.1 Management of information security incidents
- A.12.2 Information security event reporting
- A.12.3 Response to information security events
- A.12.4 Learning from information security events
- A.12.5 Collection of evidence
- Incident response team structure
- Incident classification and prioritisation
- Containment, eradication, recovery steps
- Forensic data collection procedures
- Regulatory breach reporting timelines
- Customer and stakeholder notification plans
- Post-incident reviews and root cause analysis
- Incident playbooks for common scenarios
- Threat intelligence integration
- Coordination with law enforcement
- Simulated incident drills
- Business continuity integration
Module 14: Business Continuity and Resilience - A.13.1 Information security in business continuity
- A.13.2 Redundancies in information system
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Critical system identification
- Data backup strategies and frequency
- Disaster recovery site options
- Cloud-based continuity solutions
- War gaming and tabletop exercises
- Failover and failback procedures
- Backup integrity verification
- Testing frequency and documentation
- Ensuring control availability post-disruption
- Third-party continuity planning
- Legal obligations during outages
- Insurance and risk transfer
- Maintaining ISMS during crises
Module 15: Compliance, Legal, and Regulatory Alignment - A.14.1 Compliance with legal and contractual requirements
- Identifying applicable laws (GDPR, HIPAA, CCPA, etc.)
- Regulatory mapping to ISO controls
- Conducting compliance gap assessments
- Freedom of information and privacy laws
- Data sovereignty requirements
- Intellectual property protection
- Monitoring legislative changes
- Records retention and disposal policies
- Evidence collection for auditors
- Penalty avoidance strategies
- Industry-specific regulatory checklists
- International data transfer mechanisms
- Lawful processing grounds
- Regulatory reporting obligations
- Working with data protection officers (DPOs)
- Legal hold procedures
Module 16: Information Security Policies and Documentation - Developing the Information Security Policy
- Acceptable Use Policy (AUP) creation
- Remote Access Policy
- Incident Response Policy
- Acceptable Encryption Policy
- Data Handling Policy
- Physical Security Policy
- Mobile Device Policy
- Cloud Security Policy
- Vendor Security Policy
- Policy review and approval workflows
- Digital policy distribution and attestation
- Version control and change logs
- Policy compliance monitoring
- Automated reminders for reviews
- Policy exception management
- Integration with HR and legal teams
Module 17: Internal Audit and Management Review - A.15.1 Internal audit process
- A.15.2 Management review
- Creating an audit schedule
- Competency requirements for auditors
- Audit checklists aligned with Annex A
- Conducting document reviews
- Interviewing staff during audits
- Reporting audit findings and non-conformities
- Root cause analysis of audit gaps
- Corrective action planning
- Tracking closure of audit actions
- Preparing for external audits
- Presenting audit reports to leadership
- Scheduling regular management reviews
- Demonstrating continual improvement
- Using audit results to update risk assessments
- Integrating audits with other management systems
Module 18: Certification Audit Preparation - Stages of certification: Stage 1 and Stage 2 audits
- Selecting a certification body
- Understanding audit criteria and scoring
- Preparing audit evidence binders
- Organising documentation for auditors
- Conducting pre-certification readiness assessments
- Mock audits and gap closure
- Handling auditor questions and requests
- Responding to non-conformities
- Correcting major and minor findings
- Auditor communication etiquette
- Legal and contractual considerations with CBs
- Post-certification surveillance audits
- Maintaining certification over time
- Re-certification cycle management
- Using certification in marketing and proposals
- Handling adverse audit outcomes
Module 19: Post-Certification Sustainment - Integrating ISMS into daily operations
- Monthly ISMS performance reviews
- Annual internal audit scheduling
- Updating the risk assessment annually
- Reviewing and revising the SoA
- Tracking control effectiveness
- Updating policies and procedures
- Conducting management review meetings
- Reporting to the board or executive team
- Handling organisational changes (M&A, restructuring)
- Scaling the ISMS across departments
- Extending scope for multi-site operations
- Automation of ISMS workflows
- Using GRC platforms for sustainment
- Continuous improvement through feedback loops
- KPI dashboards for leadership
- Renewal planning for certification
Module 20: Advanced Topics and Career Advancement - Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
- Purpose and structure of the Statement of Applicability
- Mapping Annex A controls to identified risks
- Justifying inclusion and exclusion of controls
- Documenting control objectives and implementation status
- Integrating risk treatment decisions into the SoA
- Version control and change management for the SoA
- Presenting the SoA to auditors and management
- Using automated templates to maintain accuracy
- Linking SoA entries to risk treatment plans
- Best practices for audit readiness
- Ensuring traceability between risks and controls
- Handling partial implementation of controls
- Reporting on control maturity levels
- Reviewing and updating the SoA annually
- Using the SoA in gap analysis and audits
- Working with consultants on SoA validation
- Checklist for SoA finalisation and approval
Module 5: Risk Treatment Planning - Four risk treatment options: avoid, transfer, mitigate, accept
- Selecting appropriate treatment strategies per risk
- Creating detailed risk treatment action plans
- Assigning ownership and accountability
- Setting timelines and milestones
- Linking treatments to resource allocation
- Budgeting for control implementation
- Creating a risk treatment register
- Defining success criteria for each treatment
- Monitoring progress using dashboards
- Integrating treatments into project plans
- Using pilot projects for high-impact controls
- Documenting risk acceptance criteria and approvals
- Ensuring legal review for risk transfers
- Obtaining management sign-off on treatments
- Reviewing treatment effectiveness post-implementation
- Updating the ISMS documentation accordingly
Module 6: Annex A Controls Deep Dive: Organisational Controls - A.5.1 Policies for information security
