Implementing ISO/IEC 27001: building an ISMS
You apply the clauses of ISO/IEC 27001:2022 step by step and build a working ISMS with scope, context, risk assessment, Statement of Applicability, documents, internal audit and management review.
Level 201 · 23 lessons · 21 practice labs
Lessons
Knowing the standard
- The ISO/IEC 27000 family
- The structure: clauses 4–10 and Annex A
- Plan, do, check, act
- Quick task: map clauses to activities
Context and leadership
- Context: internal and external issues
- Interested parties and their expectations
- Defining the ISMS scope
- Leadership and the information security policy
- Information security objectives
- Quick task: write a scope statement
Risk and controls
- The risk assessment methodology
- Running the risk assessment
- Preparing the Statement of Applicability
- The risk treatment plan
- Quick task: SoA entries for ten controls
Support
- Documented information and document control
- Competence, awareness and communication
- Quick task: a master document list
Performance and improvement
- Monitoring and measurement
- The internal audit programme
- Management review
- Nonconformity and continual improvement
- Capstone: an ISMS pack for a software company
Practice labs
- Match the clause to the activity: Match twelve activities to clauses 4 to 10 of ISO/IEC 27001.
- Place activities in the PDCA cycle: Place fifteen management system activities in the plan, do, check and act stages and name the stage that is missing.
- Pick the right standard from the family: For eight needs, pick the fitting standard from the 27000 family (27001, 27002, 27005, 27017, 27018, 27701) and justify it.
- Sort internal and external issues: Classify fifteen issues as internal or external.
- Fill in the interested parties table: For Göktaşı Yazılım, write the expectations of eight interested parties and the requirement each one turns into.
- Derive risks and opportunities from context: From a logistics company's context analysis, derive five risks and three opportunities for the management system and tie each to an action.
- Find what the scope statement lacks: Assess three scope statements for location, process, system and exclusions and mark the missing elements.
- Write a scope statement: Write a scope statement covering interfaces and dependencies for a software company with two offices and cloud infrastructure.
- Write measurable security objectives: From the general statements of a security policy, derive five objectives with a metric, target value, owner and date.
- Find the missing element of the methodology: Check a risk assessment methodology document for scales, acceptance criteria, ownership and repeatability.
- Prepare the risk treatment plan: Write a treatment plan with control, owner, resources and date for eight risks above the acceptance criteria.
- Submit residual risk for approval: For three risks still above the criteria after treatment, write the acceptance rationale and monitoring conditions to put to the risk owner.
- Find the gap in the SoA row: Mark which of ten statement of applicability rows lack a justification, status or reference.
- SoA entries for ten controls: For a remote-working consultancy, write the applicability, justification and implementation status of ten Annex A controls.
- Reconcile the SoA with the treatment plan: Find the controls selected in the risk treatment plan but excluded in the SoA, and those in the SoA tied to no risk.
- Tidy the master document list: Fix a twenty-document list with missing versions, owners or review dates and mark the overdue ones.
- Find the document control faults: In a shared folder listing, find the unapproved versions, duplicate copies and links pointing to superseded versions.
- A competence matrix and awareness plan: Prepare a matrix for eight management system roles showing required competence, current state and the training that closes the gap.
- Tie each measurement to an objective: Match ten measurements to the security objective they serve and mark those that serve none.
- Draft the internal audit programme: Prepare an internal audit programme that spreads clauses and processes over a three-year cycle based on risk and past findings.
- Management review agenda and inputs: From the given audit results, measurements and incident summaries, prepare an agenda covering the required inputs and a draft of decisions.
About this course
You apply the clauses of ISO/IEC 27001:2022 step by step and build a working ISMS with scope, context, risk assessment, Statement of Applicability, documents, internal audit and management review.
What you will learn
- Knowing the standard
- Context and leadership
- Risk and controls
- Support
- Performance and improvement
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.