Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO/IEC 27001 Information Security Management System Auditor Training has been designed to train auditors who can assess the conformity, implementation and effectiveness of Information Security Management Systems, examine information security risks and controls based on objective evidence, and conduct systematic management system audits.
The training is based on the current ISO/IEC 27001:2022 and ISO/IEC 27001:2022/Amd 1:2024 requirements, together with the guidance in ISO 19011:2026 for management system audits. ISO/IEC 27007:2020 is taken into account specifically for Information Security Management System audits, while the requirements of ISO/IEC 27006-1:2024 are considered for third-party certification audits.
The language of the training is Turkish. The training is delivered online.
About the Training
The training covers the structure of the ISO/IEC 27001 standard; the context of the organisation; leadership; information security policy; risk assessment and risk treatment; information security objectives; competence and awareness; operational planning; performance evaluation; the Statement of Applicability (SoA); Annex A controls; information security incident management; continual improvement; audit principles; audit programme management; the risk-based audit approach; audit planning; the evaluation of technical and documented evidence; interviewing and sampling techniques; the formulation of audit findings; the reporting of nonconformities; and the follow-up of audit results.
Who Should Attend?
- ISO/IEC 27001 auditors and auditor candidates
- Information security management system professionals
- Information security and cybersecurity personnel
- Management system auditors
- Auditors working for certification bodies
- Information technology and infrastructure teams
- Risk and compliance professionals
- Data protection and privacy personnel
- System, network and security administrators
- Professionals wishing to take part in ISO/IEC 27001 audits
Objectives and Outcomes
The aim is to enable participants to interpret the requirements of ISO/IEC 27001 correctly, assess organisations’ Information Security Management Systems based on risk and objective evidence, examine the implementation and effectiveness of information security controls, plan and conduct audits in accordance with the principles of ISO 19011:2026, and report audit findings professionally.
By the End of the Training
Participants will be able to:
- Explain the purpose, scope and structure of the ISO/IEC 27001 standard.
- Interpret Information Security Management System requirements from an auditor’s perspective.
- Assess the organisation’s context and relevant interested parties.
- Audit information security policies, roles and responsibilities.
- Examine information security risk assessment and risk treatment processes.
- Evaluate information security objectives and performance indicators.
- Audit the Statement of Applicability (SoA).
- Evaluate the selection and implementation of Annex A controls.
- Examine organisational, people, physical and technological controls.
- Evaluate the management of information security incidents.
- Determine audit objectives, scope and criteria.
- Prepare a risk-based audit plan.
- Prepare audit checklists and working documents.
- Manage opening and closing meetings.
- Apply interview, observation, document review and sampling techniques.
- Evaluate technical and documented objective evidence.
- Write audit findings and nonconformities correctly.
- Evaluate the adequacy and effectiveness of corrective actions.
- Prepare an audit report and manage follow-up activities.
Programme and Method
Training Topics
- Introduction to the ISO/IEC 27001 Standard and Information Security Management System
- Core Principles of Information Security: Confidentiality, Integrity and Availability
- Context of the Organisation, Interested Parties and Leadership
- Information Security Policy, Roles and Responsibilities
- Information Security Risk Assessment and Risk Treatment
- Information Security Objectives and Planning
- Competence, Awareness, Communication and Documented Information
- Operational Planning and Information Security Processes
- Statement of Applicability (SoA) and Annex A Controls
- Organisational, People, Physical and Technological Controls
- Information Security Incident Management and Business Continuity
- Performance Monitoring, Measurement and Continual Improvement
- ISO 19011:2026 Auditing Principles and Auditor Competence
- ISMS Audit Approach under ISO/IEC 27007
- Overview of Certification Audits under ISO/IEC 27006-1
- Management of the Audit Programme and Risk-Based Audit Approach
- Audit Objectives, Scope and Criteria, and Preparation of the Audit Plan
- Roles, Authority and Responsibilities of the Audit Team
- First-, Second- and Third-Party Audit Approaches
- Opening Meeting and Conducting the Audit
- Interview, Observation, Document Review and Sampling Techniques
- Evaluation of Technical Evidence and Information Security Records
- Writing Audit Findings and Nonconformities
- Preparation of the Audit Report and Closing Meeting
- Follow-up of Corrective Actions and Post-Audit Activities
Training Method
The training is delivered through subject presentations, evaluation of ISO/IEC 27001 requirements from an auditor’s perspective, information security risk scenarios, Statement of Applicability and Annex A control assessments, exercises on preparing an audit programme and plan, reviews of technical controls and records, interview and sampling exercises, evaluation of objective evidence, opening and closing meeting exercises, case studies, writing nonconformities and preparing audit reports.
