ISO 27002 Training - United States

ISO 27002 Internal Auditor Training Course Outline

Module 1: Introduction to ISO 27002 

• Scope 
• Terms and Definitions 
• Abbreviated Terms 

Module 2: Information Security 

• What is Information Security? 
• CIA 
• Principles of Information Security 
• Need for Information security 
• Threats 
• Active and Passive Attacks 

Module 3: Cybersecurity 

• What is Cybersecurity? 
• Cybersecurity Domains 
• Dangerous Cybersecurity Myths 
• Common Cyber Threats 
• Key Cybersecurity Technologies and Best Practices 
• Zero Trust Security Strategy 
• Difference Between Cybersecurity and Information Security   
• Roles and Responsibilities of Cybersecurity Professionals 

Module 4: Information Security Management System (ISMS) 

• Introduction to ISMS 
• Need 
• What Does an ISMS Do? 
• Benefits 

Module 5: Themes and Controls 

• Control Type 
• Information Security Properties 
• Cybersecurity Concepts 
• Operational Capabilities 
• Security Domains 
• Control Layout 

Module 6: Organisational Controls 

• Policies for Information Security 
• Information Security Roles and Responsibilities 
• Segregation of Duties 
• Management Responsibilities  
• Contact with  
  • Authorities 
  • Special Interest Groups 
• Threat Intelligence 
• Information Security in Project Management 
• Inventory of Information and Other Associated Assets 
• Acceptable Use of Information and Other Associated Assets 
• Return of Assets 
• Classification of Information 
• Labelling of Information  
• Information Transfer  
• Access Control 
• Identity Management 
• Authentication Information 
• Access Rights 
• Information Security in Supplier Relationships  
• Addressing Information Security within Supplier Agreements  
• Managing Information Security in the ICT Supply Chain 
• Monitoring, Review, and Change Management of Supplier Services 
• Information Security for Use of Cloud Services 
• Information Security Incident Management Planning and Preparation 
• Assessment and Decision on Information Security Events 
• Response to Information Security Incidents 
• Learning from Information Security Incidents 
• Collection of Evidence 
• Information Security During Disruption 
• ICT Readiness for Business Continuity  
• Legal, Statutory, Regulatory, and Contractual Requirements 
• Intellectual Property Rights 
• Protection of Records 
• Privacy and Protection of PII 
• Independent Review of Information Security 
• Compliance with Policies, Rules, and Standards for Information Security 
• Documented Operating Procedures 

Module 7: People Controls 

• Screening 
• Terms and Conditions of Employment. 
• Information Security Awareness, Education, and Training 
• Disciplinary Process 
• Responsibilities After Termination or Change of Employment 
• Confidentiality or Non-Disclosure Agreements 
• Remote Working 
• Information Security Event Reporting 

Module 8: Physical Controls 

• Physical Security Perimeters 
• Physical Entry 
• Securing Offices, Rooms, and Facilities  
• Physical Security Monitoring 
• Protecting Against Physical and Environmental Threats  
• Working in Secure Areas  
• Clear Desk and Clear Screen 
• Equipment Siting and Protection  
• Security of Assets Off-Premises 
• Storage Media 
• Supporting Utilities 
• Cabling Security 
• Equipment Maintenance 
• Secure Disposal or Re-use of Equipment 

Module 9: Technological Controls  

• User Endpoint Devices  
• Privileged Access Rights 
• Information Access Restriction 
• Access to Source Code 
• Secure Authentication 
• Capacity Management 
• Protection Against Malware 
• Management of Technical Vulnerabilities 
• Configuration Management 
• Information Deletion 
• Data  
  • Masking  
  • Leakage Prevention 
• Information Backup 
• Redundancy of Information Processing Facilities 
• Logging 
• Monitoring Activities 
• Clock Synchronisation 
• Use of Privileged Utility Programmes 
• Installation of Software on Operational Systems 
• Networks Security 
• Security of Network Services 
• Segregation of Networks 
• Web Filtering 
• Use of Cryptography  
• Secure Development Life Cycle 
• Application Security Requirements 
• Secure System Architecture and Engineering Principles 
• Secure Coding 
• Security Testing in Development and Acceptance 
• Outsourced Development 
• Separation of Development, Test, and Production Environments 
• Change Management 
• Test Information 
• Protection of Information Systems During Audit Testing 

