Shopping Cart  |  Live Chat  |  Contact Us  |  1-855-668-5858

27001 Implementer

The ISMS Lead Implementer Course

This five-day intensive course enables the participants to develop an expertise to support an organization in implementing and managing an Information Security Management System as specified in ISO 27001:2005.

Specific topics include risk management (based on ISO 27005), risk management plan, implementation, surveillance, re-examination and operation of an ISMS, continuous improvement of information security, management’s commitment, follow-up and review as well as an introduction to ISO 27001 audit certification.

In addition, the participant will be able to become proficient in the best practices in the implementation of information security control measures based on the eleven (11) ISO 27002 domains: security policy, organization of information security, asset management, human resources security, physical and environmental security, communications and operations management, access control, information systems acquisition, development and maintenance, information security incident management, business continuity management and compliance.

This training focused on practice falls in line with best practices in project management based on the Project Management Institute (PMI) and the International Project Management Association (IPMA) as well as the ISO 10006 standard, “Quality Control Project Management Guidelines.” It is fully compatible with the future ISO 27003 standard (guidelines for the implementation of an ISMS) and ISO 27004 (ISMS measures).

Learning Objectives

  • Understanding the application of an information security management system in the ISO 2701:2005 context.
  • Understanding the relationship between the information security management system, including the management of risks and controls, and the various stakeholders.
  • Mastering the concepts, approaches, standards, methods and techniques required in an effective
    management of an Information Security Management System
  • Acquiring the expertise to support an organization in implementing, managing and maintaining an ISMS as specified ISO 27001.
  • Acquiring the personal skills and knowledge necessary to advise an organization on the best practices in information security management.
  • Improve the capacity for analysis and decision making in a context of information security management

Who Should Participate?

  • Project manager or consultant wanting to support an organization in the implementation of an ISMS.
  • ISO 27001 auditor who wants to master the ISMS implementation process.
  • Person responsible for the information security or conformity in an organization.
  • Information security team member.
  • Expert advisor in information technology.
  • Technical experts wanting to prepare for an information security function or for an ISMS project management function

Educational approach.

This training is based on the alternation of theory and practice:

  • Sessions of lectures illustrated with examples based on real cases
  • Practical exercises based on a full case study including role plays and narrative presentation
  • Review exercises to assist the exam preparation
  • Practice test similar to the certification exam

Given the practical exercises, the number of training participants is limited

Course Overview:

Schedule by Day

Day 1: Introduction to the management of an Information Security Management System based on ISO 27001 and launching an ISMS

  • Introduction to management systems and the process approach
  • Presentation of the standards ISO 27001, ISO 27002 and ISO 27003 and regulatory framework
  • Fundamental principles in information security
  • Preliminary analysis and determining the level of maturity of the existing information security management system based upon ISO 21827
  • Writing the business case and preliminary design of the ISMS
  • Developing a project plan of compliance to ISO 27001
Day 2: Planning an ISMS based on ISO 27001

  • Defining the scope of the ISMS
  • Drafting the ISMS and information security policies
  • Selection of the approach and methodology for risk assessment
  • Risk management based on ISO 27005: risk identification, risk analysis and risk treatment.
  • Drafting the statement of applicability.
Day 3: Launching and implementing an ISMS based on ISO 27001

  • Implementation of a documentation management framework
  • Design of controls and writing procedures
  • Implementation of controls
  • Development of a training & awareness program and communicating about the information security
  • Incident management according to ISO 27035
  • Operations management of an ISMS
Day 4: Control, act and the certification audit of the ISMS according ISO 27001

  • Monitoring the ISMS controls
  • Development of metrics, performance indicators and dashboards in accordance with ISO 27004
  • ISO27001 internal audit
  • Management review of the ISMS
  • Implementation of a continuous improvement program
  • Preparing for the ISO 27001 certification audit
Day 5: Certification Exam

Examination and certification

The “ISO 27001 Lead Implementer” exam fully meets the requirements of the PECB Examination Certification Programme (ECP).

The exam covers the following competency domains:

Domain 1: Fundamental principles and concepts of information security

Domain 2: Information Security Control Best Practice based on ISO 27002

Domain 3: Planning an ISMS based on ISO 27001

Domain 4: Implementing an ISMS based on ISO 27001

Domain 5: Performance evaluation, monitoring and measurement of an ISMS based on ISO 27001

Domain 6: Continuous improvement of an ISMS based on ISO 27001

Domain 7: Preparing for an ISMS certification audit

The “ISO 27001 Lead Implementer” exam is available in different languages (the complete list of languages can be found in the examination application form)

Security Blog

Understanding Risk - A 5-step risk management strategy

So, what is risk? What does it mean? We can define risk as the possibility that bad, unplanned or unexpected things happen. It implies,...

A Dike and Three Dutch Boys…is this enough?

…Applying a triad methodology for risk management.

Similar to the Dutch boys and their dike, securing the barrier between your IT infrastructure and the rest...

Business Continuity – it’s not just for the big boys who can afford the big toys

For anyone with roots along the Gulf Coast - if have learned anything through the years, it’s that the impacts of weather can frequently...