OpenCourser
Learn skills that shape your future
Visit OpenCourser.com
What is ISO/IEC 27001 and why it matters?
ISO/ It demonstrates an organization’s ability to safeguard information with robust controls, ensuring trust and reliability.
What is ISO/IEC 27001 and why it matters?
ISO/ It demonstrates an organization’s ability to safeguard information with robust controls, ensuring trust and reliability.
Global leaders like Google, Apple, Adobe, Oracle, and countless other tech corporations, financial institutions, healthcare providers, insurance companies, educational institutions, manufacturers, service companies, government agencies, and businesses of all sizes have implemented and certified Information Security Management Systems (ISMS) according to ISO/IEC 27001. This showcases their commitment to protecting the confidentiality, integrity, and availability of the information they handle.
Course Overview
My course delves into the management system requirements of ISO/IEC 27001:2022, along with the information security controls from the standard's annex (Annex A). This comprehensive guide will help you understand how to implement an ISMS, meet the necessary requirements and achieve compliance.
The course is structured into 6 sections:
- the first section is an introduction to the concept of information security and to this standard, ISO/IEC 27001. Among other aspects the introductive part addresses the following subjects: what represents an ISMS (Information Security Management System), what is the purpose of ISO/
- the second section of the course is about the management system requirements of ISO/IEC 27001:2022. The course follows the structure of the standard, covering all the requirements in each clause and sub-clause. The context of the organization, the scope of the ISMS, information security risk assessment and risk treatment, the information security objectives, the documentation of the ISMS, the internal audit of the ISMS, the management review, the information security policy or the management of nonconformities are among the subjects covered by this second section of the course.
- the third, fourth, fifth and sixth sections are all about the information security controls from Annex A of ISO/IEC 27001:2022. There are 93 controls divided into 4 themes: Organizational controls (section 3 of the course), People controls (section 4), Physical controls (section 5) and Technological controls (section 6). The information security controls to be discussed cover, among others, subjects like incident management, supplier relationships, network security, business continuity and ICT readiness, equipment maintenance, storage media, the development of software and systems, the use of cryptography, authentication information, the screening of candidates for employment, the disciplinary process, change management, backup and redundancy, malware protection and technical vulnerability management, logging and monitoring, information security awareness and training, requirements for user end-point devices, capacity management, access privileges, protection against environmental threats, cabling security or secure coding.
If you are interested in the certification to ISO/
After going through all the videos of this course you will have a good understanding of what are the requirements for an information security management system and how an organization can apply such a system and claim conformity to ISO/IEC 27001:2022.
The information will be very useful to you if you:
- work as a consultant helping organizations apply standards and implement management systems;
- participate in audits (internal or external audits) in accordance with ISO/IEC 27001:2022;
- work in a company that applies or intends to apply an information security management system;
- have an interest in information security management in general;
- are looking to build a career in information security.
If none of the options above suits your profile you can use the information in my course for awareness on information security and you will have a good image of the requirements that many organizations around the world have decided to adopt.
This course provides 7 hours of condensed information that you can revisit anytime you need and once you finish it you can prove your knowledge in the field of information security management with the certificate issued by Udemy.
*The course is updated to account for the 2024 Amendment to ISO/IEC 27001:2022 about climate change.
Generic information about the this course and its structure.
About the concept of information security and the three constitutive properties of information security - Confidentiality, Integrity and Availability (the so-called CIA triad). About information security management.
What represents an ISMS and why would an organization be interested in applying a management system to coordinate its information security activities. About the principles that contribute to the succesful implementation of an information security management system in an organization.
About other standards in the ISO/IEC 27000. Examples of relevant standards for information security management, what they refer to and how they can be useful to an organization.
A short history of ISO/IEC 27001. What is the purpose of this standard and who are its intended users. About the structure of ISO/IEC 27001:2022 and the relationship with ISO/IEC 27002:2022.
About the internal and external issues that are relevant for the purpose of an organization and that influence its ISMS. Examples of internal and external issues.
About the stakeholders (or interested parties) that are relevant to an organization and to its ISMS. Examples of interested parties and their requirements.
About what represents the scope of the ISMS. What should be included in the scope and if its possible for the ISMS scope to change in time.
How to get the most benefits from the application of an ISMS. A recapitulation of the requirements in clause number 4 of ISO/IEC 27001:2022 (Context of the organization).
About the 2024 Amendment to ISO/IEC 27001:2022 (Climate action changes). Examples of how climate change can impact an organization's information security performance and its management system
About how critical it is for the ISMS to receive adequate support from the top management. What is the top management expected to do to demonstrate its leadership and commitment.
About the information security policy. The requirements in ISO/IEC 27001 on what the policy should include and how it should be communicated inside the organization.