- A.5.2 Segregation of duties
- A.5.3 Management responsibilities
- A.5.4 Contact with authorities
- A.5.5 Contact with special interest groups
- A.5.6 Information security in project management
- Establishing roles and responsibilities
- Defining access control policy
- Developing acceptable use policies
- Implementing disciplinary processes
- Supplier security policies
- Remote working security policies
- Mobile device security frameworks
- Cloud security governance
- Third-party risk management frameworks
- Confidentiality agreements and NDAs
- Security awareness programme oversight
Module 7: Annex A Controls Deep Dive: People Controls - A.6.1 Screening of candidates
- A.6.2 Terms and conditions of employment
- A.6.3 Information security awareness and training
- A.6.4 Disciplinary process
- A.6.5 Termination responsibilities
- A.6.6 Access rights management
- A.6.7 Return of assets
- Onboarding security checklists
- Role-based training plans
- Phishing simulation and response
- Insider threat detection frameworks
- Post-employment access revocation
- Security induction programmes
- Measuring training effectiveness
- Security competency frameworks
- Conducting security knowledge assessments
- Managing temporary and contract staff access
Module 8: Annex A Controls Deep Dive: Physical and Environmental Controls - A.7.1 Secure areas
- A.7.2 Equipment security
- A.7.3 Secure disposal or reuse of equipment
- A.7.4 Assets outside organisational premises
- Designing secure server rooms and data centres
- Visitor access control procedures
- Physical security monitoring systems
- Environmental controls: fire, water, temperature
- Equipment labeling and tracking
- Secure transportation of devices
- Protection against natural disasters
- Remote work device security standards
- Disposal certification for hardware
- Inventory management for physical assets
- Secure storage for backup media
- Lockdown procedures for breaches
- Physical access logs and audit trails
Module 9: Annex A Controls Deep Dive: Communication and Operations - A.8.1 Operational procedures and responsibilities
- A.8.2 Protection from malware
- A.8.3 Backup
- A.8.4 Logging and monitoring
- A.8.5 Control of operational software
- A.8.6 Technical vulnerability management
- A.8.7 Information systems audit controls
- A.8.8 Network security management
- A.8.9 Security of system engineering principles
- A.8.10 Secure development policy
- A.8.11 System security testing
- A.8.12 Protection of information during exchange
- A.8.13 Electronic messaging security
- A.8.14 Confidentiality of information
- A.8.15 Secure system architecture
- Change management procedures
- Incident response planning
- Privileged access review schedules
- Configuration management databases
- Secure API design
- Network segmentation strategies
- Log retention and analysis
- SOAR integration basics
- Automated alert systems
- Secure code review checklists
- Penetration testing coordination
- Secure configuration baselines
Module 10: Access Control and Identity Management - A.9.1 Access control policy
- A.9.2 User access management
- A.9.3 User responsibilities
- A.9.4 System and application access control
- Principle of least privilege implementation
- Role-based access control (RBAC) design
- Identity and access management (IAM) tools
- Multi-factor authentication rollout
- Service account governance
- Password policy standards
- Emergency access procedures
- Access review and recertification
- Single sign-on (SSO) integration
- Just-in-time access models
- Privileged identity management
- Segregation of duties conflict detection
- Access request workflows
Module 11: Cryptography and Data Security - A.10.1 Cryptographic controls policy
- A.10.2 Key management
- Data classification framework development
- Encryption at rest and in transit
- Email and file encryption tools
- Key lifecycle management
- Secure key storage solutions
- Quantum-safe cryptography awareness
- Tokenisation and data masking
- Database encryption strategies
- Cloud key management (e.g., AWS KMS, Azure Key Vault)
- Hardware security modules (HSMs)
- Digital signatures and non-repudiation
- End-to-end encryption design
- Decrypting without compromising security
- Compliance with encryption export laws
- Key recovery policies
Module 12: Supplier Relationships and Third-Party Security - A.11.1 Supplier relationship information security
- A.11.2 Supplier service delivery management
- Third-party risk assessment templates
- Due diligence checklists for vendors
- Contractual security clauses
- Cloud service provider assessments
- Outsourcing risk management
- Third-party audit rights and access
- Service level agreement (SLA) security metrics
- Penetration testing of supplier systems
- Supply chain vulnerability mapping
- Managed service provider oversight
- Subcontractor risk management
- Onsite supplier access control
- Security questionnaires and assessments (SIG, CAIQ)
- Continuous monitoring of supplier risks
- Exit strategies and data recovery
Module 13: Incident Management and Business Continuity - A.12.1 Management of information security incidents
- A.12.2 Information security event reporting
- A.12.3 Response to information security events
- A.12.4 Learning from information security events
- A.12.5 Collection of evidence
- Incident response team structure
- Incident classification and prioritisation
- Containment, eradication, recovery steps
- Forensic data collection procedures
- Regulatory breach reporting timelines
- Customer and stakeholder notification plans
- Post-incident reviews and root cause analysis
- Incident playbooks for common scenarios
- Threat intelligence integration
- Coordination with law enforcement
- Simulated incident drills
- Business continuity integration
Module 14: Business Continuity and Resilience - A.13.1 Information security in business continuity
- A.13.2 Redundancies in information system
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Critical system identification
- Data backup strategies and frequency
- Disaster recovery site options
- Cloud-based continuity solutions
- War gaming and tabletop exercises
- Failover and failback procedures
- Backup integrity verification
- Testing frequency and documentation
- Ensuring control availability post-disruption
- Third-party continuity planning
- Legal obligations during outages
- Insurance and risk transfer
- Maintaining ISMS during crises
Module 15: Compliance, Legal, and Regulatory Alignment - A.14.1 Compliance with legal and contractual requirements
- Identifying applicable laws (GDPR, HIPAA, CCPA, etc.)
