PART I – OVERVIEW OF TOPICS

1. Introduction – Information Security Management System in accordance with the requirements of ISO 27001:2023
   • Overview of the responsibilities and powers of the Information Security Management System Representative
   • Organisational Context
   • Leadership
   • Planning
2. Risk Analysis
   • Risk Analysis and Risk Treatment

Exercise 1: Engaging training participants in exercises to understand a practical approach to risk analysis: how do we quantify risk within our organisation? How do we verify that risks have been correctly identified?

PART II

1. Overview of the standard’s requirements – clauses 4–10
   • Organisational context
   • Identification of internal factors
   • Identification of external factors
   • Identification of stakeholders’ needs and requirements
   • Establishment of a management system based on the requirements of ISO 27001:2023
2. Overview of controls from Annex A
   • Definition of security and scope of the system
   • General principles
   • Information security organisation
   • Asset and risk management
   • Human resources security – staff competencies, training and awareness
   • Physical and environmental security
   • Systems and network management
   • Access control
   • Procurement, development and maintenance of information systems
   • Relationships with suppliers
   • Incident management
   • Business continuity management
   • Compliance

Exercise 2: Engaging training participants in exercises to understand what lies behind the clauses of the standard. How to implement security measures so that they meet the requirements of the standard?

PART III

1. Presentation of the role, responsibilities and tasks of the ISMS Representative
   • Performance evaluation
   • Monitoring, measurement, analysis and evaluation
   • Internal audit
   • Management review

Exercise 3: Engaging training participants in exercises designed to help them understand how to measure security measures.

2. Presentation of the role of the Auditor in the Information Security Management System
   • Introduction to the subject of internal audits, including essential terminology
   • The role of the auditor within the organisation

Exercise 4: Engaging training participants in exercises designed to help them understand how to plan and manage audits, and what to look out for.