ISO 27001: Information Security Management Systems Course

Lesson 1 • The Business Case for Security

Connects security investment to financial, reputational, and operational outcomes. Equips learners to justify ISMS adoption to executive stakeholders.

Lesson 2 • Overview of Security Standards Landscape

Maps the ecosystem of international security standards and frameworks, positioning ISO 27001 within it. Helps learners choose complementary frameworks appropriately.

Lesson 3 • Core Information Security Concepts

Defines confidentiality, integrity, and availability as the CIA triad and explains how each property protects organisational assets. Anchors all subsequent ISMS design decisions.

Lesson 1 • Compulsory Documentation Requirements

Identifies every document and record explicitly required by the standard. Learners can build a compliant documentation framework from the outset.

Lesson 2 • Understanding Annex A Controls

Surveys all control domains in Annex A and explains their purpose and applicability. Provides the foundation for building a Statement of Applicability.

Lesson 3 • High-Level Structure and Clauses

Explains the Harmonised Structure (Annex SL) shared across ISO management system standards and walks through clauses 4–10. Enables learners to read and interpret the standard accurately.

Lesson 4 • Scoping the ISMS

Covers how to define and document the ISMS scope in alignment with clause 4.3. A well-defined scope prevents audit findings and controls implementation effort.

Lesson 1 • Top Management Roles and Responsibilities

Defines what clause 5.1 requires from senior leadership and how to secure genuine commitment. Leadership engagement is the single strongest predictor of ISMS success.

Lesson 2 • Identifying Interested Parties

Maps stakeholders and their security-relevant needs and expectations per clause 4.2. Ensures the ISMS addresses obligations to customers, regulators, and partners.

Lesson 3 • Analysing Organisational Context

Uses structured tools to identify internal and external issues relevant to the ISMS as required by clause 4.1. Grounds the ISMS in real organisational realities.

Lesson 1 • Risk Management Fundamentals

Establishes risk terminology, concepts, and the ISO 27005 risk management process as the basis for clause 6.1 compliance. Ensures consistent language across the ISMS team.

Lesson 2 • Risk Treatment Options and Planning

Applies the four treatment options—modify, avoid, share, retain—and maps selected controls to Annex A. Produces a risk treatment plan ready for management approval.

Lesson 3 • Statement of Applicability

Constructs the Statement of Applicability (SoA) linking each Annex A control to risk treatment decisions. The SoA is a key audit artefact and must be accurate and current.

Lesson 4 • Conducting the Risk Assessment

Walks through identifying, analysing, and evaluating risks against defined criteria. Produces the risk register that drives all subsequent treatment decisions.

Lesson 1 • Implementing Security Controls

Converts risk treatment decisions into deployed technical, organisational, and physical controls. Covers prioritisation, ownership assignment, and implementation tracking.

Lesson 2 • Asset Management in Practice

Implements asset inventory, classification, and handling procedures aligned to Annex A controls. Accurate asset management is prerequisite to effective risk treatment.

Lesson 3 • Supplier and Third-Party Security

Establishes security requirements for suppliers and manages third-party risk per Annex A controls. Supply chain weaknesses are a leading source of security incidents.

Lesson 4 • Security Policies and Procedures

Develops the policy and procedure library required to operationalise Annex A controls. Well-written procedures reduce human error and support consistent audit evidence.

Lesson 1 • Phishing Simulation and Testing

Plans and executes phishing simulations as a measurable awareness control. Simulation data drives targeted remediation and demonstrates programme effectiveness.

Lesson 2 • Building an Awareness Programme

Designs a structured awareness programme meeting clause 7.2 and 7.3 competence and awareness requirements. Covers audience segmentation, content design, and delivery channels.

Lesson 3 • Human Risk in Information Security

Quantifies the human element as a primary attack vector through social engineering, insider threat, and error. Motivates investment in awareness as a control category.

Lesson 1 • Management Review Process

Structures the clause 9.3 management review to produce actionable decisions on ISMS resources and improvements. Connects audit findings to strategic security decisions.

Lesson 2 • Monitoring and Measurement

Defines ISMS performance indicators and establishes a measurement programme per clause 9.1. Effective measurement provides objective evidence of control effectiveness.

Lesson 3 • Conducting Internal Audits

Applies audit techniques—interviews, observation, document review—to gather objective evidence. Covers opening meetings, fieldwork, and closing meetings.

Lesson 4 • Nonconformity and Corrective Action

Manages nonconformities through root cause analysis and corrective action per clause 10.1. Systematic correction prevents recurrence and strengthens the ISMS over time.

Lesson 1 • Selecting a Certification Body

Evaluates accreditation, scope, and commercial factors when choosing a certification body. The right choice ensures audit credibility and a productive long-term relationship.

Lesson 2 • Surveillance and Recertification Audits

Maintains certification through annual surveillance audits and triennial recertification cycles. Ongoing readiness prevents certificate suspension or withdrawal.

Lesson 3 • Stage 2 On-Site Certification Audit

Manages the Stage 2 audit process, including opening meetings, evidence presentation, and closing meetings. Confident audit management reduces nonconformity risk.

Lesson 4 • Stage 1 Documentation Review

Prepares all compulsory documentation for the Stage 1 audit and addresses common documentation gaps. A clean Stage 1 prevents costly delays before the Stage 2 on-site audit.