- Regulatory mapping to ISO controls
- Conducting compliance gap assessments
- Freedom of information and privacy laws
- Data sovereignty requirements
- Intellectual property protection
- Monitoring legislative changes
- Records retention and disposal policies
- Evidence collection for auditors
- Penalty avoidance strategies
- Industry-specific regulatory checklists
- International data transfer mechanisms
- Lawful processing grounds
- Regulatory reporting obligations
- Working with data protection officers (DPOs)
- Legal hold procedures
Module 16: Information Security Policies and Documentation - Developing the Information Security Policy
- Acceptable Use Policy (AUP) creation
- Remote Access Policy
- Incident Response Policy
- Acceptable Encryption Policy
- Data Handling Policy
- Physical Security Policy
- Mobile Device Policy
- Cloud Security Policy
- Vendor Security Policy
- Policy review and approval workflows
- Digital policy distribution and attestation
- Version control and change logs
- Policy compliance monitoring
- Automated reminders for reviews
- Policy exception management
- Integration with HR and legal teams
Module 17: Internal Audit and Management Review - A.15.1 Internal audit process
- A.15.2 Management review
- Creating an audit schedule
- Competency requirements for auditors
- Audit checklists aligned with Annex A
- Conducting document reviews
- Interviewing staff during audits
- Reporting audit findings and non-conformities
- Root cause analysis of audit gaps
- Corrective action planning
- Tracking closure of audit actions
- Preparing for external audits
- Presenting audit reports to leadership
- Scheduling regular management reviews
- Demonstrating continual improvement
- Using audit results to update risk assessments
- Integrating audits with other management systems
Module 18: Certification Audit Preparation - Stages of certification: Stage 1 and Stage 2 audits
- Selecting a certification body
- Understanding audit criteria and scoring
- Preparing audit evidence binders
- Organising documentation for auditors
- Conducting pre-certification readiness assessments
- Mock audits and gap closure
- Handling auditor questions and requests
- Responding to non-conformities
- Correcting major and minor findings
- Auditor communication etiquette
- Legal and contractual considerations with CBs
- Post-certification surveillance audits
- Maintaining certification over time
- Re-certification cycle management
- Using certification in marketing and proposals
- Handling adverse audit outcomes
Module 19: Post-Certification Sustainment - Integrating ISMS into daily operations
- Monthly ISMS performance reviews
- Annual internal audit scheduling
- Updating the risk assessment annually
- Reviewing and revising the SoA
- Tracking control effectiveness
- Updating policies and procedures
- Conducting management review meetings
- Reporting to the board or executive team
- Handling organisational changes (M&A, restructuring)
- Scaling the ISMS across departments
- Extending scope for multi-site operations
- Automation of ISMS workflows
- Using GRC platforms for sustainment
- Continuous improvement through feedback loops
- KPI dashboards for leadership
- Renewal planning for certification
Module 20: Advanced Topics and Career Advancement - Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
- A.5.1 Policies for information security
- A.5.2 Segregation of duties
- A.5.3 Management responsibilities
- A.5.4 Contact with authorities
- A.5.5 Contact with special interest groups
- A.5.6 Information security in project management
- Establishing roles and responsibilities
- Defining access control policy
- Developing acceptable use policies
- Implementing disciplinary processes
- Supplier security policies
- Remote working security policies
- Mobile device security frameworks
- Cloud security governance
- Third-party risk management frameworks
- Confidentiality agreements and NDAs
- Security awareness programme oversight
Module 7: Annex A Controls Deep Dive: People Controls - A.6.1 Screening of candidates
- A.6.2 Terms and conditions of employment
- A.6.3 Information security awareness and training
- A.6.4 Disciplinary process
- A.6.5 Termination responsibilities
- A.6.6 Access rights management
- A.6.7 Return of assets
- Onboarding security checklists
- Role-based training plans
- Phishing simulation and response
- Insider threat detection frameworks
- Post-employment access revocation
- Security induction programmes
- Measuring training effectiveness
- Security competency frameworks
- Conducting security knowledge assessments
- Managing temporary and contract staff access
Module 8: Annex A Controls Deep Dive: Physical and Environmental Controls - A.7.1 Secure areas
- A.7.2 Equipment security
- A.7.3 Secure disposal or reuse of equipment
- A.7.4 Assets outside organisational premises
- Designing secure server rooms and data centres
- Visitor access control procedures
- Physical security monitoring systems
- Environmental controls: fire, water, temperature
- Equipment labeling and tracking
- Secure transportation of devices
- Protection against natural disasters
- Remote work device security standards
- Disposal certification for hardware
- Inventory management for physical assets
- Secure storage for backup media
- Lockdown procedures for breaches
- Physical access logs and audit trails
Module 9: Annex A Controls Deep Dive: Communication and Operations - A.8.1 Operational procedures and responsibilities
- A.8.2 Protection from malware
- A.8.3 Backup
- A.8.4 Logging and monitoring
- A.8.5 Control of operational software
- A.8.6 Technical vulnerability management
- A.8.7 Information systems audit controls
- A.8.8 Network security management
- A.8.9 Security of system engineering principles
- A.8.10 Secure development policy
- A.8.11 System security testing
- A.8.12 Protection of information during exchange
- A.8.13 Electronic messaging security
- A.8.14 Confidentiality of information
- A.8.15 Secure system architecture
- Change management procedures
- Incident response planning
- Privileged access review schedules
- Configuration management databases
- Secure API design
- Network segmentation strategies
- Log retention and analysis
- SOAR integration basics
- Automated alert systems
- Secure code review checklists
- Penetration testing coordination
- Secure configuration baselines
Module 10: Access Control and Identity Management - A.9.1 Access control policy
- A.9.2 User access management
- A.9.3 User responsibilities
- A.9.4 System and application access control
- Principle of least privilege implementation
- Role-based access control (RBAC) design
- Identity and access management (IAM) tools
- Multi-factor authentication rollout
- Service account governance
- Password policy standards
- Emergency access procedures
- Access review and recertification
- Single sign-on (SSO) integration
- Just-in-time access models
- Privileged identity management
- Segregation of duties conflict detection
- Access request workflows
Module 11: Cryptography and Data Security - A.10.1 Cryptographic controls policy
- A.10.2 Key management
- Data classification framework development
- Encryption at rest and in transit
- Email and file encryption tools
- Key lifecycle management
- Secure key storage solutions
- Quantum-safe cryptography awareness
- Tokenisation and data masking
- Database encryption strategies
- Cloud key management (e.g., AWS KMS, Azure Key Vault)
- Hardware security modules (HSMs)
- Digital signatures and non-repudiation
- End-to-end encryption design
- Decrypting without compromising security
- Compliance with encryption export laws
- Key recovery policies
Module 12: Supplier Relationships and Third-Party Security - A.11.1 Supplier relationship information security
- A.11.2 Supplier service delivery management
- Third-party risk assessment templates
- Due diligence checklists for vendors
- Contractual security clauses
- Cloud service provider assessments
- Outsourcing risk management
- Third-party audit rights and access
- Service level agreement (SLA) security metrics
- Penetration testing of supplier systems
- Supply chain vulnerability mapping
- Managed service provider oversight
- Subcontractor risk management
- Onsite supplier access control
- Security questionnaires and assessments (SIG, CAIQ)
- Continuous monitoring of supplier risks
- Exit strategies and data recovery
Module 13: Incident Management and Business Continuity - A.12.1 Management of information security incidents
- A.12.2 Information security event reporting
- A.12.3 Response to information security events
- A.12.4 Learning from information security events
- A.12.5 Collection of evidence
- Incident response team structure
- Incident classification and prioritisation
- Containment, eradication, recovery steps
- Forensic data collection procedures
- Regulatory breach reporting timelines
- Customer and stakeholder notification plans
- Post-incident reviews and root cause analysis
- Incident playbooks for common scenarios
- Threat intelligence integration
- Coordination with law enforcement
- Simulated incident drills
- Business continuity integration
Module 14: Business Continuity and Resilience - A.13.1 Information security in business continuity
- A.13.2 Redundancies in information system
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Critical system identification
- Data backup strategies and frequency
- Disaster recovery site options
- Cloud-based continuity solutions
- War gaming and tabletop exercises
- Failover and failback procedures
- Backup integrity verification
- Testing frequency and documentation
- Ensuring control availability post-disruption
- Third-party continuity planning
- Legal obligations during outages
- Insurance and risk transfer
- Maintaining ISMS during crises
Module 15: Compliance, Legal, and Regulatory Alignment - A.14.1 Compliance with legal and contractual requirements
- Identifying applicable laws (GDPR, HIPAA, CCPA, etc.)
