ISO 27001:2022 Lead Implementer

By the end of this training course, the participants will be able to:

• Explain the fundamental concepts and principles of an Information Security Management System (ISMS) based on ISO/IEC 27001.

• Interpret the ISO/IEC 27001 requirements for an ISMS from an implementer’s perspective.

• Initiate and plan the implementation of an ISMS based on ISO/IEC 27001 by utilizing ’s IMS2 Methodology and other best practices.

• Support an organization in operating, maintaining, and continually improving an ISMS based on ISO/IEC 27001.

• Prepare an organization to undergo a third-party certification audit.

• Project managers and consultants involved in and concerned with the implementation of an ISMS.

• Expert advisors seeking to master the implementation of an ISMS.

• Individuals responsible for ensuring conformity to information security requirements within an organization.

• Members of an ISMS implementation team.

It is required to have a fundamental understanding of Information Security Management Systems (ISMS) and the ISO/IEC 27001 standard.

Introduction to ISO/IEC 27001 and initiation of an ISMS

• Introduction

• General information

• Learning objectives

• Educational approach

• Examination and certification

• What is ISO?

• The ISO/IEC 27000 family of standards

• Advantages of ISO/IEC 27001

• Definition of a management system

• Management system standards

• Integrated management systems

• Definition of an ISMS

• Process approach

• Overview — Clauses 4 to 10

• Overview — Annex A

• Information and asset

• Information security

• Availability, confidentiality, and integrity

• Vulnerability, threat, and impact

• Information security risk

• Classification of security controls

• Define the approach to the ISMS implementation

• Proposed implementation approaches

• Application of the proposed implementation approaches

• Choose a methodological framework to manage the implementation of an ISMS

• Approach and methodology

• Alignment with best practices

• Mission, objectives, values, and strategies of the organization

• ISMS objectives

• Preliminary scope definition

• Internal and external environment

• Key processes and activities

• Interested parties

• Business requirements

• Boundary of the ISMS

• Organizational boundaries

• Information security boundaries

• Physical boundaries

• ISMS scope statement

Planning the implementation of an ISMS

• Business case

• Resource requirements

• ISMS project plan

• ISMS project team

• Management approval

• Organizational structure

• Information security coordinator

• Roles and responsibilities of interested parties

• Roles and responsibilities of key committees

• Determine the current state

• Conduct the gap analysis

• Establish maturity targets

• Publish a gap analysis report

• Types of policies

• Policy models

• Information security policy

• Specific security policies

• Management policy approval

• Publication and dissemination

• Training and awareness sessions

• Control, evaluation, and review

• ISO/IEC 27005

• Risk assessment approach

• Risk assessment methodology

• Risk identification

• Risk estimation

• Risk evaluation

• Risk treatment

• Residual risk

• Drafting the Statement of Applicability

• Management approval

• Review and selection of the applicable information security controls

• Justification of selected controls

• Justification of excluded controls

Implementation of an ISMS

• Value and types of documented information

• Master list of documented information

• Creation of templates

• Documented information management process

• Implementation of a documented information management system

• Management of records

• Organization’s security architecture

• Preparation for the implementation of controls

• Design and description of controls

• Implementation of security processes and controls

• Introduction of Annex A controls

• Big data

• The three V’s of big data

• Artificial intelligence

• Machine learning

• Cloud computing

• Outsourced operations

• The impact of new technologies in information security

• Principles of an efficient communication strategy

• Information security communication process

• Establishing communication objectives

• Identifying interested parties

• Planning communication activities

• Performing a communication activity

• Evaluating communication

• Competence and people development

• Difference between training, awareness, and communication

• Determine competence needs

• Plan the competence development activities

• Define the competence development program type and structure

• Training and awareness programs

• Provide the trainings

• Evaluate the outcome of trainings

• Change management planning

• Management of operations

• Resource management

• ISO/IEC 27035-1 and ISO/IEC 27035-2

• ISO/IEC 27032

• Information security incident management policy

• Process and procedure for incident management

• Incident response team

• Incident management security controls

• Forensics process

• Records of information security incidents

• Measure and review of the incident management process

ISMS monitoring, continual improvement, and preparation for the certification audit

• Determine measurement objectives

• Define what needs to be monitored and measured

• Establish ISMS performance indicators

• Report the results

• What is an audit?

• Types of audits

• Create an internal audit program

• Designate a responsible person

• Establish independence, objectivity, and impartiality

• Plan audit activities

• Perform audit activities

• Follow up on nonconformities

• Preparing a management review

• Conducting a management review

• Management review outputs

• Management review follow-up activities

• Root-cause analysis process

• Root-cause analysis tools

• Corrective action procedure

• Preventive action procedure

• Continual monitoring process

• Maintenance and improvement of the ISMS

• Continual update of the documented information

• Documentation of the improvements

• Selecting the certification body

• Preparing for the certification audit

• Stage 1 audit

• Stage 2 audit

• Follow-up audit

• Certification decision

• Planning for ISMS Implementation

• Gap Assessment

• Risk Assessment

• Risk Treatment

• Creating Statement of Applicability

• Internal Audit Process

• Management Review

• Documentation