ISO 27002 Internal Auditor Training - United Kingdom

ISO 27002 Internal Auditor Training Course Outline

Module 1: Introduction to ISO 27002 

• Scope 
• Terms and Definitions 
• Abbreviated Terms 

Module 2: Information Security 

• What is Information Security? 
• CIA 
• Principles of Information Security 
• Need for Information security 
• Threats 
• Active and Passive Attacks 

Module 3: Cybersecurity 

• What is Cybersecurity? 
• Cybersecurity Domains 
• Dangerous Cybersecurity Myths 
• Common Cyber Threats 
• Key Cybersecurity Technologies and Best Practices 
• Zero Trust Security Strategy 
• Difference Between Cybersecurity and Information Security   
• Roles and Responsibilities of Cybersecurity Professionals 

Module 4: Information Security Management System (ISMS) 

• Introduction to ISMS 
• Need 
• What Does an ISMS Do? 
• Benefits 

Module 5: Themes and Controls 

• Control Type 
• Information Security Properties 
• Cybersecurity Concepts 
• Operational Capabilities 
• Security Domains 
• Control Layout 

Module 6: Organisational Controls 

• Policies for Information Security 
• Information Security Roles and Responsibilities 
• Segregation of Duties 
• Management Responsibilities  
• Contact with  
  • Authorities 
  • Special Interest Groups 
• Threat Intelligence 
• Information Security in Project Management 
• Inventory of Information and Other Associated Assets 
• Acceptable Use of Information and Other Associated Assets 
• Return of Assets 
• Classification of Information 
• Labelling of Information  
• Information Transfer  
• Access Control 
• Identity Management 
• Authentication Information 
• Access Rights 
• Information Security in Supplier Relationships  
• Addressing Information Security within Supplier Agreements  
• Managing Information Security in the ICT Supply Chain 
• Monitoring, Review, and Change Management of Supplier Services 
• Information Security for Use of Cloud Services 
• Information Security Incident Management Planning and Preparation 
• Assessment and Decision on Information Security Events 
• Response to Information Security Incidents 
• Learning from Information Security Incidents 
• Collection of Evidence 
• Information Security During Disruption 
• ICT Readiness for Business Continuity  
• Legal, Statutory, Regulatory, and Contractual Requirements 
• Intellectual Property Rights 
• Protection of Records 
• Privacy and Protection of PII 
• Independent Review of Information Security 
• Compliance with Policies, Rules, and Standards for Information Security 
• Documented Operating Procedures 

Module 7: People Controls 

• Screening 
• Terms and Conditions of Employment. 
• Information Security Awareness, Education, and Training 
• Disciplinary Process 
• Responsibilities After Termination or Change of Employment 
• Confidentiality or Non-Disclosure Agreements 
• Remote Working 
• Information Security Event Reporting 

Module 8: Physical Controls 

• Physical Security Perimeters 
• Physical Entry 
• Securing Offices, Rooms, and Facilities  
• Physical Security Monitoring 
• Protecting Against Physical and Environmental Threats  
• Working in Secure Areas  
• Clear Desk and Clear Screen 
• Equipment Siting and Protection  
• Security of Assets Off-Premises 
• Storage Media 
• Supporting Utilities 
• Cabling Security 
• Equipment Maintenance 
• Secure Disposal or Re-use of Equipment 

Module 9: Technological Controls  

• User Endpoint Devices  
• Privileged Access Rights 
• Information Access Restriction 
• Access to Source Code 
• Secure Authentication 
• Capacity Management 
• Protection Against Malware 
• Management of Technical Vulnerabilities 
• Configuration Management 
• Information Deletion 
• Data  
  • Masking  
  • Leakage Prevention 
• Information Backup 
• Redundancy of Information Processing Facilities 
• Logging 
• Monitoring Activities 
• Clock Synchronisation 
• Use of Privileged Utility Programmes 
• Installation of Software on Operational Systems 
• Networks Security 
• Security of Network Services 
• Segregation of Networks 
• Web Filtering 
• Use of Cryptography  
• Secure Development Life Cycle 
• Application Security Requirements 
• Secure System Architecture and Engineering Principles 
• Secure Coding 
• Security Testing in Development and Acceptance 
• Outsourced Development 
• Separation of Development, Test, and Production Environments 
• Change Management 
• Test Information 
• Protection of Information Systems During Audit Testing 

Module 10: Audit Plan and Process 

• Audit Plan 
• Preparing for an Audit 
• Audit Process 

Module 11: Internal Auditor 

• Understanding an Internal Auditor (IA) 
• Internal Auditing Process 
• Requirements for Internal Auditors 
• Internal Auditor Vs External Auditor 
• Benefits of an Internal Auditor (IA) 

Module 12: ISMS Audit 

• Introduction 
• Principles 
• Audit Management 
• Auditing Process 
• Competence and Evaluation of Auditors 

Module 13: Cybersecurity Auditing 

• What is Cybersecurity Audit? 
• How it helps Organisation? 
• Cybersecurity and the Role of Internal Audit 

Module 14: Information Security Audit 

• What is IT Security Audit? 
• Benefits  
• Types  
• Importance  
• How to Conduct an IT Security Audit? 
• Roles and Responsibilities of Information Security Auditor