Day 1 starts with an introduction to ISMS in an information security risk management context. Key concepts, principles, terms and definitions of the ISO / IEC 27001:2022 standard are evaluated, and how you should interpret its requirements to define the scope of your ISMS. You will learn how the standard establishes the management cycle for information security and what steps you should take to ensure successful planning and implementation in practice. The course offers an overview of the process, main challenges and pitfalls, and prerequisites that should be met before ISO 27001 implementation and that will set the stage for more in-depth discussions during Day 2 and Day 3.

Topics covered:

• ISMS and information security risk management
• Information security objectives and control objectives
• Policies, processes and resources
• Phases of ISMS implementation
• History and structure of ISO 27001
• Determining the scope of an ISMS
• Leadership and commitment
• Organisational roles, responsibilities and authorities
• Planning, support and required documentation
• Risk assessment and risk treatment

From Day 2 onwards, the course takes a more in-depth and hands on approach towards implementation of the standard and ensure continuous improvement of the information security process. After a more thorough look at ISO/IEC 27001:2017 and ISO/IEC 27002:2022, challenges in selection and implementation of controls are discussed. ISMS stakeholders are evaluated and how to involve them and keep them involved in your program. Quite some time today is spent on risk and risk assessments, the very foundation of the information security practice. We will discuss how to avoid check-box compliance, the difference between doing the right things versus doing the right things right by taking a risk-based approach. You will learn how to evaluate ISMS performance, identify nonconformities, and take corrective actions. Lastly you will learn how to work with your internal audit department, prepare for an internal audit and management review.

Topics covered:

• Challenges in the selection and implementation of information security controls
• ISMS stakeholders
• Risk assessment, risk treatment and documentation
• ISMS performance evaluation, nonconformities and corrective actions
• Information security incident management
• Internal audit and management review

Day 3 starts with an evaluation of information security controls in more detail, focusing on the ISO/IEC 27002:2022 reference standard, its relationship with ISO/IEC 27001:2017 and how to analyze which controls may or may not reduce which risks. From thereon, the course will investigate the ISO 27001 certification process: You will evaluate how audits are performed, how to demonstrate compliance to an auditor, and what it takes to become and remain compliant. The course ends with a case study exercise, where you will advise your organization on the implementation of an ISMS and help them prepare for a third-party audit.

Topics covered:

•ISO 27002: 2022 Information security controls
•ISO 27001 certification
•Required processes
•Required and recommended documentation
•Auditor’s focus
•Case Study Exercise: ISMS Implementation and preparing for a third-party certification audit

Exam

• Language: English
• Delivered: Online via a certified proctor
• Questions: 20 multiple choice & 2 cases
• Time: 120 minutes