ISO/IEC 27001 (ISO 27001) is an international standard for Information Security management. It provides a model to establish, implement, maintain and continually improve a risk-managed Information Security Management System (ISMS).
The standard forms the basis for effective management of sensitive, confidential information and for the application of information security controls.
An organization that conforms to the ISO/IEC 27001 standard possesses clear, objective proof of its commitment to continued improvement of control over its sensitive and confidential information.
ISO/IEC 27001 therefore provides reassurance to sponsors, shareholders and customers that the organization has expert control over its risk management and data security.
Due to the diversity of different organizations’ information assets – the ISO/IEC 27001 standard is adaptable according to an organization’s requirements.
The design and implementation of the ISMS is tailored to the organization’s objectives, information assets, operational processes, governing legal requirements and regulatory security requirements.
ISO/IEC 27001 Foundation
Gain foundation level knowledge of how the standard operates in a typical organization.
This certification is aimed at those who are:
- Supporting the implementation, operation or maintenance of an ISMS within an organization.
- Required to audit an ISMS and to have a basic understanding of the standard.
- Working within an organization with an ISMS, whether the organization is already certified or is considering certification to ISO/IEC 27001.
- Preparing for the ISO/IEC 27001 Practitioner - Information Security Officer qualification.
- The scope and purpose of ISO/IEC 27001 and how it can be used.
- The key terms and definitions used in the ISO/IEC 27000 series.
- The fundamental requirements for an ISMS in ISO/IEC 27001 and the need for continual improvement.
- The processes, their objectives and high level requirements.
- Applicability and scope definition requirements.
- Use of controls to mitigate IS risks.
- The purpose of internal audits and external certification audits, their operation and the associated terminology.
- The relationship with best practices and with other related International Standards: ISO 9001 and ISO/IEC 20000.
- Multiple choice format
- 50 questions per paper
- 25 marks or more required to pass (out of 50 available) – 50%
- 40 minute duration
- Closed book
ISO/IEC 27001 Practitioner - Information Security Officer
Learn to apply the standard to enable the management of information security.
- APMG ISO/IEC 27001 Foundation certificate.
- TÜV SÜD ISO27001 Foundation certificate.
- ICO-CERT ISMS 27001 Foundation certificate.
This qualification is aimed at those who are:
- Internal managers and personnel working to implement, maintain and operate an ISMS within an organization.
- External consultants supporting an organization’s implementation, maintenance and operation of an ISMS.
- Internal auditors who are required to have an applied knowledge of the standard.
- Applying the principles of ISMS policy and its information security scope, objectives, and processes within an organizational context.
- Applying the principles of risk management including risk identification, analysis and evaluation and propose appropriate treatments and controls to reduce information security risk, support business objectives and improve information security.
- How to analyze and evaluate deployed risk treatments and controls to assess their effectiveness and opportunities for continual improvement.
- How to analyze and evaluate the effectiveness of the ISMS through the use of internal audit and management review to continually improve the suitability, adequacy and effectiveness of the ISMS.
- How to create, apply and evaluate the suitability, adequacy and effectiveness of documented information and records required by ISO/IEC 27001.
- How to identify and apply appropriate corrective actions to maintain ISMS conformity with ISO/IEC 27001.
- Objective Testing
- 4 questions per paper with 20 marks available per question
- 40 marks or more required to pass (out of 80 available) – 50%
- 2 ½ hour duration
- Open book
ISO/IEC 27001 Auditor
Certify your expertise in performing audits against the ISO 27001 standard.
- Third-party auditors working for Certification Bodies, responsible for conducting audits which certify organizations against ISO 27001 and ISO 19011.
- Internal auditors seeking to understand the specific requirements of auditing Information Security Management Systems needed to confirm that an organization conforms to the ISO 27001 or ISO 19011 standard.
- How to audit organizations to identify conformity with ISO 27001.
- How to evaluate the principles of risk management - including risk identification, analysis and evaluation.
- How to propose appropriate treatments and controls to reduce information security risk, support business objectives and improve information security.
- Leading organizations through an audit program.
- Directing audit teams.
- Evaluating the effectiveness of applied corrective actions to maintain ISMS conformity with ISO 27001.
- 40 questions
- Multiple choice format
- 120 minute duration
- 20 marks or more required to pass (out of 40 available) - 50%
- Open book: ISO/IEC 27001:2013, ISO/IEC 27002:2013, ISO 19011:2018, APMG ISO/IEC 27001 Suppmenentary Paper
