Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

ISO 27002:2022 Complete Training - ISMS Lead Manager

Name: ISO 27002:2022 Complete Training - ISMS Lead Manager
Rating: 4.3 (3 reviews)

The MOST Complete ISO 27001 Study Reference, Cover ISMS ISO 27001, 27002 and Practical Implementation guidance 27001:22

Created byCYVITRIX Learning | CISSP, CISA, CISM, CRISC, ISO 27001, and GRC Mastery!

Last updated 3/2026

English

What you'll learn

Build and structure a GRC framework aligned with business strategy, using standards like ISO 27001, NIST, COSO, and COBIT in a practical way.
Design and maintain a risk management process end to end, from risk identification and assessment to treatment, monitoring, and reporting.
Develop and manage policies, standards, and procedures that are clear, enforceable, and aligned with governance requirements.
Map and implement controls across technology, processes, and people, and link them to risks, regulations, and business objectives.
Build and maintain risk registers, control libraries, and compliance matrices that stand up to audits and regulator reviews.
Communicate with executives, audit committees, and regulators using the language of risk appetite, tolerance, KRI, KPI, and assurance.

Course content

14 sections • 101 lectures • 25h 21m total length

What is ISO 27002 ?8:22
The ISO 27001 Management System Approach11:55
How ISO 27000 Family is Connected Together?10:00
Implementation and Integration of ISO 27001 - ISMS10:35

Threat Intelligence (A.5.7)17:32
Explore threat intelligence as a proactive cornerstone of information security management, turning raw data into actionable insights to collect, analyze, disseminate, and integrate within an Isms for risk-based defense.
Information Security in Project Management (A.5.8)15:50
Inventory of Information & Associated Assets (A.5.9)14:30
Create and maintain a comprehensive inventory of information assets with clear ownership, classification, and value to enable risk management, compliance, and rapid incident response.
Acceptable Use of Information & Associated Assets (A.5.10)14:02
Return of Assets (A.5.11)14:23
Information Classification (A.5.12)13:53
Labelling of Information (A.5.13)15:10
Information Transfer (A.5.14)14:12

Access Control (A.5.15)13:37
Identity Management (A.5.16)14:03
Authentication Information (A.5.17)14:55
Explore authentication information, why it matters, and how to manage it securely with passwords, tokens, biometrics, and MFA.
Access Rights (A.5.18)15:49
Information Security in Supplier Relationships (A.5.19)16:22
Addressing Information Security within Supplier Agreements (A.5.20)15:41
Managing Information Security in the ICT Supply Chain (A.5.21)16:27
Monitoring, Review and Change Management of Supplier Services (A.5.22)15:44
Information Security for Use of Cloud Services (A.5.23)14:25
Explain the unique security requirements of cloud services, including the shared responsibility model, access controls, encryption, monitoring, incident response, data residency, governance, shadow IT, and data portability.

Information Security Incident Management Planning & Preparation (A.5.24)14:34
Explore how information security incident management planning and preparation form a structured incident response plan with defined roles, reporting, triage, containment, recovery, and lessons learned.
Assessment and Decision on Information Security Events (A.5.25)13:31
Response to Information Security Incidents (A.5.26)15:44
Learning from Information Security Incidents (A.5.27)16:43
Collection of Evidence (A.5.28)13:11
Collect and preserve digital evidence during information security incidents, emphasizing chain of custody, volatile data handling, and hashing. Document all actions to ensure evidence remains admissible and reliable forensics.

Independent Review of Information Security (A.5.35)14:46
Conduct an independent review of information security under control A.5.35 to verify the ISMS operates effectively, meets internal and external requirements, and drives continuous improvement through objective, risk-based assessments.
Compliance with Policies and Standards for Information Security (A.5.36)17:38
Documented Operating Procedures (A.5.37)17:14

Screening (A.6.1)15:46
Terms and Conditions of Employment (A.6.2)15:27
Information Security Awareness, Education and Training (A.6.3)17:18
Disciplinary Process (A.6.4)15:05
Responsibilities After Termination or Change of Employment (A.6.5)12:13
Confidentiality or Non-Disclosure Agreements (A.6.6)17:40
Align confidentiality with NDA foundations to protect sensitive information, outlining key clauses, enforcement, and practical implementation for remote work and third-party collaborations.
Remote Working (A.6.7)14:25
Information Security Event Reporting (A.6.8)15:17

Physical Security Perimeters (A.7.1)17:37
Physical Entry (A.7.2)15:55
Securing Offices, Rooms and Facilities (A.7.3)14:42
Physical Security Monitoring (A.7.4)15:17
Protection from Physical and Environmental Threats (A.7.5)19:09
Working in Secure Areas (A.7.6)16:19
Clear Desk and Clear Screen (A.7.7)13:28
Learn clear desk and clear screen policies to prevent unauthorized access and visual hacking, reinforcing regulatory compliance under iso 27002:2022 and a security mindset across offices and remote work.
Equipment Siting and Protection (A.7.8)15:16
Security of Assets Off-Premises (A.7.9)14:33
Secure off premises assets by enforcing encryption for data at rest, VPN/TLS for data in transit, and MDM with strong access controls and MFA.
Storage Media (A.7.10)15:56
Supporting Utilities (A.7.11)19:00
Cabling Security (A.7.12)14:46
Secure both power and telecommunications cabling by applying physical, technical, and organizational controls to prevent interception and damage, using conduits, encryption, network segmentation, and risk-based management.
Equipment Maintenance (A.7.13)15:45
Secure Disposal or Re-use of Equipment (A.7.14)14:41

