ISO IEC 27001 and 27002 Training

Lesson 1 • Business Drivers for an ISMS

Examines regulatory pressure, customer expectations, and breach costs that motivate ISMS adoption. Connects security investment to measurable business outcomes.

Lesson 2 • Organisational Context and Interested Parties

Applies Clause 4 thinking to identify internal and external issues and stakeholder needs. Learners practice scoping an ISMS around real organisational context.

Lesson 3 • Core Information Security Concepts

Defines confidentiality, integrity, and availability as the CIA triad and introduces key terminology. Grounds all subsequent ISMS discussions in shared vocabulary.

Lesson 1 • Information Security Objectives

Teaches how to set measurable, aligned security objectives and link them to operational plans. Objectives translate policy intent into trackable performance targets.

Lesson 2 • Defining and Documenting ISMS Scope

Guides learners through boundary-setting decisions, exclusions, and scope statement drafting. A well-defined scope prevents audit gaps and resource waste.

Lesson 3 • Leadership Commitment and Governance

Details top management responsibilities under Clause 5, including policy ownership and role assignment. Strong leadership commitment is the primary predictor of ISMS success.

Lesson 1 • Information Asset Identification

Covers asset inventory methods, ownership assignment, and classification as prerequisites to risk assessment. Accurate asset data is the foundation of meaningful risk analysis.

Lesson 2 • Risk Treatment and Acceptance

Explains the four treatment options—modify, avoid, share, retain—and links treatment decisions to control selection. Learners produce a risk treatment plan with justified residual risk acceptance.

Lesson 3 • Risk Assessment Methodology

Teaches qualitative and quantitative risk assessment techniques, threat-vulnerability pairing, and likelihood-impact scoring. Learners apply a repeatable methodology to produce defensible risk ratings.

Lesson 4 • Ongoing Risk Monitoring and Review

Establishes processes for continuous risk monitoring, trigger-based reassessment, and risk register maintenance. Keeps the ISMS responsive to emerging threats and organisational changes.

Lesson 1 • People Controls

Examines controls governing the full employment lifecycle, from pre-hire screening to offboarding. Human-layer controls reduce insider threat and unintentional security failures.

Lesson 2 • Physical and Environmental Controls

Addresses secure areas, equipment protection, and environmental threat mitigation. Physical controls prevent unauthorised access and protect hardware assets.

Lesson 3 • Organisational Controls

Covers the 37 organisational controls addressing policies, roles, supplier relationships, and incident management. Learners map each control to risk scenarios and draft implementation notes.

Lesson 4 • Statement of Applicability Development

Guides learners through building a complete Statement of Applicability linking controls to risks and justifying inclusions and exclusions. The SoA is the central audit evidence document.

Lesson 1 • Communication Planning

Establishes what, when, and how to communicate security information internally and externally. Structured communication prevents misunderstanding and supports incident response.

Lesson 2 • Operational Planning and Control

Applies Clause 8 to plan, implement, and control security processes and manage outsourced functions. Operational control ensures risk treatment plans are executed as designed.

Lesson 3 • Documented Information Management

Covers creation, control, retention, and disposal of ISMS documents and records per Clause 7.5. Proper document control is essential for audit readiness and operational consistency.

Lesson 1 • ISMS Internal Audit Programme

Covers audit programme planning, auditor competence, audit criteria, and evidence collection techniques. Internal audits provide independent assurance before certification.

Lesson 2 • Nonconformity Identification and Reporting

Defines nonconformity types, grading severity, and documenting findings in audit reports. Clear nonconformity reporting drives targeted corrective action.

Lesson 3 • Management Review Process

Structures the management review meeting agenda, required inputs, and expected outputs per Clause 9.3. Management reviews translate audit data into strategic ISMS decisions.

Lesson 1 • Continual Improvement Planning

Establishes a structured improvement backlog, prioritisation criteria, and integration with ISMS planning cycles. Continual improvement is a certification requirement, not an optional activity.

Lesson 2 • Nonconformity and Corrective Action Workflow

Maps the end-to-end corrective action process from nonconformity detection to closure verification. A disciplined workflow prevents recurrence and demonstrates ISMS maturity.

Lesson 3 • Root Cause Analysis Techniques

Introduces 5-Whys, fishbone diagrams, and fault tree analysis applied to security incidents and audit findings. Selecting the right technique improves the quality of corrective actions.

Lesson 1 • Post-Certification ISMS Maintenance

Establishes routines for keeping the ISMS current as the organisation, technology, and threat landscape evolve. Maintenance activities protect the value of certification over time.

Lesson 2 • Surveillance and Recertification Cycles

Describes annual surveillance audit requirements and the three-year recertification cycle. Ongoing compliance prevents certificate suspension and maintains stakeholder confidence.

Lesson 3 • Certification Body Selection and Engagement

Covers accreditation criteria for certification bodies, pre-audit engagement, and contract considerations. Choosing an accredited body ensures certification is globally recognised.

Lesson 4 • Stage 2 On-Site Certification Audit

Prepares staff for interviews, evidence walkthroughs, and auditor interactions during Stage 2. Confident, consistent responses demonstrate ISMS operational effectiveness.