• What is ISO?
• The ISO/IEC 27000 family of standards
• Advantages of ISO/IEC 27001

• Definition of a management system
• Management system standards
• Integrated management systems
• Definition of an ISMS
• Process approach
• Overview — Clauses 4 to 10
• Overview — Annex A

• Information and asset
• Information security
• Availability, confidentiality, and integrity
• Vulnerability, threat, and impact
• Information security risk
• Classification of security controls

• Define the approach to the ISMS implementation
• Proposed implementation approaches
• Application of the proposed implementation approaches
• Choose a methodological framework to manage the implementation of an ISMS
• Approach and methodology
• Alignment with best practices

• Mission, objectives, values, and strategies of the organization
• ISMS objectives
• Preliminary scope definition
• Internal and external environment
• Key processes and activities
• Interested parties
• Business requirements

• Boundary of the ISMS
• Organizational boundaries
• Information security boundaries
• Physical boundaries
• ISMS scope statement

• Business case
• Resource requirements
• ISMS project plan
• ISMS project team
• Management approval

• Organizational structure
• Information security coordinator
• Roles and responsibilities of interested parties
• Roles and responsibilities of key committees

• Determine the current state
• Conduct the gap analysis
• Establish maturity targets
• Publish a gap analysis report

• Types of policies
• Policy models
• Information security policy
• Specific security policies
• Management policy approval
• Publication and dissemination
• Training and awareness sessions
• Control, evaluation, and review

• ISO/IEC 27005
• Risk assessment approach
• Risk assessment methodology
• Risk identification
• Risk estimation
• Risk evaluation
• Risk treatment
• Residual risk

• Drafting the Statement of Applicability
• Management approval
• Review and selection of the applicable information security controls
• Justification of selected controls
• Justification of excluded controls

• Value and types of documented information
• Master list of documented information
• Creation of templates
• Documented information management process
• Implementation of a documented information management system
• Management of records

• Organization’s security architecture
• Preparation for the implementation of controls
• Design and description of controls

• Implementation of security processes and controls
• Introduction of Annex A controls

• Big data
• The three V’s of big data
• Artificial intelligence
• Machine learning
• Cloud computing
• Outsourced operations
• The impact of new technologies in information security

• Principles of an efficient communication strategy
• Information security communication process
• Establishing communication objectives
• Identifying interested parties
• Planning communication activities
• Performing a communication activity
• Evaluating communication

• Competence and people development
• Difference between training, awareness, and communication
• Determine competence needs
• Plan the competence development activities
• Define the competence development program type and structure
• Training and awareness programs
• Provide the trainings
• Evaluate the outcome of trainings

• Change management planning
• Management of operations
• Resource management
• ISO/IEC 27035-1 and ISO/IEC 27035-2
• ISO/IEC 27032
• Information security incident management policy
• Process and procedure for incident management
• Incident response team
• Incident management security controls
• Forensics process
• Records of information security incidents
• Measure and review of the incident management process

• Determine measurement objectives
• Define what needs to be monitored and measured
• Establish ISMS performance indicators
• Report the results

• What is an audit?
• Types of audits
• Create an internal audit program
• Designate a responsible person
• Establish independence, objectivity, and impartiality
• Plan audit activities
• Perform audit activities
• Follow up on nonconformities

• Preparing a management review
• Conducting a management review
• Management review outputs
• Management review follow-up activities

• Root-cause analysis process
• Root-cause analysis tools
• Corrective action procedure
• Preventive action procedure

• Continual monitoring process
• Maintenance and improvement of the ISMS
• Continual update of the documented information
• Documentation of the improvements

• Selecting the certification body
• Preparing for the certification audit
• Stage 1 audit
• Stage 2 audit
• Follow-up audit
• Certification decision

• PECB certification scheme
• PECB certification process
• Other PECB services
• Other PECB training courses and certifications

A: The ISO 27001 (ISMS) Lead Implementer training aims to provide participants with the knowledge and skills necessary to lead and implement an ISMS based on the ISO 27001 standard. It equips them with the expertise to establish effective information security controls and practices within their organizations.

A: There are no formal prerequisites for the ISO 27001 (ISMS) Lead Implementer training. However, a basic understanding of information security concepts and familiarity with ISO standards is beneficial. Prior experience in information security management or related roles will also be advantageous.

A: The ISO 27001 (ISMS) Lead Implementer training is suitable for professionals involved in information security management, risk management, compliance, and IT governance. It is ideal for individuals responsible for implementing and managing an ISMS within their organizations, such as Information Security Managers, IT Managers, Compliance Officers, and Consultants.

A: The training covers a range of topics, including the principles and concepts of information security management, ISO 27001 requirements, risk assessment and management, controls selection and implementation, documentation development, performance evaluation, and continual improvement of the ISMS.

A: Yes, participants will receive comprehensive course materials, which may include slides, handouts, and reference materials. These resources will support learning during and after the training, serving as valuable references for implementing ISO 27001.

A: This training can be customized to address specific organizational needs. We can discuss customization options based on your requirements.