Description

This curriculum spans the end-to-end operational demands of maintaining an ISO 27001-certified ISMS, equivalent in depth to a multi-phase internal capability build or a multi-workshop advisory engagement across risk, access, incident response, and third-party governance.

Module 1: Defining the Scope and Boundaries of the ISMS

Determining which business units, systems, and locations are included in the ISMS based on risk exposure and regulatory obligations.
Documenting excluded departments or processes with justifications acceptable to internal audit and external certifiers.
Mapping physical locations, cloud environments, and third-party providers to ensure complete coverage.
Resolving conflicts between legal departments and IT over jurisdictional boundaries in multinational operations.
Updating scope documentation when mergers, divestitures, or new service lines are introduced.
Aligning ISMS scope with existing enterprise architecture diagrams and asset inventories.
Obtaining formal sign-off from executive management on scope definition before audit cycles.
Handling shadow IT systems that fall outside the defined scope but process sensitive data.

Module 2: Risk Assessment and Treatment Planning

Selecting between qualitative and quantitative risk assessment methodologies based on data availability and stakeholder requirements.
Assigning ownership of high-risk assets to specific individuals accountable for mitigation actions.
Using threat modeling techniques to identify attack vectors not captured in standard risk registers.
Integrating findings from penetration tests and vulnerability scans into the risk treatment plan.
Negotiating acceptable risk levels with business units that resist control implementation due to cost or operational impact.
Documenting risk acceptance decisions with expiration dates and required re-evaluation triggers.
Ensuring risk treatment actions are tracked in project management tools with assigned deadlines and status reporting.
Reassessing risks after major incidents or changes in threat landscape, such as new ransomware campaigns.

Module 3: Information Security Policies and Documentation

Drafting policy statements that are enforceable and aligned with operational realities across departments.
Establishing version control and review cycles for all security documents to maintain compliance.
Translating high-level policies into role-specific procedures for IT, HR, and procurement teams.
Ensuring policy language is consistent across regions despite differing legal requirements.
Integrating policy exceptions into the risk register with documented compensating controls.
Conducting policy attestation campaigns with automated tracking for employee acknowledgments.
Archiving outdated policies in a secure repository to meet audit evidence requirements.
Coordinating legal review of policy content to avoid conflicts with labor laws or contractual obligations.

Module 4: Access Control Strategy and Identity Management

Defining role-based access control (RBAC) models that reflect actual job responsibilities, not organizational charts.
Implementing automated provisioning and deprovisioning workflows integrated with HR systems.
Setting review frequencies for privileged access based on risk tier and regulatory mandates.
Enforcing multi-factor authentication for administrative accounts across on-premises and cloud platforms.
Managing shared and service accounts with documented justification and periodic access reviews.
Restricting remote access to production environments using jump servers and session monitoring.
Handling access for third-party vendors with time-limited credentials and activity logging.
Responding to access control failures during incident investigations by analyzing log completeness and retention.

Module 5: Incident Response and Management

Classifying incidents using a standardized severity matrix accepted by IT, legal, and communications teams.
Activating the incident response team based on predefined escalation thresholds and communication protocols.
Preserving forensic evidence in a manner that supports potential legal proceedings.
Coordinating with external parties such as law enforcement, insurers, and forensic consultants under NDAs.
Documenting all response actions in a central log for post-incident review and audit purposes.
Conducting post-mortem meetings to update playbooks and prevent recurrence.
Testing incident response plans through tabletop exercises with business continuity stakeholders.
Reporting breaches to supervisory authorities within 72 hours as required by GDPR and other regulations.

Module 6: Business Continuity and Resilience Planning

Conducting business impact analyses to determine critical systems and maximum tolerable downtime.
Validating backup integrity through periodic restoration tests in isolated environments.
Establishing geographically separate recovery sites with up-to-date data replication.
Integrating cloud-based failover solutions with on-premises systems without introducing single points of failure.
Updating contact lists and communication trees for crisis scenarios with role-specific notification paths.
Aligning recovery time objectives (RTOs) and recovery point objectives (RPOs) with business unit expectations.
Testing full-scale disaster recovery scenarios during maintenance windows without disrupting operations.
Ensuring third-party providers have equivalent resilience commitments documented in SLAs.

Module 7: Supplier and Third-Party Risk Management

Conducting security assessments of vendors before contract finalization using standardized questionnaires.
Negotiating audit rights and right-to-terminate clauses based on security performance.
Classifying suppliers by risk level to determine assessment frequency and depth.
Monitoring third-party compliance with ISO 27001 or equivalent frameworks through audit reports and certifications.
Enforcing data processing agreements that specify security requirements and breach notification timelines.
Mapping data flows between internal systems and external providers to identify exposure points.
Managing subcontracting arrangements where vendors outsource components of the service.
Terminating access and retrieving data when contracts expire or relationships end.

Module 8: Security Monitoring and Log Management

Defining log retention periods based on legal requirements, storage costs, and forensic needs.
Centralizing logs from firewalls, servers, and applications into a SIEM with normalized formats.
Creating detection rules for suspicious activities such as brute force attacks or data exfiltration patterns.
Assigning responsibility for monitoring alerts during business hours and after-hours coverage.
Calibrating alert thresholds to reduce false positives without missing critical events.
Ensuring log sources are synchronized using NTP to maintain accurate timelines during investigations.
Restricting access to raw logs to prevent tampering or unauthorized disclosure.
Integrating threat intelligence feeds to enrich log analysis with known malicious indicators.

Module 9: Internal Audit and Continuous Improvement

Planning audit schedules that cover all controls and departments within the certification cycle.
Selecting auditors with technical expertise and no conflict of interest regarding the areas being reviewed.
Documenting non-conformities with specific references to ISO 27001 clauses and observed evidence.
Tracking corrective actions to closure with evidence of implementation and effectiveness.
Reporting audit findings to top management with risk-based prioritization.
Comparing current audit results with historical data to identify recurring weaknesses.
Using audit outcomes to update risk assessments and improve control design.
Preparing for external certification audits by conducting pre-assessment readiness reviews.

Module 10: Change Management and Control Integration

Requiring security impact assessments for all changes to systems, networks, or applications.
Integrating security checkpoints into the organization’s existing change advisory board (CAB) process.
Reviewing emergency changes post-implementation to ensure they meet security standards.
Updating asset inventories and risk registers when new systems are deployed.
Validating that security controls are maintained after infrastructure or application upgrades.
Coordinating control updates when ISO 27001 is revised or new regulatory requirements emerge.
Training change managers on security requirements to reduce approval of non-compliant changes.
Monitoring configuration drift using automated tools to detect unauthorized deviations from baseline.