User End Point Devices (A.8.1)17:09
Privileged Access Rights (A.8.2)14:09
Information Access Restriction (A.8.3)17:09
Implement information access restriction through information classification and fine-grained controls, enforcing need-to-know with RBAC, ABAC, and MAC, plus provisioning, review, and deprovisioning in a zero-trust framework.
Access to Source Code (A.8.4)12:53
Secure Authentication (A.8.5)14:34
Capacity Management (A.8.6)17:19
Learn capacity management to ensure information systems meet current and future demands while preserving security performance. Explore systematic planning, monitoring, thresholds, and best practices for cloud, on-premises, and DevOps environments.
Protection Against Malware (A.8.7)15:22
Management of Technical Vulnerabilities (A.8.8)15:49
Configuration Management (A.8.9)15:26
Information Deletion (A.8.10)14:41
Data Masking (A.8.11)16:22
Data Leakage Prevention (A.8.12)18:18

Requirements

If you are ready to move beyond fragmented knowledge and build a complete, practical GRC skill set that organizations truly value, this training is your roadmap.
Enrol now and start your journey to becoming a GRC expert who can design, communicate, and run governance, risk, and compliance programs that make a real impact.

Description

This course contains the use of artificial intelligence. in the production workflow, but it is not purely AI-generated content. The curriculum is designed, reviewed, and authored by a subject matter expert. Audio narration is synthesized using text-to-speech tools, with quality checks applied throughout the process. Our goal is to deliver learning that is clear, accessible, and worth your investment.

This course is an independent study resource designed to help you learn the subject matter. It does not replace official materials, exam blueprints, standards, or guidance published by certification bodies or standards organizations. This training is not sponsored by, endorsed by, affiliated with, or approved by ISACA, ISC2, Cloud Security Alliance (CSA), PECB, or any similar organization. All certification names and related marks, including CISA, CISM, CRISC, CGEIT, CDPSE, AAIA, AAISM, AAIR, CISSP, CCSP, CGRC, CSSLP, SSCP, CC, CCSK, CCAK, and CCZT, are registered trademarks of their respective owners and are used for identification purposes only.

In this practical, end-to-end ISO 27002 training program, we take you from uncertain and fragmented understanding of information security to a clear, structured, and confident ISO 27001 mindset. No dry reading of clauses, no endless theory with no link to real organizations. You get a step-by-step roadmap to design, implement, and continuously improve an ISO 27002-aligned ISMS that actually works in practice and can stand up to external audits and regulatory expectations.

By the end of this training, you will be able to:

Understand the full structure of ISO 27002 Controls
Translate the standard into a working ISMS with clear scope, policy, roles and responsibilities, and governance model.
Perform or participate in risk assessment and risk treatment aligned with ISO 27001, and link risks, controls, and risk treatment plans together.
Work confidently with Annex A controls, understanding how to select and justify them in a Statement of Applicability (SoA).
Develop and manage key ISMS documents such as policies, procedures, registers, and records that add value instead of becoming shelfware.
Support or lead internal audits, management reviews, and continual improvement activities that keep the ISMS alive after certification.

Why this ISO 27002 training is different

Most ISO 27002 courses either read the standard clause by clause or stay stuck at very high level. This masterclass focuses on real implementation, clear understanding, and audit-ready practice:

Concepts are explained in plain language first, then mapped directly to ISO 27002 clause numbers and Annex A controls so you always know where you are in the standard.
Training is scenario-driven, using realistic examples from SMEs, enterprises, cloud environments, and regulated sectors.
You see how to connect risk management, controls, policies, awareness, and technical security into one coherent ISMS framework.

Your next step

If you are ready to move beyond generic security talk and build a practical, ISO 27002-aligned ISMS that supports both security and business objectives, this training is your roadmap.

Enroll now and start your journey to becoming an ISO 27002 practitioner who can design, implement, and improve information security management systems that truly protect the organization and satisfy auditors.

Who this course is for:

You are responsible for information security, GRC, risk management, compliance, or IT management and need to design or support an ISO 27001-aligned ISMS.
You are part of an organization that is planning for ISO 27001 certification, maintaining certification, or strengthening security governance.
You work as a security professional, consultant, internal auditor, or IT leader and want a strong, practical understanding of how ISO 27001 works in real life.
You are tired of purely theoretical explanations and want concrete guidance on what to implement, how to document it, and how to explain it to management and auditors.
Business Owners and Decision Makers

ISO 27002:2022 Complete Training - ISMS Lead Manager

What you'll learn

Explore related topics

Course content

Course Introduction4 lectures • 41min

Annex A - Control 5 - Part 1 - Organizational Controls6 lectures • 1hr 31min

Annex A - Control 5 - Part 2 - Organizational Controls8 lectures • 2hr

Annex A - Control 5 - Part 3 - Organizational Controls9 lectures • 2hr 17min

Annex A - Control 5 - Part 4 - Organizational Controls5 lectures • 1hr 14min

Annex A - Control 5 - Part 5 - Organizational Controls6 lectures • 1hr 35min

Annex A - Control 5 - Part 6 - Organizational Controls3 lectures • 50min

Annex A - Control 6 - People Controls8 lectures • 2hr 3min

Annex A - Control 7 - Physical Controls14 lectures • 3hr 42min

Annex A - Control 8 - Part 1 - Technological Controls12 lectures • 3hr 9min

Requirements

Description

Who this course is for: