Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO/IEC 27001 Information Security Management System Transition Training has been designed to provide an understanding of the new and revised requirements of the standard as part of the transition from ISO/IEC 27001:2013 to ISO/IEC 27001:2022, update existing Information Security Management Systems and enable organisations to comply effectively with the latest requirements.
The training is based on the current ISO/IEC 27001:2022 and ISO/IEC 27001:2022/Amd 1:2024 requirements. ISO/IEC 27001:2022 specifies the Information Security Management System requirements for managing information security risks, protecting information assets and sustainably maintaining the principles of confidentiality, integrity and availability.
The language of the training is Turkish. The training is delivered online.
About the Training
The training covers the structure of the ISO/IEC 27001:2022 standard, key changes compared with ISO/IEC 27001:2013, the context of the organisation, leadership, information security risk management, information security objectives, planning of changes, the Statement of Applicability (SoA), changes to the Annex A control structure, organisational, people, physical and technological controls, new information security controls, the relationship with ISO/IEC 27002:2022, climate change requirements, gap analysis of the existing system, documentation updates and transition planning.
Who Should Attend?
- Employees of organisations implementing ISO/IEC 27001
- Those responsible for information security management systems
- Information security and cybersecurity teams
- ISO/IEC 27001 internal and lead auditors
- Information technology personnel
- Risk and compliance teams
- Data protection and privacy professionals
- System and network administrators
- Management system specialists
- Personnel who will be involved in ISO/IEC 27001 update activities
Objectives and Outcomes
The aim is to enable participants to correctly understand the changes between ISO/IEC 27001:2013 and ISO/IEC 27001:2022, assess the impact of new and amended requirements on the existing Information Security Management System, update the Annex A control structure, and bring the organisation’s system into compliance with ISO/IEC 27001:2022 and the 2024 amendment.
By the End of the Training
Participants will be able to:
- Explain the purpose, scope and current structure of the ISO/IEC 27001:2022 standard.
- Identify the key changes between ISO/IEC 27001:2013 and ISO/IEC 27001:2022.
- Assess the impact of new and amended requirements on the existing ISMS.
- Review information security risk assessment and risk treatment processes.
- Assess the requirements relating to the planning of changes.
- Understand the control structure updated by ISO/IEC 27002:2022.
- Assess the new organisation of the Annex A controls.
- Identify newly added information security controls.
- Review the Statement of Applicability (SoA) against the updated control structure.
- Update existing risk treatment plans.
- Assess the requirements of ISO/IEC 27001:2022/Amd 1:2024.
- Conduct a gap analysis of the existing system.
- Identify documentation and process update needs.
- Develop an ISMS update and compliance plan.
Programme and Method
Training Topics
- Overview of the ISO/IEC 27001:2022 Standard and the Transition Process
- Key Changes Between ISO/IEC 27001:2013 and ISO/IEC 27001:2022
- Current Management System Structure and Changes in Terminology
- Updates Regarding the Context of the Organisation and Interested Parties
- Leadership, Information Security Policy and Responsibilities
- Updating the Information Security Risk Assessment and Risk Treatment Process
- Information Security Objectives and Planning of Changes
- Changes to the ISO/IEC 27002:2022 Control Structure
- New Structure of Annex A Controls
- Organisational, People, Physical and Technological Controls
- New Information Security Controls Introduced by ISO/IEC 27001:2022
- Updating the Statement of Applicability (SoA)
- Reviewing the Risk Treatment Plan and Control Mappings
- ISO/IEC 27001:2022/Amd 1:2024 Climate Action Changes
- Gap Analysis of the Existing Information Security Management System
- Planning Documentation and Process Updates
- Preparation and Implementation of the ISO/IEC 27001:2022 Compliance Plan
Training Method
The training is delivered through subject presentations, comparison of the requirements of ISO/IEC 27001:2013 and ISO/IEC 27001:2022, mapping of the old and new Annex A control structures, Statement of Applicability update exercises, information security risk scenarios, sample gap analyses, documentation update exercises, case studies and compliance plan preparation exercises.
Attendance and Certificate
Certificate Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must obtain a passing grade in the examination at the end of the training; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
Who is the ISO/IEC 27001 Information Security Management System Transition Training suitable for?
It is intended for professionals working in information security, cybersecurity, information technology, risk, compliance, privacy, management systems and auditing within organisations implementing ISO/IEC 27001, who will be responsible for adapting the existing ISMS to the latest requirements.
What is the main purpose of the training?
The purpose is to enable participants to understand the new and revised requirements introduced by ISO/IEC 27001:2022, identify the updates required within the existing Information Security Management System and bring the system into conformity with the current standard.
What key changes have been made in ISO/IEC 27001:2022?
ISO/IEC 27001:2022 introduced various updates to the management system requirements, aligned the Annex A control structure with ISO/IEC 27002:2022 and reorganised the controls under four main themes: organisational, people, physical and technological.
Has the number of Annex A controls changed?
Yes. While ISO/IEC 27001:2013 contained 114 controls under 14 headings, the controls in the ISO/IEC 27001:2022 Annex A structure have been organised as 93 controls under four themes. Some controls have been merged, some renamed and new controls added.
Should the Statement of Applicability (SoA) be updated?
Yes. The organisation’s Statement of Applicability should be reviewed and, where necessary, updated, taking into account the current risk assessment and risk treatment results, as well as the ISO/IEC 27001:2022 Annex A control structure.
What did ISO/IEC 27001:2022/Amd 1:2024 change?
The amendment emphasised that organisations must determine whether climate change is a relevant issue within their context and consider that interested parties may have requirements related to climate change.
Is the transition period from ISO/IEC 27001:2013 still ongoing?
No. The period specified for transitioning accredited ISO/IEC 27001:2013 certificates to ISO/IEC 27001:2022 ended on 31 Ekim 2025. Current certification activities are based on ISO/IEC 27001:2022.
Should a gap analysis be conducted for the transition?
Yes. Comparing the existing ISMS against the ISO/IEC 27001:2022 requirements and current Annex A controls helps identify areas that are missing or require modification or improvement, and supports the planning of update activities.
Does the training include practical exercises?
Yes. The training includes comparisons between ISO/IEC 27001:2013 and ISO/IEC 27001:2022, Annex A control mapping, updating the Statement of Applicability, risk assessment, gap analysis, documentation updates and exercises in preparing a compliance plan.
Is there an examination at the end of the training?
Yes. An assessment examination is administered at the end of the training.
References
- ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Requirements
- ISO/IEC 27001:2022/Amd 1:2024 Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Amendment 1: Climate Action Changes
- ISO/IEC 27001:2013 Information Technology — Security Techniques — Information Security Management Systems — Requirements
- ISO/IEC 27002:2022 Information Security, Cybersecurity and Privacy Protection — Information Security Controls
- ISO/IEC 27005:2022 Information Security, Cybersecurity and Privacy Protection — Guidance on Managing Information Security Risks
- ISO/IEC 27007:2020 Information Security, Cybersecurity and Privacy Protection — Guidelines for Information Security Management Systems Auditing
- IAF MD 26 Transition Requirements for ISO/IEC 27001:2022
Similar trainings
EXEMPLAR002ISO/IEC 27701 Privacy Information Management System Transition Training8 hours · No session plannedEXEMPLAR011ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Awareness Training8 hours · No session plannedEXEMPLAR012ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training16 hours · No session planned