Certified ISO 27001 Lead Implementer and Lead Auditor Combination Training Course

• The key concepts, principles and main requirements of ISO/IEC 27001:2013.
  
• The terms and definitions used in the Standard, including risk and options for risk assessments.
  
• How to interpret the requirements of ISO/IEC 27001:2013 to determine the scope of your ISMS.
  
• How to secure senior management commitment by building a compelling business case.
  
• How to structure and manage your ISO 27001 project.
  
• How to review and map your existing controls to Annex A of ISO 27001.
  
• The importance of the Statement of Applicability (SoA), and justifications for inclusions and exclusions.
  
• How to carry out an information security risk assessment – the core competence of information security management.
  
• How to develop a management framework, write policies and produce other critical documentation.
• The key elements of management review.

• The importance of staff, an effective communication strategy and general awareness training.
• How to prepare for your ISO 27001 certification audit and ensure you that you pass first time.
• How to manage and drive continual improvement under ISO 27001. 
  
• An overview of the audit process used by certification bodies.
  
• Best-practice audit methodology based on ISO 19011.
  
• How to establish, maintain and manage an audit programme.
  
• How to plan, conduct, report, summarise and follow-up on an audit.
  
• Effective interviewing techniques and observation skills.
  
• How to use audits to identify nonconformities and ensure appropriate corrective action is taken.
  
• How the audit process is used in first, second and third-party audits.

Course agenda (day 1-3):

• Project mandate
  
• Project initiation
  
• ISMS initiation
  
• Management framework
  
• Baseline security criteria
  
• Risk management
  
• Implementation
  
• Annex A controls
  
• Measure, monitor, review and improve
  
• Certification

Course agenda (day 4-8):

• Purpose and benefits of audits
  
• Role of auditors
  
• Role of standards in audits
  
• Audit terms and definitions
  
• Principles of auditing
  
• Managing an audit programme
  
• Performing an audit
  
• Observing and listening
  
• Reporting and Summarising Audit Findings 
  
• Conducting Audit Follow-up 
  
• Competence and Evaluation of Auditors 
  
• Accredited Certification Audit specifics 
  
• Auditing an Information Security Management System to ISO 27001:2013