ISO/IEC 27001 Lead Auditor for Information Security

This course will help you master Information Security Management System (ISMS) auditing and the requirements of ISO/IEC 27001:2022, equipping you with essential skills to advance your career in the rapidly growing field of information security.

Compliance with international standards, such as ISO/IEC 27001, is now a critical requirement for organizations across industries, including finance, engineering, IT, transportation, professional services or manufacturing. Professionals skilled in assessing compliance and in guiding organizations to strengthen their information security are in high demand.

By enrolling in this online course, you will gain a solid understanding of auditing fundamentals, the specific requirements of ISO/IEC 27001, the standard's proposed security controls, and how to evaluate compliance during an ISMS audit.

The first part of the course introduces the foundational concepts of information security management systems. You will explore what an ISMS is, the standards within the ISO/IEC 27000 series, and the purpose and structure of ISO/IEC 27001:2022.

Next, the course provides a comprehensive overview of management system auditing basics. You will learn about the core principles auditors must adhere to, effective methods for collecting audit evidence, and critical documents such as the audit programme, audit plan, and audit report. This section also delves into remote auditing, how to analyze audit findings and conclusions, and the differences between lead auditors and auditors, as well as internal and external audits.

The subsequent section focuses on auditing the management system requirements of ISO/IEC 27001. Key topics include auditing the information security risk assessment, assessing the scope of the ISMS, reviewing the information security policy and objectives, evaluating the management reviews and the internal audits of the ISMS, auditing the statement of applicability and the risk treatment plan or reviewing how the organization manages nonconformities. Each topic is analyzed from an auditor's perspective, emphasizing the critical areas to evaluate during compliance assessments.

The following four sections of the course address the main themes of information security controls as outlined in ISO/IEC 27001:2022:

• Organizational Controls, such as policies, supplier relationships, incident management, privacy and protection of personally identifiable information, access control, threat intelligence, information classification and labelling of the inventory of information and assets.

• People Controls, including screening, disciplinary process, information security education and training, confidentiality and non-disclosure agreements.

• Physical Controls, focusing on securing the infrastructure, protecting against natural and environmental threats, cabling security, protecting assets off-premises or managing storage media throughout its life cycle.

• Technological Controls, covering topics like cryptography, malware protection, network security, secure development, capacity management, backups, information deletion, data masking, vulnerability management or system redundancy.

This course provides suggestions for assessing during the ISMS audit challenges such as those posed by remote working, or the use of personal devices for work purposes (BYOD) . You will gain actionable insights into how auditors can evaluate compliance with these controls effectively.

The final section of the course focuses on closing the ISMS audit, covering how to formulate the audit's findings and conclusions, how to conduct the closing meeting and plan the necessary post-audit activities.

This course provides a complete and detailed exploration of ISO/IEC 27001 requirements, with inputs from related standards such as ISO/IEC 27002, ISO/IEC 27005, and ISO/IEC 27035. It combines theoretical knowledge with practical examples, offering auditors valuable guidance on where to focus to gather meaningful evidence.

Whether you are a professional aiming to advance your career as an ISMS auditor or preparing for an upcoming audit, this course offers a structured and comprehensive approach to mastering ISO/IEC 27001:2022 ISMS auditing.