ISO 27001:2013-Compliant Cybersecurity: Getting Started

Course details

If you’re an information security manager, your day-to-day work life depends on meeting recognized standards of practice. In this new two-part course, instructor Marc Menninger takes a closer look at what the ISO 27001 standard is and why it’s used around the world to build information security programs that work.

Discover why the ISO 27001 standard is one of the most popular frameworks for building effective cybersecurity programs. Learn what it takes to comply with and become certified as compliant with the standard. Find out how the standard is organized, get a description of the certification process, and explore an easy-to-follow, step-by-step plan for building a cybersecurity program that’s ISO 27001-compliant as defined by clauses four through ten. Along the way, Marc gives you handy reference documents and checklists that you can use to retain what you learn and track your compliance progress.

Concepts

0. Introduction

01 - The international standard for information security
02 - Who this course is for and prerequisites

1. ISO 27001 Overview

03 - What is the ISO 27001 standard
04 - Breaking down the ISO 27001 standard
05 - Why build an ISO 27001-compliant cybersecurity program
06 - ISO 27001 gaps and criticisms

2. Complying with ISO 27001

07 - ISO 27001 compliance and certification
08 - What to expect when getting ISO 27001 certified
09 - Building your ISO 27001 compliance plan
10 - Begin the ISO 27001 compliance process - Introduction to Clauses 4 through 10

3. Context of the Organization (Clause 4)

11 - Context of the organization and needs of interested parties (Clauses 4.1 and 4.2)
12 - The Information security management system (ISMS) and its scope (Clauses 4.3 and 4.4)

4. Leadership (Clause 5)

13 - Leadership and commitment (Clause 5.1)
14 - Policy (Clause 5.2)
15 - Organizational roles, responsibilities, and authorities (Clause 5.3)

5. Planning (Clause 6)

16 - Information security risk assessment (Clause 6.1.2)
17 - Information security risk treatment (Clause 6.1.3)
18 - Information security objectives and planning to achieve them (Clause 6.2)

6. Support and Operation (Clauses 7 and 8)

19 - Resources, competence, and awareness (Clauses 7.1, 7.2, and 7.3)
20 - Communication (Clause 7.4)
21 - Documented information (Clause 7.5)
22 - Operational planning and control, risk assessment, and risk treatment (Clauses 8.1, 8.2, and 8.3)

7. Performance Evaluation and Improvement (Clauses 9 and 10)

23 - Monitoring, measurement, analysis, and evaluation (Clause 9.1)
24 - Internal audit (Clause 9.2)
25 - Management review (Clause 9.3)
26 - Corrective action and continual improvement (Clause 10)

Conclusion

27 - Next steps to take with ISO 27001