Course Objective & Scope
An Information Security Management System (ISMS) only delivers real protection when its scope is realistic, risk assessments drive actual decisions and technical and organisational controls are embedded into daily operations. This course provides a practical walkthrough of ISO/IEC 27001:2022 clauses (4–10) and the 93 Annex A controls aligned with ISO/IEC 27002:2022.
Working through an enterprise case study, participants draft an ISMS scope statement, asset and risk register, risk treatment plan and Statement of Applicability (SoA), finishing with an internal audit readiness checklist.
Who Should Attend?
- Information security managers, ISMS coordinators and GRC specialists
- IT, systems, network and software leads responsible for technical security controls
- Specialists involved in internal ISO 27001 implementation, transition or internal audit programmes
- Prerequisite: basic familiarity with enterprise IT and information security processes
Key Takeaways
- Define ISMS context, scope and governance responsibilities in line with ISO/IEC 27001:2022
- Classify information assets and produce a structured risk assessment and risk treatment plan
- Map the 93 organisational, people, physical and technological Annex A controls to enterprise workflows
- Compile an audit-ready Statement of Applicability (SoA) with clear justifications and evidence
- Manage performance metrics, internal audits, nonconformities and corrective actions (CAPA)
Curriculum
ISO/IEC 27001:2022 Structure and ISMS Scoping
- Clauses 4–10, the PDCA cycle and key changes introduced in the 2022 revision
- Organisational context, interested parties and defining realistic ISMS scope boundaries
Information Security Risk Assessment and Treatment
- Selecting a risk methodology, asset/threat/vulnerability analysis and risk acceptance criteria
- Risk treatment options, residual risk sign-off and drafting the Risk Treatment Plan
Annex A Controls and Statement of Applicability (SoA)
- The 93 controls across 4 themes: Organisational, People, Physical and Technological
- New controls including threat intelligence, cloud security, DLP, secure coding and ICT readiness for business continuity
Documentation, Evidence Management and Operations
- Structuring mandatory documents and operational audit evidence (records)
- Change management, supplier security and information security incident management processes
Performance Evaluation, Internal Audit and Continual Improvement
- ISMS metrics, internal audit planning, writing audit findings and management review
- Major/minor nonconformity analysis, root-cause investigation and CAPA checklist
Other Courses in This Category
-
The Linux network stack, nftables/iptables, SSH and privilege hardening, SELinux/AppArmor, auditd and packet analysis for systems and security engineers securing production Linux servers.
- Live Course
- 5 modules
-
Static and dynamic malware analysis in isolated labs, PE/ELF inspection, behavioural monitoring, unpacking, code analysis with Ghidra and YARA rule authoring for security analysts.
- Live Course
- 5 modules
-
All 8 domains of the (ISC)² CISSP Common Body of Knowledge (CBK), risk and governance mindset, security architecture and scenario-based question analysis for experienced security professionals.
- Live Course
- 5 modules
-
The CIA triad, modern threat vectors, identity and access management, network security and baseline hardening practices for IT and software teams who need to identify and mitigate enterprise security risks.
- Live Course
- 5 modules
-
Identity, device posture, network micro-segmentation and continuous verification using NIST SP 800-207 and the CISA Zero Trust Maturity Model for infrastructure and security architects planning enterprise adoption.
- Live Course
- 5 modules
-
OWASP Top 10, threat modeling, secure coding, SAST/DAST/SCA integration and Secure SDLC controls for software and AppSec teams aiming to find and fix vulnerabilities before production.
- Live Course
- 5 modules
Get in touch