Module 10: Audit Plan and Process 

• Audit Plan 
• Preparing for an Audit 
• Audit Process 

Module 11: Internal Auditor 

• Understanding an Internal Auditor (IA) 
• Internal Auditing Process 
• Requirements for Internal Auditors 
• Internal Auditor Vs External Auditor 
• Benefits of an Internal Auditor (IA) 

Module 12: ISMS Audit 

• Introduction 
• Principles 
• Audit Management 
• Auditing Process 
• Competence and Evaluation of Auditors 

Module 13: Cybersecurity Auditing 

• What is Cybersecurity Audit? 
• How it helps Organisation? 
• Cybersecurity and the Role of Internal Audit 

Module 14: Information Security Audit 

• What is IT Security Audit? 
• Benefits  
• Types  
• Importance  
• How to Conduct an IT Security Audit? 
• Roles and Responsibilities of Information Security Auditor

ISO 27002 Lead Implementer Training Course Outline

Module 1: Introduction to ISO 27002

• Scope
• Terms and Definitions
• Abbreviated Terms

Module 2: Information Security

• What is Information Security?
• CIA
• Principles of Information Security
• Need for Information Security
• Threats
• Active and Passive Attacks

Module 3: Cybersecurity

• What is Cybersecurity?
• Cybersecurity Domains
• Dangerous Cybersecurity Myths
• Common Cyber Threats
• Key Cybersecurity Technologies and Best Practices
• Zero Trust Security Strategy
• Difference Between Cybersecurity and Information Security 
• Roles and Responsibilities of Cybersecurity Professionals

Module 4: Information Security Management System (ISMS)

• Introduction to ISMS
• Need
• What Does an ISMS Do?
• Benefits

Module 5: Themes and Controls

• Control type
• Information Security Properties
• Cybersecurity Concepts
• Operational Capabilities
• Security Domains
• Control Layout

Module 6: Organisational Controls

• Policies for Information Security
• Information Security Roles and Responsibilities
• Segregation of Duties
• Management Responsibilities
• Contact with
  • Authorities
  • Special Interest Groups
• Threat Intelligence
• Information Security in Project Management
• Inventory of Information and Other Associated Assets
• Acceptable Use of Information and Other Associated Assets
• Return of Assets
• Classification of Information
• Labelling of Information
• Information Transfer
• Access Control
• Identity Management
• Authentication Information
• Access Rights
• Information Security in Supplier Relationships
• Addressing Information Security within Supplier Agreements
• Managing Information Security in the ICT Supply Chain
• Monitoring, Review, and Change Management of Supplier Services
• Information Security for Use of Cloud Services
• Information Security Incident Management Planning and Preparation
• Assessment and Decision on Information Security Events
• Response to Information Security Incidents
• Learning from Information Security Incidents
• Collection of Evidence
• Information Security During Disruption
• ICT Readiness for Business Continuity
• Legal, Statutory, Regulatory, and Contractual Requirements
• Intellectual Property Rights
• Protection of Records
• Privacy and Protection of PII
• Independent Review of Information Security
• Compliance with Policies, Rules, and Standards for Information Security
• Documented Operating Procedures

Module 7: People Controls

• Screening
• Terms and Conditions of Employment.
• Information Security Awareness, Education, and Training
• Disciplinary Process
• Responsibilities After Termination or Change of Employment
• Confidentiality or Non-Disclosure Agreements
• Remote Working
• Information Security Event Reporting

Module 8: Physical Controls

• Physical Security Perimeters
• Physical Entry
• Securing Offices, Rooms, and Facilities
• Physical Security Monitoring
• Protecting Against Physical and Environmental Threats
• Working in Secure Areas
• Clear Desk and Clear Screen
• Equipment Siting and Protection
• Security of Assets Off-Premises
• Storage Media
• Supporting Utilities
• Cabling Security
• Equipment Maintenance
• Secure Disposal or Re-Use of Equipment

