ISO 27002 Lead Auditor Training - United States

ISO 27002 Lead Auditor Training Course Outline

Module 1: Introduction to ISO 27002

• Scope
• Terms and Definitions
• Abbreviated Terms

Module 2: Information Security

• What is Information Security?
• CIA
• Principles of Information Security
• Need for Information Security
• Threats
• Active and Passive Attacks

Module 3: Cybersecurity

• What is Cybersecurity?
• Cybersecurity Domains
• Dangerous Cybersecurity Myths
• Common Cyber Threats
• Key Cybersecurity Technologies and Best Practices
• Zero Trust Security Strategy
• Difference Between Cybersecurity and Information Security 
• Roles and Responsibilities of Cybersecurity Professionals

Module 4: Information Security Management System (ISMS)

• Introduction to ISMS
• Need
• What Does an ISMS Do?
• Benefits

Module 5: Themes and Controls

• Control Type
• Information Security Properties
• Cybersecurity Concepts
• Operational Capabilities
• Security Domains
• Control Layout

Module 6: Organisational Controls

• Policies for Information Security
• Information Security Roles and Responsibilities
• Segregation of Duties
• Management Responsibilities
• Contact with
  • Authorities
  • Special Interest Groups
• Threat Intelligence
• Information Security in Project Management
• Inventory of Information and Other Associated Assets
• Acceptable Use of Information and Other Associated Assets
• Return of Assets
• Classification of Information
• Labelling of Information
• Information Transfer
• Access Control
• Identity Management
• Authentication Information
• Access Rights
• Information Security in Supplier Relationships
• Addressing Information Security within Supplier Agreements
• Managing Information Security in the ICT Supply Chain
• Monitoring, Review, and Change Management of Supplier Services
• Information Security for Use of Cloud Services
• Information Security Incident Management Planning and Preparation
• Assessment and Decision on Information Security Events
• Response to Information Security Incidents
• Learning from Information Security Incidents
• Collection of Evidence
• Information Security During Disruption
• ICT Readiness for Business Continuity
• Legal, Statutory, Regulatory, and Contractual Requirements
• Intellectual Property Rights
• Protection of Records
• Privacy and Protection of PII
• Independent Review of Information Security
• Compliance with Policies, Rules, and Standards for Information Security
• Documented Operating Procedures

Module 7: People Controls

• Screening
• Terms and Conditions of Employment.
• Information Security Awareness, Education, and Training
• Disciplinary Process
• Responsibilities After Termination or Change of Employment
• Confidentiality or Non-Disclosure Agreements
• Remote Working
• Information Security Event Reporting

Module 8: Physical Controls

• Physical Security Perimeters
• Physical Entry
• Securing Offices, Rooms, and Facilities
• Physical Security Monitoring
• Protecting Against Physical and Environmental Threats
• Working in Secure Areas
• Clear Desk and Clear Screen
• Equipment Siting and Protection
• Security of Assets Off-Premises
• Storage Media
• Supporting Utilities
• Cabling Security
• Equipment Maintenance
• Secure Disposal or Re-Use of Equipment

Module 9: Technological Controls

• User Endpoint Devices
• Privileged Access Rights
• Information Access Restriction
• Access to Source Code
• Secure Authentication
• Capacity Management
• Protection Against Malware
• Management of Technical Vulnerabilities
• Configuration Management
• Information Deletion
• Data
  • Masking
  • Leakage Prevention
• Information Backup
• Redundancy of Information Processing Facilities
• Logging
• Monitoring Activities
• Clock Synchronisation
• Use of Privileged Utility Programs
• Installation of Software on Operational Systems
• Networks Security
• Security of Network Services
• Segregation of Networks
• Web Filtering
• Use of Cryptography
• Secure Development Life Cycle
• Application Security Requirements
• Secure System Architecture and Engineering Principles
• Secure Coding
• Security Testing in Development and Acceptance
• Outsourced Development
• Separation of Development, Test, and Production Environments
• Change Management
• Test Information
• Protection of Information Systems During Audit Testing

Module 10: Audit Plan and Process

• Audit Plan
• Preparing for an Audit
• Audit Process

Module 11: Internal Auditor

• Understanding an Internal Auditor (IA)
• Internal Auditing Process
• Requirements for Internal Auditors
• Internal Auditor Vs External Auditor
• Benefits of an Internal Auditor (IA)

Module 12: ISMS Audit

• Introduction
• Principles
• Audit Management
• Auditing Process
• Competence and Evaluation of Auditors

Module 13: Cybersecurity Auditing

• What is Cybersecurity Audit?
• How it helps Organisation?
• Cybersecurity and the Role of Internal Audit

Module 14: Information Security Audit

• What is IT Security Audit?
• Benefits
• Types
• Importance
• How to Conduct an IT Security Audit?
• Roles and Responsibilities of Information Security Auditor

Module 15: Information Security in Project Management

• Project Management
• Attributes Table
• Purpose of Control 5.8
• Meet Requirements
• ISO 27002:2013 Vs ISO 27002:2022

Module 16: Components of Information Security

• Confidentiality
• Integrity
• Availability
• Authenticity
• Non-Repudiation

Module 17: Information Security Risk Management (ISRM)

• Introduction
• Stages
• Ownership

Module 18: Control and Compliance

• Security Controls
• Importance of Compliance
• Legal Requirements for Information Security
• Information Technology Compliance 
• Information Security Compliance Standards

Module 19: Management Responsibilities

• Control 5.4 Management Responsibilities
• What is an Information Security Policy?
• Attributes Table
• Purpose of Control 5.4
• Implementation Guidelines

Module 20: Competence and Evaluation of Auditors

• Auditor Competence
• Demonstration of Auditor Competence

Module 21: Lead Auditor

• What is Lead Auditor?
• Roles
• Planning Phase
• Audit Phase
• Audit Report

Module 22: Conformity Assessment

• What is Conformity Assessment?
• Need of Conformity Assessment
• Conformity Assessment and Standards
• Types of Conformity Assessment