Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO/IEC 27001 Information Security Management System Awareness Training has been designed to help organisations protect their information assets, manage information security risks and ensure that employees understand their information security responsibilities.
The training is based on the current ISO/IEC 27001:2022 and ISO/IEC 27001:2022/Amd 1:2024 requirements. ISO/IEC 27001 specifies the Information Security Management System requirements for organisations to manage information security risks systematically and protect the confidentiality, integrity and availability of information.
The language of the training is Turkish. The training is delivered online.
About the Training
The training covers the structure of the ISO/IEC 27001 standard, the fundamental principles of information security, the context of the organisation, leadership, information security policy, risk assessment and risk treatment, information security objectives, employees’ duties and responsibilities, protection of information assets, access control, physical security, human resources security, supplier relationships, technological controls, information security incident management, business continuity, the Statement of Applicability (SoA), Annex A controls, performance evaluation and continual improvement.
Who Should Attend?
- Employees wishing to learn about ISO/IEC 27001
- Those responsible for information security management systems
- Information technology personnel
- Information security and cybersecurity teams
- Managers and departmental supervisors
- Human resources personnel
- Risk and compliance teams
- Data protection and privacy personnel
- System and network administrators
- All employees who use information assets
Objectives and Outcomes
The aim is for participants to understand the fundamental approach and requirements of the ISO/IEC 27001 Information Security Management System, develop awareness of information security risks, recognise their personal responsibilities in protecting information assets, and contribute to a secure working culture.
By the End of the Training
Participants will be able to:
- Explain the purpose, scope and basic structure of the ISO/IEC 27001 standard.
- Understand the principles of confidentiality, integrity and availability.
- Explain the concepts of information assets and information security risk.
- Recognise the importance of the information security policy.
- Understand the approach to information security risk assessment and risk treatment.
- Assess the impact of their own roles and responsibilities on information security.
- Understand the principles of access control and authorisation.
- Explain the importance of password and authentication security.
- Recognise physical and environmental security controls.
- Identify threats such as social engineering and phishing.
- Understand the importance of supplier and third-party risks.
- Explain how to report information security incidents.
- Understand the fundamental purpose of the Statement of Applicability and Annex A controls.
- Contribute to the continual improvement of information security performance.
Programme and Method
Training Topics
- Introduction to the ISO/IEC 27001 Standard and the Information Security Management System
- Fundamental Principles of Information Security: Confidentiality, Integrity and Availability
- Context of the Organisation, Interested Parties and Leadership
- Information Security Policy, Roles and Responsibilities
- Identification and Protection of Information Assets
- Information Security Risk Assessment and Risk Treatment
- Information Security Objectives and Planning
- Competence, Awareness, Communication and Documented Information
- Access Control, Authentication and User Security
- Physical and Environmental Security
- Human Resources and Information Security
- Supplier and Third-Party Information Security
- Cybersecurity Threats, Social Engineering and Phishing
- Reporting and Management of Information Security Incidents
- Overview of the Statement of Applicability (SoA) and Annex A Controls
- Organisational, People, Physical and Technological Controls
- Performance Evaluation and Continual Improvement
- Climate Change and Information Security Management
Training Method
The training is delivered through presentations, relating ISO/IEC 27001 requirements to daily work activities, information security risk scenarios, password and access security examples, social engineering and phishing cases, information security incident reporting scenarios, Annex A control examples and case studies.
Attendance and Certificate
Certification Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must achieve a passing grade in the examination at the end of the training; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
Who is the ISO/IEC 27001 Information Security Management System Awareness Training suitable for?
It is suitable for all employees, managers and information security professionals who wish to gain a basic understanding of information security, understand the requirements of ISO/IEC 27001 and contribute to protecting the organisation's information assets.
What is the main purpose of the training?
The main purpose is for participants to recognise information security risks, understand the fundamental requirements of the ISO/IEC 27001 Information Security Management System and develop secure working practices.
Which areas does ISO/IEC 27001 cover?
It covers areas such as the context of the organisation, leadership, information security policy, risk assessment and risk treatment, information security objectives, competence, access control, physical security, personnel security, technological controls, incident management, performance evaluation and continual improvement.
What do confidentiality, integrity and availability mean?
Confidentiality means that information is accessible only to authorised persons; integrity means safeguarding the accuracy and completeness of information; and availability means that authorised users can access information and related systems when required.
What is the Statement of Applicability (SoA)?
The Statement of Applicability is one of the core ISMS documents that sets out the controls the organisation considers necessary for managing information security risks, the implementation status of these controls and the required justifications.
What are the ISO/IEC 27001 Annex A controls?
In ISO/IEC 27001:2022 Annex A, the controls are organised under four main themes: organisational controls, people controls, physical controls and technological controls.
Should employees report information security incidents?
Yes. Suspicious emails, unauthorised access, data loss, information being sent to the wrong person, loss of devices or other information security incidents must be reported through the notification channels specified by the organisation as soon as possible.
What did ISO/IEC 27001:2022/Amd 1:2024 change?
The amendment emphasised that organisations must determine whether climate change is a relevant issue within their context and consider that interested parties may have requirements related to climate change.
Does the training include practical activities?
Yes. The training uses example scenarios and case studies relating to information security risks, access security, password use, social engineering, phishing, information security incidents and day-to-day work activities.
Is there an examination at the end of the training?
Yes. An assessment examination is conducted at the end of the training.
References
- ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Requirements
- ISO/IEC 27001:2022/Amd 1:2024 Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Amendment 1: Climate Action Changes
- ISO/IEC 27002:2022 Information Security, Cybersecurity and Privacy Protection — Information Security Controls
- ISO/IEC 27005:2022 Information Security, Cybersecurity and Privacy Protection — Guidance on Managing Information Security Risks
- ISO/IEC 27035 Series — Information Security Incident Management
- ISO/IEC 27701 Privacy Information Management Systems
Similar trainings
EXEMPLAR002ISO/IEC 27701 Privacy Information Management System Transition Training8 hours · No session plannedEXEMPLAR018ISO/IEC 27019 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training16 hours · No session plannedEXEMPLAR019ISO/IEC 27701 Privacy Information Management System Auditor Training24 hours · No session planned