- Regulatory mapping to ISO controls
- Conducting compliance gap assessments
- Freedom of information and privacy laws
- Data sovereignty requirements
- Intellectual property protection
- Monitoring legislative changes
- Records retention and disposal policies
- Evidence collection for auditors
- Penalty avoidance strategies
- Industry-specific regulatory checklists
- International data transfer mechanisms
- Lawful processing grounds
- Regulatory reporting obligations
- Working with data protection officers (DPOs)
- Legal hold procedures
Module 16: Information Security Policies and Documentation - Developing the Information Security Policy
- Acceptable Use Policy (AUP) creation
- Remote Access Policy
- Incident Response Policy
- Acceptable Encryption Policy
- Data Handling Policy
- Physical Security Policy
- Mobile Device Policy
- Cloud Security Policy
- Vendor Security Policy
- Policy review and approval workflows
- Digital policy distribution and attestation
- Version control and change logs
- Policy compliance monitoring
- Automated reminders for reviews
- Policy exception management
- Integration with HR and legal teams
Module 17: Internal Audit and Management Review - A.15.1 Internal audit process
- A.15.2 Management review
- Creating an audit schedule
- Competency requirements for auditors
- Audit checklists aligned with Annex A
- Conducting document reviews
- Interviewing staff during audits
- Reporting audit findings and non-conformities
- Root cause analysis of audit gaps
- Corrective action planning
- Tracking closure of audit actions
- Preparing for external audits
- Presenting audit reports to leadership
- Scheduling regular management reviews
- Demonstrating continual improvement
- Using audit results to update risk assessments
- Integrating audits with other management systems
Module 18: Certification Audit Preparation - Stages of certification: Stage 1 and Stage 2 audits
- Selecting a certification body
- Understanding audit criteria and scoring
- Preparing audit evidence binders
- Organising documentation for auditors
- Conducting pre-certification readiness assessments
- Mock audits and gap closure
- Handling auditor questions and requests
- Responding to non-conformities
- Correcting major and minor findings
- Auditor communication etiquette
- Legal and contractual considerations with CBs
- Post-certification surveillance audits
- Maintaining certification over time
- Re-certification cycle management
- Using certification in marketing and proposals
- Handling adverse audit outcomes
Module 19: Post-Certification Sustainment - Integrating ISMS into daily operations
- Monthly ISMS performance reviews
- Annual internal audit scheduling
- Updating the risk assessment annually
- Reviewing and revising the SoA
- Tracking control effectiveness
- Updating policies and procedures
- Conducting management review meetings
- Reporting to the board or executive team
- Handling organisational changes (M&A, restructuring)
- Scaling the ISMS across departments
- Extending scope for multi-site operations
- Automation of ISMS workflows
- Using GRC platforms for sustainment
- Continuous improvement through feedback loops
- KPI dashboards for leadership
- Renewal planning for certification
Module 20: Advanced Topics and Career Advancement - Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
- A.7.1 Secure areas
- A.7.2 Equipment security
- A.7.3 Secure disposal or reuse of equipment
- A.7.4 Assets outside organisational premises
- Designing secure server rooms and data centres
- Visitor access control procedures
- Physical security monitoring systems
- Environmental controls: fire, water, temperature
- Equipment labeling and tracking
- Secure transportation of devices
- Protection against natural disasters
- Remote work device security standards
- Disposal certification for hardware
- Inventory management for physical assets
- Secure storage for backup media
- Lockdown procedures for breaches
- Physical access logs and audit trails
Module 9: Annex A Controls Deep Dive: Communication and Operations - A.8.1 Operational procedures and responsibilities
- A.8.2 Protection from malware
- A.8.3 Backup
- A.8.4 Logging and monitoring
- A.8.5 Control of operational software
- A.8.6 Technical vulnerability management
- A.8.7 Information systems audit controls
- A.8.8 Network security management
- A.8.9 Security of system engineering principles
- A.8.10 Secure development policy
- A.8.11 System security testing
- A.8.12 Protection of information during exchange
- A.8.13 Electronic messaging security
- A.8.14 Confidentiality of information
- A.8.15 Secure system architecture
- Change management procedures
- Incident response planning
- Privileged access review schedules
- Configuration management databases
- Secure API design
- Network segmentation strategies
- Log retention and analysis
- SOAR integration basics
- Automated alert systems
- Secure code review checklists
- Penetration testing coordination
- Secure configuration baselines
Module 10: Access Control and Identity Management - A.9.1 Access control policy
- A.9.2 User access management
- A.9.3 User responsibilities
- A.9.4 System and application access control
- Principle of least privilege implementation
- Role-based access control (RBAC) design
- Identity and access management (IAM) tools
- Multi-factor authentication rollout
- Service account governance
- Password policy standards
- Emergency access procedures
- Access review and recertification
- Single sign-on (SSO) integration
- Just-in-time access models
- Privileged identity management
- Segregation of duties conflict detection
- Access request workflows
Module 11: Cryptography and Data Security - A.10.1 Cryptographic controls policy
- A.10.2 Key management
- Data classification framework development
- Encryption at rest and in transit
- Email and file encryption tools
- Key lifecycle management
- Secure key storage solutions
- Quantum-safe cryptography awareness
- Tokenisation and data masking
- Database encryption strategies
- Cloud key management (e.g., AWS KMS, Azure Key Vault)
- Hardware security modules (HSMs)
- Digital signatures and non-repudiation
- End-to-end encryption design
- Decrypting without compromising security
- Compliance with encryption export laws
- Key recovery policies
Module 12: Supplier Relationships and Third-Party Security - A.11.1 Supplier relationship information security
- A.11.2 Supplier service delivery management
- Third-party risk assessment templates
- Due diligence checklists for vendors
- Contractual security clauses
- Cloud service provider assessments
- Outsourcing risk management
- Third-party audit rights and access
- Service level agreement (SLA) security metrics
- Penetration testing of supplier systems
- Supply chain vulnerability mapping
- Managed service provider oversight
- Subcontractor risk management
- Onsite supplier access control
- Security questionnaires and assessments (SIG, CAIQ)
- Continuous monitoring of supplier risks
- Exit strategies and data recovery
