Shopping Cart | Training Portal | Contact Us | 1-800-473-5181

27001 Implementer

The ISMS Lead Implementer Course

This five-day intensive course enables the participants to develop an expertise to support an organization in implementing and managing an Information Security Management System as specified in ISO 27001:2005.


Specific topics include risk management (based on ISO 27005), risk management plan, implementation, surveillance, re-examination and operation of an ISMS, continuous improvement of information security, management’s commitment, follow-up and review as well as an introduction to ISO 27001 audit certification.

In addition, the participant will be able to become proficient in the best practices in the implementation of information security control measures based on the eleven (11) ISO 27002 domains: security policy, organization of information security, asset management, human resources security, physical and environmental security, communications and operations management, access control, information systems acquisition, development and maintenance, information security incident management, business continuity management and compliance.

This training focused on practice falls in line with best practices in project management based on the Project Management Institute (PMI) and the International Project Management Association (IPMA) as well as the ISO 10006 standard, “Quality Control Project Management Guidelines.” It is fully compatible with the future ISO 27003 standard (guidelines for the implementation of an ISMS) and ISO 27004 (ISMS measures).

Learning Objectives

  • Understanding the application of an information security management system in the ISO 2701:2005 context.
  • Understanding the relationship between the information security management system, including the management of risks and controls, and the various stakeholders.
  • Mastering the concepts, approaches, standards, methods and techniques required in an effective
    management of an Information Security Management System
  • Acquiring the expertise to support an organization in implementing, managing and maintaining an ISMS as specified ISO 27001.
  • Acquiring the personal skills and knowledge necessary to advise an organization on the best practices in information security management.
  • Improve the capacity for analysis and decision making in a context of information security management

Who Should Participate?

  • Project manager or consultant wanting to support an organization in the implementation of an ISMS.
  • ISO 27001 auditor who wants to master the ISMS implementation process.
  • Person responsible for the information security or conformity in an organization.
  • Information security team member.
  • Expert advisor in information technology.
  • Technical experts wanting to prepare for an information security function or for an ISMS project management function

Educational approach.

This training is based on the alternation of theory and practice:

  • Sessions of lectures illustrated with examples based on real cases
  • Practical exercises based on a full case study including role plays and narrative presentation
  • Review exercises to assist the exam preparation
  • Practice test similar to the certification exam

Given the practical exercises, the number of training participants is limited

Course Overview:

Schedule by Day

Day 1: Introduction to the management of an Information Security Management System based on ISO 27001 and launching an ISMS

  • Introduction to management systems and the process approach
  • Presentation of the standards ISO 27001, ISO 27002 and ISO 27003 and regulatory framework
  • Fundamental principles in information security
  • Preliminary analysis and determining the level of maturity of the existing information security management system based upon ISO 21827
  • Writing the business case and preliminary design of the ISMS
  • Developing a project plan of compliance to ISO 27001
Day 2: Planning an ISMS based on ISO 27001

  • Defining the scope of the ISMS
  • Drafting the ISMS and information security policies
  • Selection of the approach and methodology for risk assessment
  • Risk management based on ISO 27005: risk identification, risk analysis and risk treatment.
  • Drafting the statement of applicability.
Day 3: Launching and implementing an ISMS based on ISO 27001

  • Implementation of a documentation management framework
  • Design of controls and writing procedures
  • Implementation of controls
  • Development of a training & awareness program and communicating about the information security
  • Incident management according to ISO 27035
  • Operations management of an ISMS
Day 4: Control, act and the certification audit of the ISMS according ISO 27001

  • Monitoring the ISMS controls
  • Development of metrics, performance indicators and dashboards in accordance with ISO 27004
  • ISO27001 internal audit
  • Management review of the ISMS
  • Implementation of a continuous improvement program
  • Preparing for the ISO 27001 certification audit
Day 5: Certification Exam

Examination and certification

The “ISO 27001 Lead Implementer” exam fully meets the requirements of the PECB Examination Certification Programme (ECP).

The exam covers the following competency domains:

Domain 1: Fundamental principles and concepts of information security

Domain 2: Information Security Control Best Practice based on ISO 27002

Domain 3: Planning an ISMS based on ISO 27001

Domain 4: Implementing an ISMS based on ISO 27001

Domain 5: Performance evaluation, monitoring and measurement of an ISMS based on ISO 27001

Domain 6: Continuous improvement of an ISMS based on ISO 27001

Domain 7: Preparing for an ISMS certification audit

The “ISO 27001 Lead Implementer” exam is available in different languages (the complete list of languages can be found in the examination application form)

ISO Locations *

This five-day intensive course enables the participants to develop an expertise to support an organization in implementing and managing an Information Security Management System as specified in ISO 27001:2005.

  • 27001 Auditor

    How many?

    This five-day intensive course enables participants to develop the expertise needed to audit an Information Security Manageme...

Security Blog

Does your smartphone app discover all your accounts?

There’s a chill in the air, and it’s not just the normal fall morning breeze. In the era of NSA Prism/Xkeyscore/whatnext surveillance, and...

Ethical implications of whistle blowing

(ISC)2 code of ethics; Protect society, the commonwealth, and the infrastructure. Act honorably, honestly, justly, responsibly, and legally. Provide diligent and competent service to principals. Advance and protect...

The Great ATM Heist - is it really newsworthy?

On Friday, May 10, we saw many headlines about the latest great ATM bank robbery. Apparently these types of attacks are being regarded as...