Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO/IEC 27001 Information Security Management System Internal Auditor Training has been designed to provide the knowledge and auditor skills required to assess the conformity and effectiveness of an organisation’s Information Security Management System, systematically examine information security risks and controls, and conduct internal audits based on objective evidence.
The training is based on the current ISO/IEC 27001:2022 and ISO/IEC 27001:2022/Amd 1:2024 requirements, together with the ISO 19011:2026 guidance for management system audits. ISO/IEC 27001 specifies the requirements for organisations to protect their information assets, manage information security risks, and establish and maintain an effective Information Security Management System in accordance with the principles of confidentiality, integrity and availability.
The language of the training is Turkish. The training is delivered online.
About the Training
The training covers the structure of the ISO/IEC 27001 standard, the context of the organisation, leadership, information security policy, risk assessment and risk treatment, information security objectives, competence and awareness, documented information, operational planning, performance evaluation, nonconformity and continual improvement, Annex A information security controls, the Statement of Applicability (SoA), ISO 19011:2026 auditing principles, internal audit planning, objective evidence gathering, interview and sampling techniques, reporting nonconformities, and monitoring corrective actions.
Who Should Attend?
- ISO/IEC 27001 internal auditors and auditor candidates
- Personnel responsible for information security management systems
- Information security and cyber security personnel
- Information technology teams
- Risk and compliance personnel
- Internal audit teams
- Data protection and privacy professionals
- System and network administrators
- Management system specialists
- Personnel involved in the implementation and development of the ISO/IEC 27001 system
Objectives and Outcomes
The aim is to enable participants to interpret the requirements of ISO/IEC 27001 correctly, assess the Information Security Management System using a risk-based approach and objective evidence, examine the implementation and effectiveness of information security controls, and conduct effective internal audits in accordance with the principles of ISO 19011:2026.
By the End of the Training
Participants will be able to:
- Explain the purpose, scope and structure of the ISO/IEC 27001 standard.
- Assess the fundamental principles of the Information Security Management System.
- Audit the requirements relating to the context of the organisation and interested parties.
- Assess information security policies, roles and responsibilities.
- Examine information security risk assessment and risk treatment processes.
- Assess information security objectives and performance indicators.
- Examine the Statement of Applicability (SoA).
- Assess the implementation of Annex A information security controls.
- Audit requirements relating to competence, awareness and documented information.
- Assess the management of information security incidents.
- Establish the scope, criteria and plan for an internal audit.
- Collect and evaluate objective audit evidence.
- Apply interview, observation and sampling techniques.
- Report nonconformities objectively.
- Monitor the implementation and effectiveness of corrective actions.
Programme and Method
Training Topics
- Introduction to the ISO/IEC 27001 Standard and the Information Security Management System
- Context of the Organisation, Interested Parties and Leadership
- Information Security Policy, Roles and Responsibilities
- Information Security Risk Assessment and Risk Treatment
- Information Security Objectives and Planning
- Competence, Awareness, Communication and Documented Information
- Operational Planning and Information Security Processes
- Statement of Applicability (SoA) and Annex A Controls
- Organisational, People, Physical and Technological Controls
- Information Security Incident Management and Business Continuity
- Performance Monitoring, Measurement and Continual Improvement
- ISO 19011:2026 Auditing Principles and Internal Auditor Competence
- Internal Audit Planning and Determination of Scope and Audit Criteria
- Conducting the Audit, Interviewing, Observation, Sampling and Objective Evidence
- Evaluation of Information Security Records and Technical Evidence
- Audit Findings, Writing Nonconformities and Reporting
- Follow-up of Corrective Actions and Evaluation of Audit Effectiveness
Training Method
The training is delivered through subject presentations, evaluation of ISO/IEC 27001 requirements, information security risk scenarios, examination of the Statement of Applicability and Annex A controls, process-based internal audit exercises, preparation of audit plans and checklists, interviewing, observation and sampling exercises, evaluation of technical and documented evidence, case studies and nonconformity-writing exercises.
Attendance and Certificate
Certificate Rules
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must achieve a passing mark in the examination at the end of the course; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
Who is the ISO/IEC 27001 Information Security Management System Internal Auditor Training suitable for?
It is intended for professionals working in information security, cybersecurity, information technology, risk, compliance, privacy, management systems and internal auditing, or those who will serve as ISO/IEC 27001 internal auditors.
What is the main objective of the training?
To enable participants to evaluate the ISO/IEC 27001 Information Security Management System systematically and objectively and conduct effective internal audits in accordance with ISO 19011 principles.
Which areas are evaluated during an internal audit?
The organisation's context, leadership, information security policy, risk assessment and risk treatment, information security objectives, Statement of Applicability, Annex A controls, incident management, competence, performance evaluation, nonconformities and continual improvement processes are evaluated.
Is the Statement of Applicability (SoA) evaluated during an internal audit?
Yes. The internal audit evaluates whether the Statement of Applicability is consistent with the risk treatment results, whether the necessary controls have been included, whether the implementation status of the controls has been stated accurately and whether the justifications for excluded controls are appropriate.
How are Annex A controls evaluated during an audit?
Annex A controls are evaluated by taking into account the organisation's risks, risk treatment plan and Statement of Applicability. The controls are expected not only to be documented, but also to be implemented effectively and supported by appropriate evidence.
Should ISO/IEC 27001:2022/Amd 1:2024 be taken into account during an internal audit?
Yes. The 2024 amendment requires the organisation to determine whether climate change is a relevant issue within its context and to consider that relevant interested parties may have requirements related to climate change. These matters should also be verified during the internal audit.
Can ISO/IEC 27007 be used in internal auditing?
Yes. ISO/IEC 27007 provides additional guidance to ISO 19011 on managing Information Security Management System audit programmes, conducting audits and auditor competence. As of 30 Eylül 2026, ISO/IEC 27007:2020 is the published version; its new edition is under development as ISO/IEC DIS 27007.
Is the training practical?
Yes. The training uses information security risk scenarios, Statement of Applicability and control evaluations, internal audit planning, checklist preparation, objective evidence gathering, interviews, observation, sampling, case studies and nonconformity writing exercises.
Is there an examination at the end of the training?
Yes. An assessment examination is administered at the end of the training.
References
- ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Requirements
- ISO/IEC 27001:2022/Amd 1:2024 Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Amendment 1: Climate Action Changes
- ISO/IEC 27002:2022 Information Security, Cybersecurity and Privacy Protection — Information Security Controls
- ISO/IEC 27005:2022 Information Security, Cybersecurity and Privacy Protection — Guidance on Managing Information Security Risks
- ISO/IEC 27007:2020 Information Security, Cybersecurity and Privacy Protection — Guidelines for Information Security Management Systems Auditing
- ISO 19011:2026 Guidelines for Auditing Management Systems
Similar trainings
EXEMPLAR002ISO/IEC 27701 Privacy Information Management System Transition Training8 hours · No session plannedEXEMPLAR017ISO/IEC 27019 Information Security, Cybersecurity and Privacy Protection Awareness Training8 hours · No session plannedEXEMPLAR018ISO/IEC 27019 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training16 hours · No session planned