Module 13: Incident Management and Business Continuity - A.12.1 Management of information security incidents
- A.12.2 Information security event reporting
- A.12.3 Response to information security events
- A.12.4 Learning from information security events
- A.12.5 Collection of evidence
- Incident response team structure
- Incident classification and prioritisation
- Containment, eradication, recovery steps
- Forensic data collection procedures
- Regulatory breach reporting timelines
- Customer and stakeholder notification plans
- Post-incident reviews and root cause analysis
- Incident playbooks for common scenarios
- Threat intelligence integration
- Coordination with law enforcement
- Simulated incident drills
- Business continuity integration
Module 14: Business Continuity and Resilience - A.13.1 Information security in business continuity
- A.13.2 Redundancies in information system
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Critical system identification
- Data backup strategies and frequency
- Disaster recovery site options
- Cloud-based continuity solutions
- War gaming and tabletop exercises
- Failover and failback procedures
- Backup integrity verification
- Testing frequency and documentation
- Ensuring control availability post-disruption
- Third-party continuity planning
- Legal obligations during outages
- Insurance and risk transfer
- Maintaining ISMS during crises
Module 15: Compliance, Legal, and Regulatory Alignment - A.14.1 Compliance with legal and contractual requirements
- Identifying applicable laws (GDPR, HIPAA, CCPA, etc.)
- Regulatory mapping to ISO controls
- Conducting compliance gap assessments
- Freedom of information and privacy laws
- Data sovereignty requirements
- Intellectual property protection
- Monitoring legislative changes
- Records retention and disposal policies
- Evidence collection for auditors
- Penalty avoidance strategies
- Industry-specific regulatory checklists
- International data transfer mechanisms
- Lawful processing grounds
- Regulatory reporting obligations
- Working with data protection officers (DPOs)
- Legal hold procedures
Module 16: Information Security Policies and Documentation - Developing the Information Security Policy
- Acceptable Use Policy (AUP) creation
- Remote Access Policy
- Incident Response Policy
- Acceptable Encryption Policy
- Data Handling Policy
- Physical Security Policy
- Mobile Device Policy
- Cloud Security Policy
- Vendor Security Policy
- Policy review and approval workflows
- Digital policy distribution and attestation
- Version control and change logs
- Policy compliance monitoring
- Automated reminders for reviews
- Policy exception management
- Integration with HR and legal teams
Module 17: Internal Audit and Management Review - A.15.1 Internal audit process
- A.15.2 Management review
- Creating an audit schedule
- Competency requirements for auditors
- Audit checklists aligned with Annex A
- Conducting document reviews
- Interviewing staff during audits
- Reporting audit findings and non-conformities
- Root cause analysis of audit gaps
- Corrective action planning
- Tracking closure of audit actions
- Preparing for external audits
- Presenting audit reports to leadership
- Scheduling regular management reviews
- Demonstrating continual improvement
- Using audit results to update risk assessments
- Integrating audits with other management systems
Module 18: Certification Audit Preparation - Stages of certification: Stage 1 and Stage 2 audits
- Selecting a certification body
- Understanding audit criteria and scoring
- Preparing audit evidence binders
- Organising documentation for auditors
- Conducting pre-certification readiness assessments
- Mock audits and gap closure
- Handling auditor questions and requests
- Responding to non-conformities
- Correcting major and minor findings
- Auditor communication etiquette
- Legal and contractual considerations with CBs
- Post-certification surveillance audits
- Maintaining certification over time
- Re-certification cycle management
- Using certification in marketing and proposals
- Handling adverse audit outcomes
Module 19: Post-Certification Sustainment - Integrating ISMS into daily operations
- Monthly ISMS performance reviews
- Annual internal audit scheduling
- Updating the risk assessment annually
- Reviewing and revising the SoA
- Tracking control effectiveness
- Updating policies and procedures
- Conducting management review meetings
- Reporting to the board or executive team
- Handling organisational changes (M&A, restructuring)
- Scaling the ISMS across departments
- Extending scope for multi-site operations
- Automation of ISMS workflows
- Using GRC platforms for sustainment
- Continuous improvement through feedback loops
- KPI dashboards for leadership
- Renewal planning for certification
Module 20: Advanced Topics and Career Advancement - Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
- A.9.1 Access control policy
- A.9.2 User access management
- A.9.3 User responsibilities
- A.9.4 System and application access control
- Principle of least privilege implementation
- Role-based access control (RBAC) design
- Identity and access management (IAM) tools
- Multi-factor authentication rollout
- Service account governance
- Password policy standards
- Emergency access procedures
- Access review and recertification
- Single sign-on (SSO) integration
- Just-in-time access models
- Privileged identity management
- Segregation of duties conflict detection
- Access request workflows
Module 11: Cryptography and Data Security - A.10.1 Cryptographic controls policy
- A.10.2 Key management
- Data classification framework development
- Encryption at rest and in transit
- Email and file encryption tools
- Key lifecycle management
- Secure key storage solutions
- Quantum-safe cryptography awareness
- Tokenisation and data masking
- Database encryption strategies
- Cloud key management (e.g., AWS KMS, Azure Key Vault)
- Hardware security modules (HSMs)
- Digital signatures and non-repudiation
- End-to-end encryption design
- Decrypting without compromising security
- Compliance with encryption export laws
- Key recovery policies
Module 12: Supplier Relationships and Third-Party Security - A.11.1 Supplier relationship information security
- A.11.2 Supplier service delivery management
- Third-party risk assessment templates
- Due diligence checklists for vendors
- Contractual security clauses
- Cloud service provider assessments
- Outsourcing risk management
- Third-party audit rights and access
- Service level agreement (SLA) security metrics
- Penetration testing of supplier systems
- Supply chain vulnerability mapping
- Managed service provider oversight
- Subcontractor risk management
- Onsite supplier access control
- Security questionnaires and assessments (SIG, CAIQ)
- Continuous monitoring of supplier risks
- Exit strategies and data recovery
Module 13: Incident Management and Business Continuity - A.12.1 Management of information security incidents
- A.12.2 Information security event reporting
