Skip to main content
Security Education and Training in ISO 27799

Security Education and Training in ISO 27799

$346.00
How you learn:
Self-paced • Lifetime updates
When you get access:
Course access is prepared after purchase and delivered via email
Your guarantee:
30-day money-back guarantee — no questions asked
Toolkit Included:
Includes a practical, ready-to-use toolkit containing implementation templates, worksheets, checklists, and decision-support materials used to accelerate real-world application and reduce setup time.
Who trusts this:
Trusted by professionals in 160+ countries
Adding to cart… The item has been added

What does the Security Education and Training in ISO 27799 course cover?

Security Education and Training in ISO 27799 is covered here in 10 modules: Establishing Governance for Security Awareness Programs, Risk-Based Training Needs Assessment, Designing Role-Specific Security Content and 7 more. The outline lists 80 specific topics, opening with define scope and accountability for security training across clinical, administrative, and IT roles within healthcare organizations.

How do you approach Security Education and Training in ISO 27799 step by step?

The work is sequenced in 10 stages. It starts with Establishing Governance for Security Awareness Programs, moves through Risk-Based Training Needs Assessment and Designing Role-Specific Security Content, and ends at Aligning with ISO 27799 and External Audits. Each stage carries its own topic list, so the sequence is followed rather than summarised.

What is in Module 1 of the Security Education and Training in ISO 27799 course?

Module 1 is Establishing Governance for Security Awareness Programs. It works through define scope and accountability for security training across clinical, administrative, and IT roles within healthcare organizations., select executive sponsors and governance committee members with authority to enforce participation and allocate resources., determine reporting lines for training compliance data to risk, compliance, and clinical leadership teams. and 5 more.

How is the Security Education and Training in ISO 27799 course delivered?

The Security Education and Training in ISO 27799 course is fully self-paced with immediate online access after enrolment. Access does not expire and future updates are included at no cost. It can be taken on any device, and a certificate of completion is issued by The Art of Service when you finish.

How much does the Security Education and Training in ISO 27799 course cost?

The Security Education and Training in ISO 27799 course is $346 as a one time payment. There is no subscription, no per seat licence and no hidden fee. Enrolment carries a 30 day satisfied or refunded guarantee, so it can be assessed in full before you commit.

Closely related courses: Education And Training Toolkit, Technical Education And Training Toolkit, Education Training in Work Team Kit, Education Training in Resource Development Kit.

More answers: what you get with every course, refund policy, all help answers.

This curriculum spans the design and operationalization of a healthcare-specific security training program, comparable in scope to a multi-phase advisory engagement that integrates governance, risk assessment, role-based content development, workflow integration, and audit alignment across clinical and administrative functions.

Module 1: Establishing Governance for Security Awareness Programs

  • Define scope and accountability for security training across clinical, administrative, and IT roles within healthcare organizations.
  • Select executive sponsors and governance committee members with authority to enforce participation and allocate resources.
  • Determine reporting lines for training compliance data to risk, compliance, and clinical leadership teams.
  • Align training governance with ISO 27799 controls 5.1.1 (Information security policies) and 8.2.1 (User awareness).
  • Establish thresholds for acceptable completion rates and retraining triggers based on audit findings.
  • Integrate training governance into existing risk management frameworks such as HIPAA or NIST CSF.
  • Resolve conflicts between departmental autonomy and centralized security mandates during policy rollout.
  • Document decision trails for training scope exclusions, such as third-party vendors or temporary staff.

Module 2: Risk-Based Training Needs Assessment

  • Map roles to data access levels (e.g., physicians vs. billing clerks) to determine training intensity and content.
  • Conduct threat scenario workshops to identify high-risk behaviors requiring targeted intervention.
  • Use incident data from phishing logs and audit trails to prioritize training topics.
  • Assess current knowledge gaps via pre-training quizzes focused on HIPAA, ransomware, and device handling.
  • Classify training needs by frequency and urgency (e.g., new hire vs. annual refresher vs. post-incident).
  • Validate risk assessment inputs with legal, privacy, and clinical informatics stakeholders.
  • Adjust training focus based on changes in regulatory enforcement trends or breach patterns.
  • Document risk rationale for omitting low-exposure roles from specialized modules.

Module 3: Designing Role-Specific Security Content

  • Develop distinct training tracks for clinicians, IT support, and administrative staff using job shadowing insights.
  • Customize phishing simulation content to reflect real healthcare email threats (e.g., fake lab results).
  • Incorporate clinical workflow constraints, such as time pressure and EHR interface limitations.
  • Include device-specific guidance for mobile carts, shared workstations, and wearable health monitors.
  • Embed real-world case studies of PHI breaches due to poor password hygiene or screen visibility.
  • Ensure language avoids technical jargon when addressing non-technical roles.
  • Design content for shift workers by offering asynchronous and mobile-accessible formats.
  • Validate scenario realism with frontline staff during pilot sessions.

