- Duration
- 5 days
- Level
- Implementer
- Formats
- Virtual instructor-led, In-house
- CPD hours
- 35
Course overview
This intensive five-day course gives you the knowledge and practical skills to plan, implement, manage and maintain an information security management system based on ISO/IEC 27001:2022. Through lectures, worked examples and a running case study, you build each element of an ISMS, from scope and risk assessment to the Statement of Applicability, monitoring and certification readiness.
Why attend
- Lead an ISO/IEC 27001 project with confidence from start to certificate
- Learn a risk methodology you can apply immediately
- Understand how the 2022 controls map to SOC 2, NIST CSF and local regulations
- Gain templates and checklists used in real implementations
- Prepare for the role of ISMS manager or implementation consultant
Who should attend
- ISMS managers and project leads
- Security and IT managers
- Consultants
Learning objectives
- Scope and plan an ISMS
- Run a risk assessment and build a Statement of Applicability
- Implement and monitor controls
- Prepare for certification
Course agenda
Day 1Introduction to ISO/IEC 27001 and initiating an ISMS
- Standards and regulatory frameworks
- Fundamental concepts of information security
- The ISMS and the Plan-Do-Check-Act cycle
- Initiating the implementation: business case and leadership commitment
- Understanding the organisation and its context
- Defining the ISMS scope
Day 2Planning the ISMS
- Information security policy and objectives
- Roles, responsibilities and governance
- Information security risk assessment methodology (ISO/IEC 27005)
- Risk identification, analysis and evaluation
- Risk treatment and the risk treatment plan
- The Statement of Applicability
Day 3Implementing the ISMS
- Documented information and document control
- Selecting and designing Annex A controls
- Organisational, people, physical and technological controls
- Supplier and cloud security
- Competence, awareness and communication
- Incident management and business continuity aspects
Day 4Monitoring, measurement and continual improvement
- Monitoring, measurement and metrics
- Internal audit programme
- Management review
- Nonconformity and corrective action
- Continual improvement
- Preparing for the certification audit: Stage 1 and Stage 2
Day 5Case study review and assessment
- Review of the course case study
- Transitioning and integrating with other management systems
- Questions and exam preparation
- Written assessment
Prerequisites
A basic understanding of information security concepts. Experience in IT, risk or compliance is helpful but not required.
Assessment and certificate
Written assessment. A scenario-based written assessment on the final day, open book, covering the requirements and their practical application. Pass mark 70%. Participants who pass receive a certificate of achievement; others receive a certificate of attendance.
Certificate: Certificate of achievement (on passing) or attendance from Secure iQube.
What is included
- Course slides and participant notes
- Practical workbook with exercises and case studies
- Templates you can adapt for your organisation
- Certificate of completion
- 30 days of post-course Q&A support by email
- Refreshments and lunch for classroom sessions
Dates
Public dates are announced regularly. Enquire below for the next date, or book a private session for your team on dates that suit you.