- A.12.3 Response to information security events
- A.12.4 Learning from information security events
- A.12.5 Collection of evidence
- Incident response team structure
- Incident classification and prioritisation
- Containment, eradication, recovery steps
- Forensic data collection procedures
- Regulatory breach reporting timelines
- Customer and stakeholder notification plans
- Post-incident reviews and root cause analysis
- Incident playbooks for common scenarios
- Threat intelligence integration
- Coordination with law enforcement
- Simulated incident drills
- Business continuity integration
Module 14: Business Continuity and Resilience - A.13.1 Information security in business continuity
- A.13.2 Redundancies in information system
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Critical system identification
- Data backup strategies and frequency
- Disaster recovery site options
- Cloud-based continuity solutions
- War gaming and tabletop exercises
- Failover and failback procedures
- Backup integrity verification
- Testing frequency and documentation
- Ensuring control availability post-disruption
- Third-party continuity planning
- Legal obligations during outages
- Insurance and risk transfer
- Maintaining ISMS during crises
Module 15: Compliance, Legal, and Regulatory Alignment - A.14.1 Compliance with legal and contractual requirements
- Identifying applicable laws (GDPR, HIPAA, CCPA, etc.)
- Regulatory mapping to ISO controls
- Conducting compliance gap assessments
- Freedom of information and privacy laws
- Data sovereignty requirements
- Intellectual property protection
- Monitoring legislative changes
- Records retention and disposal policies
- Evidence collection for auditors
- Penalty avoidance strategies
- Industry-specific regulatory checklists
- International data transfer mechanisms
- Lawful processing grounds
- Regulatory reporting obligations
- Working with data protection officers (DPOs)
- Legal hold procedures
Module 16: Information Security Policies and Documentation - Developing the Information Security Policy
- Acceptable Use Policy (AUP) creation
- Remote Access Policy
- Incident Response Policy
- Acceptable Encryption Policy
- Data Handling Policy
- Physical Security Policy
- Mobile Device Policy
- Cloud Security Policy
- Vendor Security Policy
- Policy review and approval workflows
- Digital policy distribution and attestation
- Version control and change logs
- Policy compliance monitoring
- Automated reminders for reviews
- Policy exception management
- Integration with HR and legal teams
Module 17: Internal Audit and Management Review - A.15.1 Internal audit process
- A.15.2 Management review
- Creating an audit schedule
- Competency requirements for auditors
- Audit checklists aligned with Annex A
- Conducting document reviews
- Interviewing staff during audits
- Reporting audit findings and non-conformities
- Root cause analysis of audit gaps
- Corrective action planning
- Tracking closure of audit actions
- Preparing for external audits
- Presenting audit reports to leadership
- Scheduling regular management reviews
- Demonstrating continual improvement
- Using audit results to update risk assessments
- Integrating audits with other management systems
Module 18: Certification Audit Preparation - Stages of certification: Stage 1 and Stage 2 audits
- Selecting a certification body
- Understanding audit criteria and scoring
- Preparing audit evidence binders
- Organising documentation for auditors
- Conducting pre-certification readiness assessments
- Mock audits and gap closure
- Handling auditor questions and requests
- Responding to non-conformities
- Correcting major and minor findings
- Auditor communication etiquette
- Legal and contractual considerations with CBs
- Post-certification surveillance audits
- Maintaining certification over time
- Re-certification cycle management
- Using certification in marketing and proposals
- Handling adverse audit outcomes
Module 19: Post-Certification Sustainment - Integrating ISMS into daily operations
- Monthly ISMS performance reviews
- Annual internal audit scheduling
- Updating the risk assessment annually
- Reviewing and revising the SoA
- Tracking control effectiveness
- Updating policies and procedures
- Conducting management review meetings
- Reporting to the board or executive team
- Handling organisational changes (M&A, restructuring)
- Scaling the ISMS across departments
- Extending scope for multi-site operations
- Automation of ISMS workflows
- Using GRC platforms for sustainment
- Continuous improvement through feedback loops
- KPI dashboards for leadership
- Renewal planning for certification
Module 20: Advanced Topics and Career Advancement - Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
- A.11.1 Supplier relationship information security
- A.11.2 Supplier service delivery management
- Third-party risk assessment templates
- Due diligence checklists for vendors
- Contractual security clauses
- Cloud service provider assessments
- Outsourcing risk management
- Third-party audit rights and access
- Service level agreement (SLA) security metrics
- Penetration testing of supplier systems
- Supply chain vulnerability mapping
- Managed service provider oversight
- Subcontractor risk management
- Onsite supplier access control
- Security questionnaires and assessments (SIG, CAIQ)
- Continuous monitoring of supplier risks
- Exit strategies and data recovery
Module 13: Incident Management and Business Continuity - A.12.1 Management of information security incidents
- A.12.2 Information security event reporting
- A.12.3 Response to information security events
- A.12.4 Learning from information security events
- A.12.5 Collection of evidence
- Incident response team structure
- Incident classification and prioritisation
- Containment, eradication, recovery steps
- Forensic data collection procedures
- Regulatory breach reporting timelines
- Customer and stakeholder notification plans
- Post-incident reviews and root cause analysis
- Incident playbooks for common scenarios
- Threat intelligence integration
- Coordination with law enforcement
- Simulated incident drills
- Business continuity integration
Module 14: Business Continuity and Resilience - A.13.1 Information security in business continuity
- A.13.2 Redundancies in information system
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Critical system identification
- Data backup strategies and frequency
- Disaster recovery site options
- Cloud-based continuity solutions
- War gaming and tabletop exercises
- Failover and failback procedures
- Backup integrity verification
- Testing frequency and documentation
- Ensuring control availability post-disruption
- Third-party continuity planning
- Legal obligations during outages
- Insurance and risk transfer
- Maintaining ISMS during crises
Module 15: Compliance, Legal, and Regulatory Alignment - A.14.1 Compliance with legal and contractual requirements
- Identifying applicable laws (GDPR, HIPAA, CCPA, etc.)