Attendance and Certificate
Certification Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must achieve a passing grade in the examination at the end of the training; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
Who is the ISO/IEC 27001 Information Security Management System Auditor Training suitable for?
It is intended for professionals working in information security, cybersecurity, information technology, risk, compliance, data protection, management systems and auditing who wish to participate in first-, second- or third-party audits within the scope of ISO/IEC 27001.
What is the main objective of the training?
To enable participants to evaluate the requirements of ISO/IEC 27001 from an auditor’s perspective and conduct Information Security Management System audits systematically, impartially, on a risk-based basis and using objective evidence.
Which areas are evaluated during an audit?
The organisation’s context, leadership, information security policy, risk assessment and risk treatment, information security objectives, Statement of Applicability, Annex A controls, incident management, performance evaluation, nonconformities and continual improvement processes are evaluated.
What is the difference between Internal Auditor Training and Auditor Training?
While Internal Auditor Training focuses primarily on first-party audits within an organisation, Auditor Training covers first-, second- and third-party audit approaches, audit programme management, audit team activities and the broader auditor competencies required for certification audits.
Why is the Statement of Applicability (SoA) important in an audit?
The Statement of Applicability identifies the information security controls that the organisation considers necessary as part of its risk treatment process, the implementation status of those controls and the reasons for their inclusion. The auditor evaluates whether the SoA is consistent with the results of the risk assessment and risk treatment, and whether the specified controls have actually been implemented.
How are Annex A controls evaluated during an audit?
Annex A controls are evaluated with consideration given to the organisation’s information security risks, risk treatment plan and Statement of Applicability. The auditor examines not only whether documents exist, but also objective evidence demonstrating that the controls have been implemented and support the intended outcomes.
Why is ISO/IEC 27007 important?
ISO/IEC 27007 supplements the guidance in ISO 19011 by providing specific guidance on managing Information Security Management System audit programmes, conducting ISMS audits and auditor competence. The currently published version is ISO/IEC 27007:2020; as of 2026, a new edition is being developed at the DIS stage and is expected to replace the current version.
Why is ISO/IEC 27006-1 important?
ISO/IEC 27006-1:2024 specifies requirements additional to those in ISO/IEC 17021-1 for bodies conducting Information Security Management System audits and certification in accordance with ISO/IEC 27001. It supports the delivery of competent, consistent and impartial third-party certification activities.
Should ISO/IEC 27001:2022/Amd 1:2024 be taken into account during an audit?
Yes. The 2024 amendment requires the organisation to determine whether climate change is a relevant issue within its context and to consider that interested parties may have requirements related to climate change. These matters should also be evaluated during the audit.
Is the training practical?
Yes. The training includes practical exercises involving information security risk scenarios, the Statement of Applicability, Annex A controls, audit planning, the evaluation of technical and documented evidence, interviewing, observation, sampling, writing nonconformities, opening and closing meetings, and preparing audit reports.
Is there an examination at the end of the training?
Yes. An assessment examination is held at the end of the training.
References
- ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Requirements
- ISO/IEC 27001:2022/Amd 1:2024 Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Amendment 1: Climate Action Changes
- ISO/IEC 27002:2022 Information Security, Cybersecurity and Privacy Protection — Information Security Controls
- ISO/IEC 27005:2022 Information Security, Cybersecurity and Privacy Protection — Guidance on Managing Information Security Risks
- ISO/IEC 27007:2020 Information Security, Cybersecurity and Privacy Protection — Guidelines for Information Security Management Systems Auditing
- ISO 19011:2026 Guidelines for Auditing Management Systems
- ISO/IEC 27006-1:2024 Information Security, Cybersecurity and Privacy Protection — Requirements for Bodies Providing Audit and Certification of Information Security Management Systems — Part 1: General
- ISO/IEC 17021-1:2015 Conformity Assessment — Requirements for Bodies Providing Audit and Certification of Management Systems
Similar trainings
EXEMPLAR002ISO/IEC 27701 Privacy Information Management System Transition Training8 hours · No session plannedEXEMPLAR011ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Awareness Training8 hours · No session plannedEXEMPLAR012ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training16 hours · No session planned