EIEIOTECHNOVATION
← Training programmes

EIEIO / CYBERSECURITY

ISOIEC27017 Information Security Controls for Cloud Services

Course outline

ISOIEC270172 days
Discuss this programme →

Duration

2 days

What is ISO/IEC 27017:2015 standard?

ISO/IEC 27017:2015 is a security control for cloud services and is an extension to ISO/IEC 27001 and ISO/IEC 27002. The standard advises on both the cloud service customers and cloud service providers. ISO 27017 is designed to help you and your organizations when selecting security controls for cloud services when implementing a cloud computing information security management system. As an extension to ISO 27002, ISO 27017 provides the guidance on 37 controls from ISO 27002.

Course Overview

This two-day course will highlight the importance of selecting security controls for cloud services when implementing a cloud computing information security management system.

This interactive training provides course will assist participants to understand how ISO/IEC 27017 supports with building a more effective ISO/IEC 27001 Information Security Management System (ISMS). It will provide excellent knowledge of the different cloud security controls and train how to ensure the appropriate ones are in place.

Course Objectives

On successful completion of this course the participants will be able to learn:

  • What is Cloud and the different types of cloud models?
  • Benefits of implementing ISO/IEC 27017:2015
  • Information security risks encounter in cloud services
  • Understand structure and controls applicable to cloud services based on ISO/IEC 27017:2015
  • Examine and select controls from ISO/IEC 27017:2015 based on risk assessment, through case studies
  • Understand the specific guidance for cloud service customers and cloud service providers

Training Style

This course is designed and delivered based on the competency-based training concepts, which includes lectures, group discussion, and workshops.

Who Should Attend?

This course is recommended for

  • Cloud service consumers or cloud service providers
  • IT managers responsible for delivering or running cloud-based systems
  • Chief Information Officers or delegates
  • Information Security Officers
  • Information Technology Professionals
  • Cloud/Information Security Auditor
  • Anyone who manage information security controls

Prerequisites

Participants should have a good knowledge of ISO/IEC 27002:2013 and ISO/IEC 27001:2013, as well as the key principles of an ISMS.

Introduction

  • What is the Cloud?
  • Types of clouds
  • Cloud Deployment models and service models
  • Benefits of cloud computing for customers and providers
  • Terms and Definitions
  • Implementation Framework using ISO/IEC 27001 ISMS
  • Roles and responsibilities CSP/CSC
  • Typical risks associated with cloud computing
  • Basics of ISO/IEC 27017
  • ISO/IEC 27017 requirements
  • introduction, scope and structure
  • Information security risk assessment
  • Information security policies
  • Organization of information security
  • Human resource security
  • Asset management
  • Access control
  • Cryptography
  • Physical and environmental security
  • Operations security
  • Communications security
  • System acquisition, development and maintenance
  • Supplier relationships
  • Information security incident management
  • Information security aspects of business continuity management
  • Compliance
  • Annex A Cloud Service Extended Control Set
  • Discussions

Programme scope, delivery arrangements and suitability are confirmed during enquiry.