Duration
2 days
Overview
This course provides participants with ideas and awareness on implementing Information Security Management System using the ISO Standard for Information Security – ISO/IEC 27001:2013. This standard is comprehensive in its coverage of security issues, containing a significant number of control requirements that has changed from the 2005 version. This workshop is designed to assist organisations that are already certified to ISO 27001:2005 version who must upgrade to the new version by Oct 2014.
The critical differences, risk management approach as recommended by the new version based on ISO 31000 will be explained in detail.
The objective of this training is to introduce participants to the purpose and requirements of ISO 27001:2013 Information Security Management Systems (ISMS) new version as a tool for business improvement.
An ISMS compliance to these new requirements allows organisations to examine and control information security risks, threats and vulnerabilities based on their business processes and not based on information assets as recommended in the old version.
The training is an introduction for anyone involved in the development, implementation and management of an ISMS based on ISO 27001. If you plan to complete other ISMS training, such as Internal Auditor and the Lead Auditor Training, you will receive during this training the knowledge and understanding of ISO 27001 upon which to build auditing skills. This training is also suitable for those organisations who wish to embark fresh for the first time to the new version.
The training comprises presentations and workshop exercises.
Course Outline
Introduction to Information Security Management System(ISMS) 4 hours
- What is ISMS?
- History of ISMS?
- Why use ISMS?
Overview of ISO/IEC 27001:2013 standard 4 hours
- The Two parts of ISO 27001& 27002
- The Clause 4 to Clause 8 of the standard explained in detail
- Fundamental differences between 2005 and 2013 version
Implementing ISMS using ISO/IEC 27002 4 hours
- Risk assessment methodology based on ISO 31000
- Detailed explanation of the implementation methodology
- Selection of controls and necessary documentation
Management advantages and benefits of using ISMS 3 hours
- Internal audits
- Corrective & Preventive actions
- Measurements and analysis of ISMS performance
- Continual improvements
Course Objectives
At the end of the course, the participants should be able to:
- Define a risk management strategy appropriate to your own organization based on ISO 31000
- Understand the different stages of risk assessment – the activities, the contributors and the deliverables;
- Produce a system for classifying information systems;
- Understand the main components of an information classification scheme
- Risk Assessment Template & Risk Register
- Select the appropriate security controls based on the risks assessed using ISO 27002
Schedule (Risk Assessment Method)
- Introduction to ISO 31000 Risk Management and Objectives ½ hour
- Risk Domain Identification, Risk assessment methodology 1 hour Exercise 1 hour
- Existing Risk Assessment Concept, Types of Risks and classification ½ hour
Exercise ½ hour
- Determination (CIA in Risk Assessment): 1 hour
- Confidentiality
- Integrity
- Availability
(All based on the assets Identified)
- Risk Calculation Exercise 1 hour
Lunch Break
- Critical Information and Asset Valuation (Current Assets Identified) 1 hour
- Facilitated Compliance/Threat/Vulnerability/Impact Analysis
- Degree of Assurance Determination (Risk Prioritisation)
- Template Presentation
Exercises 1 ½ hours
Course Objectives
At the end of the course, the participants should be able to:
- Learn the 4 ways on how to treat risks
- Learn the ISO 27002 standard
- Learn the different nature of controls (Physical, Process, Technical)
- Learn about the different types of controls (Detective, Preventive and Reactive)
- Understand the control objectives
- Learn to choose the appropriate controls from the 133 listed controls
Schedule (Selection of Controls Workshop)
- Risk Treatment options ½ hour
- Nature of Controls ½ hour
- Types of Controls ½ hour
- Control Objectives as stated in ISO 27002 1 ½ hours
Lunch Break
- 114 controls discussed in detail from Annex A 1 ½ hours
- Selection of Appropriate controls Exercise 2 hours
- Presentation 1 hour
- Sample templates explained ½ hour
Programme scope, delivery arrangements and suitability are confirmed during enquiry.