Course Outline
I. Introduction to Information Security
1. Systemic management of information security
2. Organizational benefits and value addition
II. Overview of ISO 27001 Requirements
1. Key requirements of the standard
2. Critical areas of focus
3. Identification of documentation obligations
4. Overview of Annex A
III. Information Security Management System (ISMS) Compliant with ISO 27001
1. Components of an ISMS according to ISO
27001
2. Exercises interpreting and analyzing ISO 27001 requirements
IV. Audits – General Overview
1. Introduction to auditing principles
2. Full audit lifecycle
3. Audit criteria
4. Types of audits
V. Audit Planning and Preparation
1. Defining audit criteria and scope
2. Assembling the audit team
3. Process approach to internal audits
4. Key considerations for developing control question lists
5. Executing audits in accordance with ISO 19011:2018
6. Practical exercises
VI. Conducting an Audit – On-Site Protocols
1. Auditing techniques
2. Objective evidence gathering
3. Identifying and demonstrating non-conformities
4. Competencies required of a lead auditor
5. Practical exercises
VII. Documenting Audit Results
1. Precision in formulating findings
2. Documentation of non-conformities
3. Identifying and recording insights and improvement opportunities
4. Summarizing audit outcomes – Audit Report
5. Practical exercises
VIII. Effective Post-Audit Activities
1. Responsibilities regarding the initiation of corrective actions
2. The Importance of Accurately Determining Root Causes of Non-Conformity
3. Defining corrective actions
4. Evaluating the effectiveness of implemented actions
5. Post-audit activities related to insights and improvement potentials
6. Practical exercises
IX. Discussion and Summary
Requirements
Target Audience
- Professionals preparing for the role of Lead Auditor under ISO 27001:2023.
- Anyone with a professional interest in information security auditing.
