ECERTP USA
ISO 27001: 2022 Information Security Management Systems (ISMS) Foundation
Training Summary
ISO/IEC 27001:2022 is an internationally recognized standard for establishing, implementing, maintaining & continually improving an Information Security Management System (ISMS) It provides a systematic approach to managing sensitive information, ensuring its confidentiality, integrity & availability through risk management & mitigation strategies.
The Introduction to ISO 27001:2022 Standard training program helps learners to understand:
- Information Security
- Structure of the ISO 27001 2022 standard
- Structure of the ISO 27002 2022 guideline
- The clauses 1 up to clauses 10
- Annex A reference control objectives
- Roles & responsibilities for information security
- Mappings of ISO 27001 standard with SOC 2 Type II, EU GDPR; NIST CSF v 2.0
The 2022 update introduces a modernized Annex A with 93 controls, grouped into four themes: Organizational, People, Physical & Technological.
- These changes align the standard with emerging threats, technologies, ensuring its relevance in addressing current cybersecurity challenges.
- ISO 27001 is certifiable, enabling organizations to demonstrate their commitment to robust information security practices to stakeholders, clients & regulators.
- ISO/IEC 27002:2022 complements ISO 27001 by offering detailed implementation guidance for the 93 controls listed in Annex A of ISO 27001:2022.
- It is not a certifiable standard but serves as a best-practice guide for organizations looking to enhance their information security posture.
- The 2022 update introduces a simplified structure, categorizing controls into the same four themes as ISO 27001, with new & updated controls addressing areas like cloud security, threat intelligence & data
masking. - This standard is particularly valuable for organizations implementing an ISMS, as it provides practical insights & examples to tailor controls to their specific operational needs.
- Together, ISO 27001 & ISO 27002 form a comprehensive framework for managing & securing information assets.
Training Syllabus
PART 1 – Introduction to ISO 27001 2022 Standard
- What is Information Security?
- What is the need for Information Security?
- Key reasons why Information Security is important
- What is ISO 27001:2022 Standard?
- What is the ISO/IEC 27001 Rule?
- What is ISO/IEC 27001 Principles?
- What is the key concept of ISO/IEC 27001?
- What is a Management System?
- What is an Information Security Management System?
- Defining Confidentiality, Integrity & Availability (The C-I-A triad)
PART 2 – Structure of the ISO 27001:2022 Standard
- The 10 Clauses (Clause 1 up to Clause 10)
- Annex A: Reference Control Objectives & Controls
- Attributes for Controls
- Risk-based approach
- Enhanced Alignment with Other ISO Standards
- Reasons organizations upgrade to ISO 27001:2022 Standard?
PART 3 – ISO 27001:2022 Standard Clause 1 up to Clause 10
- Clause 1 – Scope
- Clause 2 – Normative References
- Clause 3 – Terms & Definitions
- Clause 4 – Context of the Organization
- Clause 5 – Leadership
- Clause 6 – Planning
- Clause 7 – Support
- Clause 8 – Operation
- Clause 9 – Performance Evaluation
- Clause 10 – Improvement
- Clause Summary
PART 4 – Annex A: Reference Control Objectives & Controls
- Introduction to Annex A
- Themes & Attributes
- Cybersecurity Concepts
- Organizational Controls
- People Controls
- Physical Controls
- Technological Controls
- Summary of Annex A Reference Control Objectives & Controls
PART 5 – Roles & Responsibilities
- Required Roles
- Top Management
- Information Security Manager/Officer
- ISMS Implementation Team
- Risk Owners
- Asset Owners
- Process Owners
- IT Team/Technical Staff
- Compliance / Audit Team
- Human Resources (HR)
- Legal & Compliance Team
- External Consultants
- Employees / End Users
- Key to Success
PART 6 – Mapping ISO 27001 2022 ISMS Standard
- Mapping ISO 27001 2022 & SOC 2 TYPE II
- ISO 27001 2022 & EU GDPR
- ISO 27001 2022 & NIST CSF v 2.0 Framework
