ISO 27002 Foundation Training​ - United Kingdom

ISO 27002 Foundation Training​ Course Outline

Module 1: Introduction to ISO 27002

• Scope
• Terms and Definitions
• Abbreviated Terms

Module 2: Information Security

• What is Information Security?
• CIA
• Principles of Information Security
• Need for Information security
• Threats
• Active and Passive Attacks

Module 3: Cybersecurity

• What is Cybersecurity?
• Cybersecurity Domains
• Dangerous Cybersecurity Myths
• Common Cyber Threats
• Key Cybersecurity Technologies and Best Practices
• Zero Trust Security Strategy
• Difference Between Cybersecurity and Information Security 
• Roles and Responsibilities of Cybersecurity Professionals

Module 4: Information Security Management System (ISMS)

• Introduction to ISMS
• Need
• What Does an ISMS Do?
• Benefits

Module 5: Themes and Controls

• Control Type
• Information Security Properties
• Cybersecurity Concepts
• Operational Capabilities
• Security Domains
• Control Layout

Module 6: Organisational Controls

• Policies for Information Security
• Information Security Roles and Responsibilities
• Segregation of Duties
• Management Responsibilities
• Contact with
  • Authorities
  • Special Interest Groups
• Threat Intelligence
• Information Security in Project Management
• Inventory of Information and Other Associated Assets
• Acceptable Use of Information and Other Associated Assets
• Return of Assets
• Classification of Information
• Labelling of Information
• Information Transfer
• Access Control
• Identity Management
• Authentication Information
• Access Rights
• Information Security in Supplier Relationships
• Addressing Information Security within Supplier Agreements
• Managing Information Security in the ICT Supply Chain
• Monitoring, Review, and Change Management of Supplier Services
• Information Security for Use of Cloud Services
• Information Security Incident Management Planning and Preparation
• Assessment and Decision on Information Security Events
• Response to Information Security Incidents
• Learning from Information Security Incidents
• Collection of Evidence
• Information Security During Disruption
• ICT Readiness for Business Continuity
• Legal, Statutory, Regulatory, and Contractual Requirements
• Intellectual Property Rights
• Protection of Records
• Privacy and Protection of PII
• Independent Review of Information Security
• Compliance with Policies, Rules, and Standards for Information Security
• Documented Operating Procedures

Module 7: People Controls

• Screening
• Terms and Conditions of Employment
• Information Security Awareness, Education, and Training
• Disciplinary Process
• Responsibilities After Termination or Change of Employment
• Confidentiality or Non-Disclosure Agreements
• Remote Working
• Information Security Event Reporting

Module 8: Physical Controls

• Physical Security Perimeters
• Physical Entry
• Securing Offices, Rooms, and Facilities
• Physical Security Monitoring
• Protecting Against Physical and Environmental Threats
• Working in Secure Areas
• Clear Desk and Clear Screen
• Equipment Siting and Protection
• Security of Assets Off-Premises
• Storage Media
• Supporting Utilities
• Cabling Security
• Equipment Maintenance
• Secure Disposal or Re-use of Equipment

Module 9: Technological Controls

• User Endpoint Devices
• Privileged Access Rights
• Information Access Restriction
• Access to Source Code
• Secure Authentication
• Capacity Management
• Protection Against Malware
• Management of Technical Vulnerabilities
• Configuration Management
• Information Deletion
• Data
  • Masking
  • Leakage Prevention
• Information Backup
• Redundancy of Information Processing Facilities
• Logging
• Monitoring Activities
• Clock Synchronisation
• Use of Privileged Utility Programs
• Installation of Software on Operational Systems
• Networks Security
• Security of Network Services
• Segregation of Networks
• Web Filtering
• Use of Cryptography
• Secure Development Life Cycle
• Application Security Requirements
• Secure System Architecture and Engineering Principles
• Secure Coding
• Security Testing in Development and Acceptance
• Outsourced Development
• Separation of Development, Test, and Production Environments
• Change Management
• Test Information
• Protection of Information Systems During Audit Testing