- Regulatory mapping to ISO controls
- Conducting compliance gap assessments
- Freedom of information and privacy laws
- Data sovereignty requirements
- Intellectual property protection
- Monitoring legislative changes
- Records retention and disposal policies
- Evidence collection for auditors
- Penalty avoidance strategies
- Industry-specific regulatory checklists
- International data transfer mechanisms
- Lawful processing grounds
- Regulatory reporting obligations
- Working with data protection officers (DPOs)
- Legal hold procedures
Module 16: Information Security Policies and Documentation - Developing the Information Security Policy
- Acceptable Use Policy (AUP) creation
- Remote Access Policy
- Incident Response Policy
- Acceptable Encryption Policy
- Data Handling Policy
- Physical Security Policy
- Mobile Device Policy
- Cloud Security Policy
- Vendor Security Policy
- Policy review and approval workflows
- Digital policy distribution and attestation
- Version control and change logs
- Policy compliance monitoring
- Automated reminders for reviews
- Policy exception management
- Integration with HR and legal teams
Module 17: Internal Audit and Management Review - A.15.1 Internal audit process
- A.15.2 Management review
- Creating an audit schedule
- Competency requirements for auditors
- Audit checklists aligned with Annex A
- Conducting document reviews
- Interviewing staff during audits
- Reporting audit findings and non-conformities
- Root cause analysis of audit gaps
- Corrective action planning
- Tracking closure of audit actions
- Preparing for external audits
- Presenting audit reports to leadership
- Scheduling regular management reviews
- Demonstrating continual improvement
- Using audit results to update risk assessments
- Integrating audits with other management systems
Module 18: Certification Audit Preparation - Stages of certification: Stage 1 and Stage 2 audits
- Selecting a certification body
- Understanding audit criteria and scoring
- Preparing audit evidence binders
- Organising documentation for auditors
- Conducting pre-certification readiness assessments
- Mock audits and gap closure
- Handling auditor questions and requests
- Responding to non-conformities
- Correcting major and minor findings
- Auditor communication etiquette
- Legal and contractual considerations with CBs
- Post-certification surveillance audits
- Maintaining certification over time
- Re-certification cycle management
- Using certification in marketing and proposals
- Handling adverse audit outcomes
Module 19: Post-Certification Sustainment - Integrating ISMS into daily operations
- Monthly ISMS performance reviews
- Annual internal audit scheduling
- Updating the risk assessment annually
- Reviewing and revising the SoA
- Tracking control effectiveness
- Updating policies and procedures
- Conducting management review meetings
- Reporting to the board or executive team
- Handling organisational changes (M&A, restructuring)
- Scaling the ISMS across departments
- Extending scope for multi-site operations
- Automation of ISMS workflows
- Using GRC platforms for sustainment
- Continuous improvement through feedback loops
- KPI dashboards for leadership
- Renewal planning for certification
Module 20: Advanced Topics and Career Advancement - Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
- A.13.1 Information security in business continuity
- A.13.2 Redundancies in information system
- Business impact analysis (BIA) methodology
- Recovery time objectives (RTO) and recovery point objectives (RPO)
- Critical system identification
- Data backup strategies and frequency
- Disaster recovery site options
- Cloud-based continuity solutions
- War gaming and tabletop exercises
- Failover and failback procedures
- Backup integrity verification
- Testing frequency and documentation
- Ensuring control availability post-disruption
- Third-party continuity planning
- Legal obligations during outages
- Insurance and risk transfer
- Maintaining ISMS during crises
Module 15: Compliance, Legal, and Regulatory Alignment - A.14.1 Compliance with legal and contractual requirements
- Identifying applicable laws (GDPR, HIPAA, CCPA, etc.)
