ISO 27001 Course

Lesson 1 • Overview of the ISO 27001 Standard

Introduces the structure, purpose, and history of ISO 27001. Positions the standard within the broader ISO/IEC 27000 family.

Lesson 2 • Business Case for ISO 27001 Certification

Examines organisational drivers for adopting ISO 27001. Connects certification benefits to risk reduction and stakeholder trust.

Lesson 3 • Roles and Responsibilities in an ISMS

Defines key roles required to operate an Information Security Management System. Clarifies accountability structures needed throughout implementation.

Lesson 1 • Leadership and Commitment Requirements

Addresses Clause 5 obligations for top management engagement. Demonstrates how leadership commitment directly enables ISMS effectiveness.

Lesson 2 • The Plan-Do-Check-Act Cycle

Explains the PDCA model as the operational engine of an ISMS. Demonstrates how each phase drives continuous improvement.

Lesson 3 • Defining Organisational Context

Covers Clause 4 requirements for understanding internal and external issues. Establishes context as the foundation for scope and risk decisions.

Lesson 4 • Determining the ISMS Scope

Guides students through scoping decisions that define ISMS boundaries. Correct scoping prevents gaps and over-engineering in implementation.

Lesson 1 • Establishing the Risk Assessment Process

Covers criteria, methodology selection, and process documentation for risk assessment. A consistent methodology is required for repeatable, auditable results.

Lesson 2 • Risk Management Fundamentals

Establishes risk terminology and frameworks aligned with ISO 31000. Provides the conceptual grounding needed before applying ISO 27001 risk processes.

Lesson 3 • Statement of Applicability

Explains the purpose, structure, and mandatory content of the Statement of Applicability. Connects control selection justifications to risk treatment decisions.

Lesson 4 • Identifying and Analysing Risks

Guides students through systematic risk identification and likelihood-impact analysis. Produces a prioritised risk register as a core ISMS artefact.

Lesson 1 • Incident Management and Business Continuity Controls

Examines controls for detecting, responding to, and recovering from security events. Connects incident management to business continuity planning requirements.

Lesson 2 • Organisational and People Controls

Examines controls governing policies, roles, human resources, and supplier relationships. These controls form the governance layer of the ISMS.

Lesson 3 • Technological Controls: Access and Cryptography

Addresses access management, authentication, and cryptographic controls. These controls directly mitigate unauthorised access and data exposure risks.

Lesson 4 • Technological Controls: Operations and Networks

Covers operational security, network controls, and vulnerability management. Operational controls maintain day-to-day security posture across systems.

Lesson 1 • Security Awareness and Training Programmes

Covers designing and delivering security awareness programmes required by Clause 7. Awareness reduces human-factor risks identified in the risk assessment.

Lesson 2 • Implementation Planning and Roadmap

Covers project planning, resource allocation, and milestone setting for ISMS implementation. A structured roadmap prevents scope creep and missed deadlines.

Lesson 3 • Developing Security Policies and Procedures

Guides creation of the policy hierarchy from top-level policy to operational procedures. Policies must align with organisational context and risk treatment decisions.

Lesson 4 • Implementing Technical and Physical Controls

Addresses the practical deployment of selected Annex A controls. Connects control implementation to documented risk treatment decisions.

Lesson 1 • Monitoring and Measurement Processes

Establishes continuous monitoring processes for controls and risk posture. Ongoing monitoring detects control failures before they become incidents.

Lesson 2 • Internal Audit Planning and Execution

Guides students through planning, conducting, and documenting internal ISMS audits. Internal audits provide evidence of conformance required for certification.

Lesson 3 • Defining Security Metrics and KPIs

Covers selection and design of meaningful information security metrics. Metrics must demonstrate ISMS effectiveness and support management decisions.

Lesson 1 • Identifying and Classifying Nonconformities

Defines nonconformity types and sources within an ISMS context. Accurate classification determines the appropriate corrective action response.

Lesson 2 • Root Cause Analysis Techniques

Introduces structured root cause analysis methods applicable to security nonconformities. Identifying true root causes prevents recurrence of the same failures.

Lesson 3 • Driving Continual Improvement

Explores proactive improvement opportunities beyond reactive nonconformity management. Continual improvement sustains certification and adapts the ISMS to evolving threats.

Lesson 1 • Stage 1 Documentation Review

Explains the purpose and process of the Stage 1 readiness review. Stage 1 findings must be resolved before proceeding to the on-site Stage 2 audit.

Lesson 2 • Stage 2 On-Site Certification Audit

Prepares students for the full conformity assessment conducted on-site. Demonstrates how auditors sample evidence and evaluate ISMS effectiveness.

Lesson 3 • Selecting a Certification Body

Covers criteria for choosing an accredited certification body and managing the engagement. The right certification body ensures audit credibility and process efficiency.

Lesson 4 • Post-Certification ISMS Maturity Growth

Guides organisations from basic certification compliance toward ISMS maturity. Maturity growth maximises the long-term security and business value of the ISMS.