Module 9: Technological Controls

• User Endpoint Devices
• Privileged Access Rights
• Information Access Restriction
• Access to Source Code
• Secure Authentication
• Capacity Management
• Protection Against Malware
• Management of Technical Vulnerabilities
• Configuration Management
• Information Deletion
• Data
  • Masking
  • Leakage Prevention
• Information Backup
• Redundancy of Information Processing Facilities
• Logging
• Monitoring Activities
• Clock Synchronisation
• Use of Privileged Utility Programs
• Installation of Software on Operational Systems
• Networks Security
• Security of Network Services
• Segregation of Networks
• Web Filtering
• Use of Cryptography
• Secure Development Life Cycle
• Application Security Requirements
• Secure System Architecture and Engineering Principles
• Secure Coding
• Security Testing in Development and Acceptance
• Outsourced Development
• Separation of Development, Test, and Production Environments
• Change Management
• Test Information
• Protection of Information Systems During Audit Testing

Module 10: Audit Plan and Process

• Audit Plan
• Preparing for an Audit
• Audit Process

Module 11: Internal Auditor

• Understanding an Internal Auditor (IA)
• Internal Auditing Process
• Requirements for Internal Auditors
• Internal Auditor Vs External Auditor
• Benefits of an Internal Auditor (IA)

Module 12: ISMS Audit

• Introduction
• Principles
• Audit Management
• Auditing Process
• Competence and Evaluation of Auditors

Module 13: Cybersecurity Auditing

• What is Cybersecurity Audit?
• How it Helps Organisation?
• Cybersecurity and the Role of Internal Audit

Module 14: Information Security Audit

• What is IT Security Audit?
• Benefits
• Types
• Importance
• How to Conduct an IT Security Audit?
• Roles and Responsibilities of Information Security Auditor

ISO 27002 Lead Auditor Training Course Outline

Module 1: Introduction to ISO 27002

• Scope
• Terms and Definitions
• Abbreviated Terms

Module 2: Information Security

• What is Information Security?
• CIA
• Principles of Information Security
• Need for Information Security
• Threats
• Active and Passive Attacks

Module 3: Cybersecurity

• What is Cybersecurity?
• Cybersecurity Domains
• Dangerous Cybersecurity Myths
• Common Cyber Threats
• Key Cybersecurity Technologies and Best Practices
• Zero Trust Security Strategy
• Difference Between Cybersecurity and Information Security 
• Roles and Responsibilities of Cybersecurity Professionals

Module 4: Information Security Management System (ISMS)

• Introduction to ISMS
• Need
• What Does an ISMS Do?
• Benefits

Module 5: Themes and Controls

• Control Type
• Information Security Properties
• Cybersecurity Concepts
• Operational Capabilities
• Security Domains
• Control Layout

Module 6: Organisational Controls

• Policies for Information Security
• Information Security Roles and Responsibilities
• Segregation of Duties
• Management Responsibilities
• Contact with
  • Authorities
  • Special Interest Groups
• Threat Intelligence
• Information Security in Project Management
• Inventory of Information and Other Associated Assets
• Acceptable Use of Information and Other Associated Assets
• Return of Assets
• Classification of Information
• Labelling of Information
• Information Transfer
• Access Control
• Identity Management
• Authentication Information
• Access Rights
• Information Security in Supplier Relationships
• Addressing Information Security within Supplier Agreements
• Managing Information Security in the ICT Supply Chain
• Monitoring, Review, and Change Management of Supplier Services
• Information Security for Use of Cloud Services
• Information Security Incident Management Planning and Preparation
• Assessment and Decision on Information Security Events
• Response to Information Security Incidents
• Learning from Information Security Incidents
• Collection of Evidence
• Information Security During Disruption
• ICT Readiness for Business Continuity
• Legal, Statutory, Regulatory, and Contractual Requirements
• Intellectual Property Rights
• Protection of Records
• Privacy and Protection of PII
• Independent Review of Information Security
• Compliance with Policies, Rules, and Standards for Information Security
• Documented Operating Procedures

