Information Security Governance & ISO 27001 Awareness
Overview
An information security management system gives organisations a structured way to protect information. This course explains information security governance and the ISO 27001 standard, covering scope, risk assessment, controls, documentation, internal audit and certification readiness.
Who should attend
Information security and IT staff, risk and compliance officers, quality managers, and internal auditors.
Training methodology
Interactive presentations, practical exercises, case studies, group discussions, role-plays where relevant, and a personal action plan that participants apply in their own work.
Objectives
By the end of this course, participants will be able to:
- Explain information security governance principles
- Understand the requirements of ISO 27001
- Conduct an information security risk assessment
- Select and document controls
- Prepare for internal audit and certification
Course outline
Day 1Information Security Governance
- Confidentiality, integrity, availability
- Governance roles
- Security policies
- Standards landscape
- Discussion
Day 2ISO 27001 Requirements
- Structure of the standard
- Context and scope
- Leadership and planning
- Support and operation
- Requirements review
Day 3Risk Assessment
- Asset inventory
- Threats and vulnerabilities
- Risk evaluation
- Risk treatment plan
- Workshop
Day 4Controls and Documentation
- Annex A controls overview
- Statement of applicability
- Policies and procedures
- Records and evidence
- Exercise
Day 5Audit and Certification
- Internal audit
- Management review
- Continual improvement
- Certification process
- Action plan