Module 4: Integrating Training with Clinical Workflows

  • Time mandatory training rollouts to avoid peak clinical periods such as flu season or system upgrades.
  • Embed microlearning modules within EHR login sequences for just-in-time awareness.
  • Coordinate with scheduling systems to release training assignments during low-activity shifts.
  • Negotiate with department heads to allocate paid time for training completion.
  • Design reminders that appear in clinical messaging systems without disrupting patient care.
  • Track completion rates by department and escalate non-compliance through clinical leadership.
  • Adjust module length based on observed drop-off rates during usability testing.
  • Integrate training milestones into onboarding checklists for new clinical hires.

Module 5: Selecting and Configuring Delivery Platforms

  • Evaluate LMS vendors based on integration capability with Active Directory and HRIS systems.
  • Configure SSO access to training portals to reduce login friction for clinical users.
  • Set up automated enrollment rules based on job code, department, and hire date.
  • Test mobile responsiveness of training modules on common clinical devices (e.g., tablets, smartphones).
  • Ensure platform generates audit logs compliant with ISO 27799 control 12.4.1 (Event logging).
  • Configure alerts for incomplete training 14 days before compliance deadlines.
  • Validate that platform supports SCORM/xAPI for detailed interaction tracking.
  • Restrict administrative access to training data based on least privilege principles.

Module 6: Measuring Training Effectiveness

  • Track post-training phishing click rates and compare against baseline metrics.
  • Correlate training completion dates with reductions in policy violation incidents.
  • Use knowledge assessment scores to identify persistent misconceptions across departments.
  • Conduct follow-up interviews with staff to assess behavior change in real workflows.
  • Compare incident reporting rates before and after training to measure cultural impact.
  • Adjust scoring thresholds for passing based on role criticality and risk exposure.
  • Map training outcomes to specific ISO 27799 controls for audit validation.
  • Report lagging indicators (e.g., breach frequency) alongside leading indicators (e.g., quiz scores).

Module 7: Managing Third-Party and Contractor Training

  • Require vendors to provide evidence of security training before granting system access.
  • Deliver abbreviated training modules focused on data handling and reporting obligations.
  • Enforce training completion as a condition of contract renewal or invoice processing.
  • Assign internal sponsors to monitor third-party compliance and escalate lapses.
  • Limit access rights until training verification is confirmed in the LMS.
  • Include training requirements in service level agreements (SLAs) and procurement contracts.
  • Conduct spot audits of contractor training records during vendor reviews.
  • Designate fallback procedures when third-party platforms cannot integrate with internal LMS.

Module 8: Responding to Security Incidents with Targeted Re-Training

  • Trigger mandatory re-training for individuals involved in a phishing incident within 48 hours.
  • Develop incident-specific modules based on root cause analysis findings.
  • Use breach timelines to demonstrate consequences of delayed reporting or poor judgment.
  • Require supervisors to review re-training content with affected staff in one-on-one sessions.
  • Adjust training content based on forensic analysis of compromised accounts or devices.
  • Coordinate with legal and compliance to ensure re-training does not interfere with investigations.
  • Track re-training completion separately for audit and disciplinary documentation.
  • Evaluate whether systemic knowledge gaps require organization-wide intervention.

Module 9: Sustaining Engagement and Avoiding Fatigue

  • Rotate content formats quarterly (e.g., video, quiz, scenario simulation) to maintain attention.
  • Introduce gamification elements such as department leaderboards with non-monetary recognition.
  • Limit annual training duration to under 90 minutes to reduce resistance.
  • Use real breach headlines in training materials to reinforce relevance.
  • Survey staff annually to identify preferred delivery methods and content pain points.
  • Rotate message ownership across departments (e.g., nursing-led security tips).
  • Introduce refresher content through posters, email signatures, and huddles.
  • Monitor completion drop-off rates and revise content before renewal cycles.

Module 10: Aligning with ISO 27799 and External Audits

  • Map each training module to specific ISO 27799 controls, including 8.2.1, 8.2.2, and 5.1.2.
  • Prepare training completion reports in formats acceptable to external auditors.
  • Document exceptions for roles excluded from training with risk acceptance justifications.
  • Archive training materials and assessment results for minimum retention periods.
  • Conduct internal mock audits to test readiness for certification assessments.
  • Coordinate with privacy officers to ensure training content reflects current HIPAA requirements.
  • Update training content immediately following changes to ISO 27799 or related standards.
  • Provide auditors with access logs and enrollment rules to demonstrate consistent enforcement.
!