About the people in charge with the ISMS and what their responsibilities and authorities should be. A recapitulation of the requirements in clause 5 of ISO/IEC 27001:2022 (Leadership)
About the risks and opportunities in relation to the ISMS. Some examples of risks and opportunities. About how is the organization expected to treat the risks and oportunities that relate to its ISMS.
Basic considerations about risk management. Examples of threats and vulnerabilities. A detailed presentation of the process for the information security risk assessment required by ISO/IEC 27001:2022. An example of consequences and probability matrix.
Requirements for the risk assessment process. Different approaches for risk identification (event-based approach and asset-based approach). About risk owners. About the risk analysis and risk evaluation as steps of the risk assessment process.
About the different options available for risk treatement and the classification of controls (preventive, detective and corrective).
Generic information about the security controls from Annex A of ISO/IEC 27001:2022. About the Statement of applicability and its purpose. What information should be included in the Statement of applicability. About the risk treatment plan. About residual risk and how it should be managed.
About objectives for information security management and how the organization should plan to achieve them. About the requirements of ISO/IEC 27001:2022 for objectives.
About managing changes to the ISMS plus a recapitulation of the requirements in clause 6 of ISO/IEC 27001 (Planning).
About the resources needed for the implementation, maintenance and continual improvement of the ISMS.
The process required by ISO/IEC 27001:2022 for ensuring competence.
About the importance of awareness for information security. How an organization can raise the awareness of its people on information security matters. What does ISO/IEC 27001:2022 require to be part of awareness activities.
About internal and external communications relevant for information security. What is the organization required to do in relation to its communication processes.
About the documentation that supports the ISMS. What documents should be part of the ISMS and what is the process for creating and updating ISMS documents according to ISO/IEC 27001:2022
About the controls that the organization should apply for the ISMS documentation and a recapitulation of the requirements in clause 7 of ISO/IEC 27001:2022 (Support).
About implementing the processes determined as necessary for treating risks and opportunities and achieving information security objectives. About managing changes so that the negative impact on information security will be minimized. About managing the relationships with external providers.
About conducting periodic risk assessments and after each iteration of the risk assessment process updating the risk treatment plan. A recapitulation of the requirements in clause 8 of ISO/IEC 27001:2022 (Operation).
About the requirements in ISO/IEC 27001 that refer to monitoring and measuring the information security performance and the ISMS, analyzing and evaluating the results. About the difference between monitoring and measurement.
About the internal audit of the ISMS. About the internal audit programme, requirements for auditors, audit objectives, scope and criteria or documents used for auditing (plans, reports, checklists, etc).
About the requirements for the management review. What are the input elements to the management review and what should the results of the review refer to. A recapitulation of the requirements in clause 9 of ISO/IEC 27001:2022 (Performance evaluation).
About the requirements of ISO/IEC 27001:2022 for improving continually the ISMS and the information security performance of the organization. Some examples of what can be considered improvements to the ISMS.
About the process required by ISO/IEC 27001:2022 for managing nonconformities in the ISMS. About corrections and corrective actions. Examples of nonconformities and a short recapitulation of clause 10 of ISO/IEC 27001:2022 (Improvement).
Generic information about the information security controls from Annex A of ISO/IEC 27001:2022. About the 4 themes of information security controls.
About topic-specific policies for information security management. About roles and responsibilities in relation to information security. About the principle of duties segregation, what is its purpose and how it can be applied.
About the need for the organization to maintain contacts with the relevant information security authorities and with specialized interest groups for information security.
About collecting information from adequate sources to produce threat intelligence and about considering information security as in integral part of any projects undertaken by the organization.
About the inventory of assets and what such an inventory should include. About "owning" assets. About establishing rules for the acceptable use of information and assets and about the process of returning assets belonging to the organization when the employment or contract is terminated.
About the classification of information. What is its purpose and examples of classification schemes that an organization may adopt. What is the purpose of information labelling and how it can be implemented.
About protecting information that is transferred using different channels including the electronic transfer of information, the transfer of information on storage media and the verbal transfer of information.
About the requirements for controlling access to information and assets. Principles for access control and possible solutions for the implementation of access control rules.
About managing identities throughout their entire life cycle. About authenticating users who request access to information and the password management system. About the provision, review, modification or removal of access rights.
About the topic-specific policy on supplier relationships. About the aspects that the organization should consider for inclusion in its agreements with suppliers, from an information security perspective.
About the need for the organization to propagate its information security requirements throughout the supply chain and to be able to trace critical products that have an impact on information security.
About the aspects that the organization should consider for monitoring in relation to the information security practices of its suppliers.
About the aspects that an organization should consider for the acquisition, use, management and exit from cloud services, so that information security will not be affected.
About the process of planning and preparation for dealing with information security incidents. About assessing information security events and about the response to security incidents.
