Duration

5 days (Two-day Training & three-day Knowledge Sharing/Simulation Program)

Introduction

The three-day workshop-based training provides participants the knowledge and skills to plan, conduct, report and follow up an internal audit of an information security management system based on ISO/IEC 27001:2013, ISO/IEC 27017 and in accordance with ISO 19011. Internal audit is a mandatory requirement as per Clause 9.2 of ISO/IEC 27001:2013. It covers the aspects of how to perform audit using the ISO/IEC27017 requirements.

Objectives

By the end of the training, participants will be able to:

Understand the requirements of ISO/IEC 27017 as part of controls in ISMS ISO 27002
Develop personal skills & knowledge required to conduct the internal audit
Apprehend the internal audit activities
Understand the method of conducting audit for the CSP or any intended parties such as cloud broker, cloud data processor etc. in compliance to ISO/IEC 27017.
Develop checklist for audit by defining such questionnaires, aspects to ask during audit and simplify ISO requirements (simplify, understood by CSP) and relevant information that able to assist in creating the checklist.
Develop techniques to collect and record audit evidence
Write an effective non-conformity (NCR)
Learn how to prepare Internal Audit Report

Who should attend?

This course is recommend the course may be beneficial to auditors who want to conduct cloud security audits, those who want to obtain competence in cloud security audit process

Pre-requisite

It is recommended that participants attend the ISO/IEC 270001:2013 Foundation (Awareness)

Course Delivery

Competency-based accelerated learning techniques combining lectures, discussions and workshops. The trainer will coach the participants through the whole process of internal audit from auditing, identifying and recording non-conformities (NCs), issuing the Corrective Action Request (CAR) until the stage at follow-up of Corrective Action.

Course Outline

Introduction to Auditing

Types of audits
Internal Audit
Type of Audit

Internal Auditor Competencies

Competence of Auditor
Desired behavior for auditors

Internal Audit Planning

Preparing Audit Programme and Audit Plan
Preparation of Audit Checklist

Internal Auditing Process

Process Audit Approach
Auditing Techniques (Interviewing/Observing/Verifying)
Collecting and recording Audit Evidence (Conformance & Nonconformance)

Cloud Computing Overview:

Deployment Models
Service Delivery

Fundamental Cloud Security Concepts

Cloud Security – CIA Triad

Major threats and vulnerabilities

Security considerations
Threats for service providers
Threats for service customers
AAA, or Authentication, Authorization & Accounting
Encryption and Cryptography
Shared Responsibility Model

Auditing controls:

Information security policies
Organization of information security
Human resource security
Asset management
Access control
Cryptography
Physical and environmental security
Operations security
Communications security
System acquisition, development and maintenance
Supplier relationships
Information security incident management
Information security aspects of business continuity management
Compliance

Auditing ISO/IEC 27017 control:

Access control
Operations security
Communications security
Supplier relationships
Compliance
Human resource security
Asset management
Physical and environmental security

Performing Audit

What to review on the CSP SOP?
What to check on the CSP Operations?
What to inspect in the CSP Infra?
Whom to call for interview from the CSP?
Should have a site visit to CSP datacentre?
Other relevant inquiries relevant to the audit.

Audit Findings Classification (Major/Minor Non-conformance)

Managing Corrective Action Request:

Issuance of Non-Conformance (NC)
Preparation of audit report
Investigation of root causes

Programme scope, delivery arrangements and suitability are confirmed during enquiry.