Overview of information security principles and the ISO/IEC 27001 standard. Importance of ISMS in today’s threat landscape and key terminology. Understanding the updates in ISO 27001:2022 and how they affect implementations.

Determining scope and context of the ISMS (Clause 4). Securing management commitment and defining roles/responsibilities. ISMS policy development and establishing organizational security objectives.

Identifying assets, threats, and vulnerabilities. Performing risk assessment and impact analysis. Selecting risk treatment options and developing a Risk Treatment Plan. Producing the Statement of Applicability mapping chosen controls to risks.

Deploying controls and information security processes to mitigate risks. In-depth coverage of Annex A control categories – People, Organizational, Physical, Technological – with real examples (e.g. access control, incident management, business continuity, network security, supplier security, etc.). Includes new 2022 controls like Threat Intelligence, Cloud Security, Configuration Management, and more.

Ensuring support for the ISMS – securing resources, training and awareness programs, competent personnel, and communication plans. Operating the ISMS daily: change management, incident response, continuity planning, and managing outsourced functions.

Monitoring and measuring ISMS effectiveness. Internal audit methodology and practice – planning audits, conducting audits, and reporting findings. Management review process – evaluating ISMS performance with top management and obtaining continual support.

Corrective actions and continual improvement of the ISMS. Handling non-conformities and updating risk assessments. Preparation for third-party certification audits – audit stages, what auditors look for, and how to ensure your organization is ready. Tips for a successful certification audit and maintaining compliance post-certification.