Module 7: People Controls

• Screening
• Terms and Conditions of Employment.
• Information Security Awareness, Education, and Training
• Disciplinary Process
• Responsibilities After Termination or Change of Employment
• Confidentiality or Non-Disclosure Agreements
• Remote Working
• Information Security Event Reporting

Module 8: Physical Controls

• Physical Security Perimeters
• Physical Entry
• Securing Offices, Rooms, and Facilities
• Physical Security Monitoring
• Protecting Against Physical and Environmental Threats
• Working in Secure Areas
• Clear Desk and Clear Screen
• Equipment Siting and Protection
• Security of Assets Off-Premises
• Storage Media
• Supporting Utilities
• Cabling Security
• Equipment Maintenance
• Secure Disposal or Re-Use of Equipment

Module 9: Technological Controls

• User Endpoint Devices
• Privileged Access Rights
• Information Access Restriction
• Access to Source Code
• Secure Authentication
• Capacity Management
• Protection Against Malware
• Management of Technical Vulnerabilities
• Configuration Management
• Information Deletion
• Data
  • Masking
  • Leakage Prevention
• Information Backup
• Redundancy of Information Processing Facilities
• Logging
• Monitoring Activities
• Clock Synchronisation
• Use of Privileged Utility Programs
• Installation of Software on Operational Systems
• Networks Security
• Security of Network Services
• Segregation of Networks
• Web Filtering
• Use of Cryptography
• Secure Development Life Cycle
• Application Security Requirements
• Secure System Architecture and Engineering Principles
• Secure Coding
• Security Testing in Development and Acceptance
• Outsourced Development
• Separation of Development, Test, and Production Environments
• Change Management
• Test Information
• Protection of Information Systems During Audit Testing

Module 10: Audit Plan and Process

• Audit Plan
• Preparing for an Audit
• Audit Process

Module 11: Internal Auditor

• Understanding an Internal Auditor (IA)
• Internal Auditing Process
• Requirements for Internal Auditors
• Internal Auditor Vs External Auditor
• Benefits of an Internal Auditor (IA)

Module 12: ISMS Audit

• Introduction
• Principles
• Audit Management
• Auditing Process
• Competence and Evaluation of Auditors

Module 13: Cybersecurity Auditing

• What is Cybersecurity Audit?
• How it helps Organisation?
• Cybersecurity and the Role of Internal Audit

Module 14: Information Security Audit

• What is IT Security Audit?
• Benefits
• Types
• Importance
• How to Conduct an IT Security Audit?
• Roles and Responsibilities of Information Security Auditor

Module 15: Information Security in Project Management

• Project Management
• Attributes Table
• Purpose of Control 5.8
• Meet Requirements
• ISO 27002:2013 Vs ISO 27002:2022

Module 16: Components of Information Security

• Confidentiality
• Integrity
• Availability
• Authenticity
• Non-Repudiation

Module 17: Information Security Risk Management (ISRM)

• Introduction
• Stages
• Ownership

Module 18: Control and Compliance

• Security Controls
• Importance of Compliance
• Legal Requirements for Information Security
• Information Technology Compliance 
• Information Security Compliance Standards

Module 19: Management Responsibilities

• Control 5.4 Management Responsibilities
• What is an Information Security Policy?
• Attributes Table
• Purpose of Control 5.4
• Implementation Guidelines

Module 20: Competence and Evaluation of Auditors

• Auditor Competence
• Demonstration of Auditor Competence

Module 21: Lead Auditor

• What is Lead Auditor?
• Roles
• Planning Phase
• Audit Phase
• Audit Report

Module 22: Conformity Assessment

• What is Conformity Assessment?
• Need of Conformity Assessment
• Conformity Assessment and Standards
• Types of Conformity Assessment