About using the experience obtained from managing information security incidents for education purposes. About collecting evidence whenever information security events occur.
About considering information security as an integral part of business continuity preparations, determining and meeting the relevant ICT continuity requriements.
About identifying and maintaining up to date the relevant requirements that relate to information security. Ensuring compliance with legal, regulatory, statutory and contractual requirements.
About identifying and meeting the requirements that refer to intellectual property. About protecting records in accordance with the legislation and regulations. About the identification of the relevant privacy requirements.
About reviewing independently the approach to information security, including people, processes and technologies. About the need for managers to review compliance with policies, rules and standards for information security in their areas of responsibility.
About documenting and making available to personnel operating procedures for information processing facilities. Situations for which the organization should consider documenting procedures.
About the investigation that should be conducted before hiring a person or transferring it to a new position. What is the screening process expected to cover. About including information security requirements in the terms and conditions of employment.
About providing adequate awareness on information security matters to all those working for the organization. About the process to be applied for cases where personnel do not follow the organization's rules and procedures.
About how the termination of employment should be handled to avoid negative consequences from an information security perspective. About managing changes to employment.
About the information security impact of remote working and what the organization should consider if its personnel work from locations outside its control.
About the process that should be applied for reporting information security events
About what are phyiscal security perimeters and what is their purpose. About securing entries to buildings and about preventing the unauthroized access to rooms, offices or facilities
About monitoring premises for unauthorized physical access. About protecting against environmental threats and man-made events that may affect an organization.
About secure areas and what precautions should be applied for working in secure areas. About the rules for clear screen and clear desk.
Security requirements for the positioning of equipment and for protecting equipment considering the applicable risks. About the requirements for taking assets off-site and for those assets that are intended to work off-premises.
About the requirements for protecting information that is stored or transferred using storage media.
About preventing information security issues caused by problems in the functioning of utilities. About protecting cables carrying power and data from interference, interception or damage.
About maintaining equipment to ensure its proper functioning. About the requirements that should be complied with whenever equipment is to be disposed of or re-used for other purposes.
About the requirements in relation to the end point devices used by the organization's personnel including requirements for using personal devices for work purposes (BYOD).
About managing privileges so that information security breaches are prevented. About the requirements for restricting access to information. About the requirements for restricting the access to program source code.
About the requirements for secure authentication technologies that the organization should consider, depening on the information that it needs to protect and the risks involved.
About the requirements to monitor the use of resources and to make projections of future resources use to avoid availability issues due to insufficient capacity.
About what can be considered adequate malware protection. About how the organization should manage the technical vulnerabilities of the systems it uses.
About keeping assets in a desired consistent state, working as intended, with the appropriate security settings and features with capacity management. About ensuring that any information on storage media is securely deleted when no longer needed.
About protecting sensitive information with masking techniques such as psedunymization or anonymization. About the process to prevent information leakage.
About backup requirements and the topic-specific policy on backup. About ensuring sufficient redundancy for information processing facilities, considering the availability requirements.
About producing, storing, protecting and analyzing logs that record activities, exceptions, faults and other relevant events.
About monitoring networks, systems and applications for anomalous behavior and about synchronizing the clocks of information processing facilities to the same time source.
About controlling the use of privileged utility programs. About the restrictions that should be applied for the installation of software on operational systems.
Generic provisions about securing networks and network devices
About the requirements for the organization to monitor the network services from internal or external providers. About segregating networks into network domains for improved security.
About managing the access of personnel to external websites and reducing the exposure to malicious content.
About the different uses of cryptography for protecting information. About the management of cryptographic keys.
About the rules that the organization should apply for the secure development of software and systems. About the security requirements for the different types of applications that an organization may develop or acquire.
About secure engineering principles and guidelines for their establishment
About the requirements for establishing secure coding principles to software development. About the security testing of software and systems.
About the security requirements that the organization should consider when it outsources system or software development.
About the requirements for separating environments and the purpose of separating development, testing and production environments.
About managing changes to information processing facilities so that any unwanted consequences for information security are avoided
About protecting the information used for test purposes. About planning and executing audit and other assurance activities in such a way so that the impact on the organization's operations is minimized.
About the certification for organizations and for persons to ISO/IEC 27001
SaveOpenCourser helps millions of learners each year. People visit us to learn workspace skills, ace their exams, and nurture their curiosity.
Our extensive catalog contains over 50,000 courses and twice as many books. Browse by search, by topic, or even by career interests. We'll match you to the right resources quickly.
Find this site helpful? Tell a friend about us.
We're supported by our community of learners. When you purchase or subscribe to courses and programs or purchase books, we may earn a commission from our partners.
Your purchases help us maintain our catalog and keep our servers humming without ads.
Thank you for supporting OpenCourser.
