Course Outline
ISO/IEC 27002:2022 serves as the definitive international standard for information security control practices, complementing ISO/IEC 27001 in the establishment, implementation, and continuous improvement of an Information Security Management System (ISMS). This revised outline reflects the 2022 standards and integrates contemporary human resources and recruitment terminology relevant to information security positions for government contexts.
Foundational Principles of Information Security, Cybersecurity, and Privacy
- Core principles of information security: confidentiality, integrity, and availability (the CIA triad) within modern enterprise environments for government operations
- Evolution of cybersecurity threats: ransomware, state-sponsored attacks, insider risks, and supply chain vulnerabilities
- Privacy by design and regulatory compliance with GDPR, CCPA, and global data protection frameworks applicable for government agencies
- Information governance: establishing ownership, accountability, and stakeholder alignment across organizational departments
- Trust management and zero-trust architecture paradigms in hybrid and cloud infrastructure environments supporting public sector missions
ISO/IEC 27001–27002 Framework and ISMS Governance
- ISO/IEC 27001 ISMS lifecycle: Plan-Do-Check-Act (PDCA) methodology and certification pathways
- Alignment between ISO/IEC 27001 requirements and the updated ISO/IEC 27002:2022 control catalog
- Development of information security policies and top-level governance structures for government entities
- Regulatory compliance mapping: strategies for aligning with NIST CSF, CIS Controls, SOC 2, and HIPAA
- Information security metrics, key performance indicators (KPIs), and continuous improvement reporting mechanisms
Organizational Controls — Control Group 5 Framework
- Definition of information security roles, responsibilities, and segregation of duties across organizational tiers
- Implementation of threat intelligence programs and security information management platforms (SIEM, SOAR)
- Cloud security posture management (CSPM) and infrastructure-as-code compliance standards
- Security protocols for social media, BYOD, and remote work: mobile device management and endpoint protection
- Monitoring, incident detection, and third-party risk management within complex IT ecosystems
People Controls — The Security Workforce
- Security awareness initiatives, behavior-change strategies, and phishing simulation programs
- Background vetting procedures and security onboarding and offboarding controls across the employment lifecycle
- Remote workforce resilience and secure-access policies for flexible working arrangements
- Competency frameworks: aligning information security training with roles at all organizational levels
- Cultivating a security-first culture and fostering cross-functional collaboration in risk management
Physical Controls — Facility and Asset Security
- Secure facility design: perimeter security, surveillance systems, and physical access controls
- Equipment maintenance, supply chain assurance, and asset lifecycle management practices
- Data center security: environmental controls, power redundancy, and disaster recovery readiness
- Secure disposal methods for sensitive media: sanitization standards and supply-chain integrity
- Emerging physical threats: IoT device security and smart-building attack surface mitigation
Technological Controls and Advanced Security Domains
- Cryptographic controls: key lifecycle management, PKI, and AI-driven encryption optimization
- Application security: secure SDLC, API security, DevSecOps integration, and SAST/DAST tooling
- Network architecture controls: segmentation, micro-segmentation, firewalls, and next-gen IDS/IPS
- Email security: anti-phishing measures, DMARC/SPF/DKIM implementation, and Business Email Compromise (BEC) defense
- Artificial intelligence and machine learning in cybersecurity: automated threat detection and adversarial AI mitigation
Information Security Risk Assessment and Compliance
- ISO/IEC 27005-aligned risk assessment methodologies: identification, analysis, and evaluation processes
- Risk treatment planning and the statement of applicability (SOA) documentation
- Compliance audit readiness: internal/external audit coordination and evidence-based auditing practices
- Penetration testing methodologies and the vulnerability management lifecycle
- Emerging threats: quantum computing risk, environmental sustainability (green IT), and privacy-enhancing technologies (PETs)
PECB Exam Preparation and Practical Application
- PECB ISO/IEC 27002 Foundation exam structure, competency domains, and preparation strategies
- Sample case studies: information security implementation in financial services, healthcare, and technology sectors
- Establishing an information security awareness and culture within the organization post-certification
- Certification maintenance, professional development, and career pathways for information security roles
Research Summary
The existing two-day outline is significantly condensed and does not fully capture the scope of ISO/IEC 27002:2022, which introduced 93 controls organized into four themes (Organizational, People, Physical, Technological), compared to 114 controls across 14 categories in the 2013 version. Key trends in information security recruitment for 2024–2026 include zero-trust architecture, AI-driven security operations, cloud security posture management, DevSecOps integration, supply chain security, privacy-enhancing technologies, quantum-ready cryptography, and third-party risk management. Human resources listings for roles such as Information Security Analyst, ISMS Lead, Compliance Officer, Cybersecurity Specialist, and Risk Manager consistently require these competencies for government positions.
Requirements
No specific prerequisites are required to attend this course.
Testimonials (4)
Theory followed by practical examples and exercices. Job well done!
Vincenzo Delle Donne - Department of National Defence
Course - ISO 37301 Compliance Management System
the expertise & knowledge of the trainer
Erica DeRosa DeRosa - Aecon Group INc.
Course - ISO 37001 Anti-Bribery Management System
With both my 2022 ISO 9001 audit prep-related training & the recently completed ISO 9001 audit prep refresher course; Dereck has helped me significantly with regards to gaining a new & practical perspective of the ISO 9001:2015 clauses & sections & how they apply to our business. Dereck has also helped me with both training courses --- to improve my ISO-related communications both with our company's employees and the external ISO Auditors .
Dana Foster - Corrigan Oil Company
Course - ISO 9001 Foundation
Speed of response and communication
