Leading an ISO/IEC 27001 project: the road to certification
You lead an ISO/IEC 27001 project end to end: business case, project plan, gap analysis, implementation waves, stage 1 and stage 2 certification audits, surveillance audits and scope extension.
Level 401 · 16 lessons · 15 practice labs
Lessons
Setting up the project
- The business case and management support
- Project plan, team and budget
- The initial gap analysis
- Quick task: a project charter
Implementation
- Implementation waves and prioritisation
- Integrating with existing processes
- Evidence readiness and the pre-audit
- Quick task: an implementation progress tracker
Certification
- Choosing a certification body and accreditation
- The stage 1 audit
- The stage 2 audit
- Dealing with a major nonconformity
- Quick task: a response plan for stage 1 findings
After certification
- Surveillance and recertification
- Extending scope and integrating ISO/IEC 27701 and ISO 22301
- Capstone: a twelve-month certification project plan and risk register
Practice labs
- Find what the business case lacks: Mark which of benefits, costs, risks and options are missing from a certification business case.
- Write a project charter: Write a charter for Göktaşı Yazılım's certification project with purpose, scope, sponsor, team, budget and success criteria.
- Build the budget and resource plan: Prepare a budget spreading internal effort, consultancy, tools and certification fees over the months, plus a workload table per role.
- Summarise the gap analysis result: From a hundred-row gap table, calculate the fulfilment rate per clause and per theme.
- Plan the implementation waves: Split forty gaps into three implementation waves by dependency and risk and justify the order.
- Integrate with existing processes: For a company with quality and service management processes, write ten processes that can be reused and the adaptation each needs.
- Update the progress tracker: Update the status of thirty work items from weekly notes and mark the late ones.
- Check evidence readiness: Scan the evidence folder for twenty controls and list missing, stale and out-of-period evidence.
- Decide from the pre-audit results: From a pre-audit report, write a reasoned decision to go to the certification audit, postpone or proceed with conditions.
- Compare certification body offers: Compare three offers by accreditation, auditor days, sector experience and total cost.
- A response plan for stage 1 findings: Write a plan with action, owner and a date before stage 2 for eight areas of concern in the stage 1 report.
- Respond to a major nonconformity: For a major nonconformity that no internal audit was held, write the correction, root cause, corrective action and evidence plan.
- Put the three-year cycle on a calendar: From the certificate date, calculate the surveillance and recertification audit dates and when preparation starts.
- Assess a scope extension: Write the effect of adding a new office and a product to scope on the risk assessment, the SoA and audit time.
- A twelve-month project plan and risk register: Prepare a plan with milestones to certification, the critical path and ten project risks with their responses.
About this course
You lead an ISO/IEC 27001 project end to end: business case, project plan, gap analysis, implementation waves, stage 1 and stage 2 certification audits, surveillance audits and scope extension.
What you will learn
- Setting up the project
- Implementation
- Certification
- After certification
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.