Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 14 hours
Course Outline
1. Introduction to ISO/IEC 27001:2023
- General overview of the ISO/IEC 27001 Information Security Management System (ISMS)
- Purpose and operational benefits of establishing an ISMS
- Role of ISO 27001 in the governance of cybersecurity for government
- Structure of the ISO 27000 family of standards
- Key concepts:
- Information security
- Risk management
- Security controls
- Continuous improvement
- Overview of the ISO 27001 certification process
2. Changes in ISO/IEC 27001:2023 Edition
2.1 What Has Changed?
- Summary of updates in the ISO 27001:2022/2023 edition
- Rationale for the revision of the standard
- Alignment with contemporary cybersecurity practices
- Impact on existing organizations maintaining certification
2.2 Scope of Changes
- Modifications to terminology and organizational structure
- Updates to requirements within ISO 27001 clauses
- Impact on ISMS documentation frameworks
- Requirements for transitioning from previous editions
- Timeline and migration considerations
2.3 Updated Annex A Security Controls
- Overview of the new Annex A structure
- Transition from 14 control domains to 4 themes:
- Organizational controls
- People controls
- Physical controls
- Technological controls
- Introduction of new and updated security controls
- Modifications to control attributes
- Determination of control applicability
3. Understanding Information Security and Risk Management
3.1 Defining Security in Modern Organizations
- Core principles of information security:
- Confidentiality
- Integrity
- Availability
- Business impact of security incidents
- Security challenges in contemporary operational environments
- Balancing security, usability, and business requirements for government
3.2 Risk Management Approach
- Identification of information security risks
- Risk assessment methodologies
- Risk treatment options
- Development of risk treatment plans
- Selection of appropriate security controls
- Statement of Applicability (SoA)
4. Implementing ISO 27001:2023 Changes
4.1 Preparing for Transition
- Assessment of current ISMS maturity
- Conducting a gap analysis
- Identification of necessary updates
- Revision of policies and procedures
- Review of existing security controls
4.2 Implementing Updated Controls
- Mapping existing controls to the new Annex A structure
- Evaluation of control effectiveness
- Integration of new security requirements
- Management of organizational changes
4.3 Practical Implementation Case Study
- Review of an example organization
- Identification of security gaps
- Selection of appropriate controls
- Development of improvement recommendations
- Creation of an implementation roadmap
5. Auditing According to ISO 27001:2023
5.1 Fundamentals of ISMS Auditing
- Purpose and principles of auditing
- Distinction between internal and certification audits
- Responsibilities of auditors
- Audit criteria and scope
- Evidence-based auditing approach
5.2 Planning an ISO 27001 Audit
- Creation of an audit program
- Preparation of audit checklists
- Definition of audit objectives
- Identification of relevant processes and controls
- Selection of audit methods
5.3 Conducting the Audit
- Opening meetings
- Interview techniques
- Review of documentation
- Collection of objective evidence
- Testing of control effectiveness
- Recording of audit findings
6. Audit Findings and Reporting
6.1 Managing Audit Results
- Identification of nonconformities
- Classification of findings:
- Major nonconformities
- Minor nonconformities
- Observations
- Opportunities for improvement
- Root cause analysis
- Corrective actions
6.2 Audit Reporting
- Preparation of effective audit reports
- Communication of findings to management
- Prioritization of improvement actions
- Follow-up activities
7. Good Practices for ISO 27001 Implementation and Auditing
- Common challenges during implementation
- Avoidance of common audit errors
- Cultivation of an effective security culture
- Maintenance of ISMS effectiveness
- Practices for continuous improvement
- Integration of ISO 27001 with other standards:
- ISO 9001
- ISO 22301
- ISO 27701
8. Practical Workshop and Case Study
- Review of an example ISMS environment
- Performance of a gap assessment
- Identification of applicable controls
- Preparation of audit questions
- Evaluation of evidence
- Creation of audit findings
- Presentation of recommendations
9. Discussion and Summary
- Review of ISO 27001:2023 changes
- Key considerations for auditors
- Lessons learned from case studies
- Best practices for successful implementation
- Questions and answers
- Additional resources and next steps
Requirements
Audience
- Internal and lead auditors
- Individuals interested in the subject matter
Testimonials (1)
Speed of response and communication
