PART I. OVERVIEW OF TOPICS

1. Introduction – Information Security Management System in accordance with the requirements of ISO 27001:2023
   • Overview of the responsibilities and powers of the Information Security Management System Representative
   • Organisational Context
   • Leadership
   • Planning
   • Interpersonal skills of the Quality System Representative
2. Risk Analysis
   • Risk Analysis and risk management approaches

Exercise 1: Engaging training participants in exercises to understand a practical approach to risk analysis: how do we quantify risk within our organisation? How do we verify that risks have been correctly identified?

PART II

1. Requirements of the ISO 27001 standard
   • Overview of the standard’s requirements – clauses 4–10
   • Discussion of the controls in Annex A

Exercise 2: Engaging training participants in exercises to understand what lies behind the clauses of the standard. How to implement controls so that they meet the requirements of the standard? 

PART III

1. An overview of the role, responsibilities and tasks of the ISO 27001 System Representative
2. Types of documented information
   • ISO 27001:2023 requirements regarding documentation
   • Developing and updating documented information
   • Control of documented information

Exercise 3: Training participants will be involved in determining the correctness of statements regarding the creation, updating and control of documented information, independently classifying documented information into controlled documents and records, and defining the objectives of proper system documentation management.

3. Performance evaluation
   • Monitoring, measurement, analysis and evaluation
   • Internal audit
   • Management review

Exercise 4: Engaging training participants in exercises to understand how to measure security measures.

4. Improvement process
   • Corrective and preventive actions
   • The role of the representative in improving the information security management system
   • Discussion of the assessment methods used during the certification audit

Exercise 5: Training participants will be involved in analysing potential non-conformities within the organisation. They will learn how to define and implement corrective actions.

PART IV

1. Simulations of scenarios encountered during certification audits
   • Discussion

Exercise 6: These simulations will familiarise training participants with how to behave in situations that may arise during an audit.

2. Summary of the training
   • Questions from participants