- Regulatory mapping to ISO controls
- Conducting compliance gap assessments
- Freedom of information and privacy laws
- Data sovereignty requirements
- Intellectual property protection
- Monitoring legislative changes
- Records retention and disposal policies
- Evidence collection for auditors
- Penalty avoidance strategies
- Industry-specific regulatory checklists
- International data transfer mechanisms
- Lawful processing grounds
- Regulatory reporting obligations
- Working with data protection officers (DPOs)
- Legal hold procedures
Module 16: Information Security Policies and Documentation - Developing the Information Security Policy
- Acceptable Use Policy (AUP) creation
- Remote Access Policy
- Incident Response Policy
- Acceptable Encryption Policy
- Data Handling Policy
- Physical Security Policy
- Mobile Device Policy
- Cloud Security Policy
- Vendor Security Policy
- Policy review and approval workflows
- Digital policy distribution and attestation
- Version control and change logs
- Policy compliance monitoring
- Automated reminders for reviews
- Policy exception management
- Integration with HR and legal teams
Module 17: Internal Audit and Management Review - A.15.1 Internal audit process
- A.15.2 Management review
- Creating an audit schedule
- Competency requirements for auditors
- Audit checklists aligned with Annex A
- Conducting document reviews
- Interviewing staff during audits
- Reporting audit findings and non-conformities
- Root cause analysis of audit gaps
- Corrective action planning
- Tracking closure of audit actions
- Preparing for external audits
- Presenting audit reports to leadership
- Scheduling regular management reviews
- Demonstrating continual improvement
- Using audit results to update risk assessments
- Integrating audits with other management systems
Module 18: Certification Audit Preparation - Stages of certification: Stage 1 and Stage 2 audits
- Selecting a certification body
- Understanding audit criteria and scoring
- Preparing audit evidence binders
- Organising documentation for auditors
- Conducting pre-certification readiness assessments
- Mock audits and gap closure
- Handling auditor questions and requests
- Responding to non-conformities
- Correcting major and minor findings
- Auditor communication etiquette
- Legal and contractual considerations with CBs
- Post-certification surveillance audits
- Maintaining certification over time
- Re-certification cycle management
- Using certification in marketing and proposals
- Handling adverse audit outcomes
Module 19: Post-Certification Sustainment - Integrating ISMS into daily operations
- Monthly ISMS performance reviews
- Annual internal audit scheduling
- Updating the risk assessment annually
- Reviewing and revising the SoA
- Tracking control effectiveness
- Updating policies and procedures
- Conducting management review meetings
- Reporting to the board or executive team
- Handling organisational changes (M&A, restructuring)
- Scaling the ISMS across departments
- Extending scope for multi-site operations
- Automation of ISMS workflows
- Using GRC platforms for sustainment
- Continuous improvement through feedback loops
- KPI dashboards for leadership
- Renewal planning for certification
Module 20: Advanced Topics and Career Advancement - Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
- Developing the Information Security Policy
- Acceptable Use Policy (AUP) creation
- Remote Access Policy
- Incident Response Policy
- Acceptable Encryption Policy
- Data Handling Policy
- Physical Security Policy
- Mobile Device Policy
- Cloud Security Policy
- Vendor Security Policy
- Policy review and approval workflows
- Digital policy distribution and attestation
- Version control and change logs
- Policy compliance monitoring
- Automated reminders for reviews
- Policy exception management
- Integration with HR and legal teams
Module 17: Internal Audit and Management Review - A.15.1 Internal audit process
- A.15.2 Management review
- Creating an audit schedule
- Competency requirements for auditors
- Audit checklists aligned with Annex A
- Conducting document reviews
- Interviewing staff during audits
- Reporting audit findings and non-conformities
- Root cause analysis of audit gaps
- Corrective action planning
- Tracking closure of audit actions
- Preparing for external audits
- Presenting audit reports to leadership
- Scheduling regular management reviews
- Demonstrating continual improvement
- Using audit results to update risk assessments
- Integrating audits with other management systems
Module 18: Certification Audit Preparation - Stages of certification: Stage 1 and Stage 2 audits
- Selecting a certification body
- Understanding audit criteria and scoring
- Preparing audit evidence binders
- Organising documentation for auditors
- Conducting pre-certification readiness assessments
- Mock audits and gap closure
- Handling auditor questions and requests
- Responding to non-conformities
- Correcting major and minor findings
- Auditor communication etiquette
- Legal and contractual considerations with CBs
- Post-certification surveillance audits
- Maintaining certification over time
- Re-certification cycle management
- Using certification in marketing and proposals
- Handling adverse audit outcomes
Module 19: Post-Certification Sustainment - Integrating ISMS into daily operations
- Monthly ISMS performance reviews
- Annual internal audit scheduling
- Updating the risk assessment annually
- Reviewing and revising the SoA
- Tracking control effectiveness
- Updating policies and procedures
- Conducting management review meetings
- Reporting to the board or executive team
- Handling organisational changes (M&A, restructuring)
- Scaling the ISMS across departments
- Extending scope for multi-site operations
- Automation of ISMS workflows
- Using GRC platforms for sustainment
- Continuous improvement through feedback loops
- KPI dashboards for leadership
- Renewal planning for certification
Module 20: Advanced Topics and Career Advancement - Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
- Stages of certification: Stage 1 and Stage 2 audits
- Selecting a certification body
- Understanding audit criteria and scoring
- Preparing audit evidence binders
- Organising documentation for auditors
- Conducting pre-certification readiness assessments
- Mock audits and gap closure
- Handling auditor questions and requests
- Responding to non-conformities
- Correcting major and minor findings
- Auditor communication etiquette
- Legal and contractual considerations with CBs
- Post-certification surveillance audits
- Maintaining certification over time
- Re-certification cycle management
- Using certification in marketing and proposals
- Handling adverse audit outcomes
Module 19: Post-Certification Sustainment - Integrating ISMS into daily operations
- Monthly ISMS performance reviews
- Annual internal audit scheduling
- Updating the risk assessment annually
- Reviewing and revising the SoA
- Tracking control effectiveness
- Updating policies and procedures
- Conducting management review meetings
- Reporting to the board or executive team
- Handling organisational changes (M&A, restructuring)
- Scaling the ISMS across departments
- Extending scope for multi-site operations
- Automation of ISMS workflows
- Using GRC platforms for sustainment
- Continuous improvement through feedback loops
- KPI dashboards for leadership
- Renewal planning for certification
Module 20: Advanced Topics and Career Advancement - Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
- Integrating ISO 27001 with ISO 22301 (BCM)
- Integration with ISO 9001 and ISO 14001
- Aligning with NIST CSF
- Maturity models for ISMS development
- Using ISO 27001 as a foundation for other certifications
- Preparing for the ISO 27001 Lead Implementer role
- Transitioning into security consultancy
- Becoming an internal ISMS champion
- Building a security culture in your organisation
- Leveraging certification for career growth
- Presenting ISMS success to executives
- Salary benchmarks for ISO 27001 professionals
- Networking with other implementers
- Using your Certificate of Completion strategically
- Pursuing lead auditor training after implementation
- Teaching others within your organisation
- Contributing to industry best practices
