Duration
3 days
Introduction
Information is a valuable asset for an organization. Securing Information of all types throughout its lifecycle is a multifold challenge. Technology alone is not sufficient to implement robust Information Security Program for an organization. Technology has to be backed by People and Processes and driven by management framework to reap the benefits of Information Security initiatives.
The workshop-based training teaches participants the necessary steps for implementation of information security management system based on ISO 27001:2013 requirements.
Benefits
- Create the framework for your own Information Security Management System (ISMS)
- Gain knowledge to develop your ISMS framework and build awareness and support for information security across your organisation
- Be confident that you have the capability to protect your business and meet stakeholder expectations
Objectives
On training completion you will be able to:
- Understand requirements of ISO 27001:2013
- Understand issues and interested parties requirements
- Develop scope for ISO 27001 and policy
- How to identify information assets and information risk ownership
- How to identify threats, vulnerabilities and impacts
- Conduct Risk Assessment
- Prepare Risk Treatment plans
- Prepare Statement of Applicability
- Develop ISMS implementation plan
Who should attend?
This course is recommend the course to those who are responsible for implementing ISMS within their organization that may include
- Information Security Manager/Executive
- Information Security Auditors,
- Data center manager/engineers
- Project Managers
Prerequisite
*Participants must have attended ISO/IEC 27001:2013 Awareness course
Course Content
- Introduction to ISO 27000 family
- The ISO 27001:2013 Clauses and Annexure – A
- Determine context and identify interested parties requirements
- Determination of Scope and Develop ISMS Policy
- Defining risk assessment approach
- Identify, Analyze and evaluate risks
- Identify and evaluate options for risk treatment
- Selecting controls and preparing SOA (Statement of applicability)
- Information security objectives setting and plans to achieve it
- Documented information requirements
- Implement and Operate ISMS
- Performance evaluation
- internal audits,
- management reviews
- measurements and monitoring
- Improvement of ISMS
- Developing ISO 27001:2013 implementation plan
Course Delivery
Competency-based workshops combining lectures, discussions & exercises.
Programme scope, delivery arrangements and suitability are confirmed during enquiry.