Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO/IEC 27001:2022 Information Security Management Systems Lead Auditor Training is a comprehensive training programme designed to develop lead auditors who can assess the information security management systems established by organisations to protect their information assets against international standard requirements, plan and conduct audits, and manage audit teams.
The training covers the requirements of the ISO/IEC 27001:2022 standard, the fundamental principles of information security, information security risk management, ISO/IEC 27002:2022 Annex A controls, the Statement of Applicability (SoA), audit principles, audit planning and implementation processes, the assessment of nonconformities, and audit reporting methods.
The programme has been designed using an approach that supports theoretical knowledge with practical exercises. It aims to develop participants’ lead auditing skills through case studies, sample risk assessments, audit scenarios, and reporting exercises.
Objectives and Outcomes
Purpose of the Training
The purpose of this training is to equip participants with the knowledge and skills required to interpret the requirements of ISO/IEC 27001:2022, assess information security risks and control mechanisms, conduct risk-based audits and carry out lead auditor activities.
Learning Outcomes
Participants who complete the training are expected to acquire the following knowledge and skills:
- Interpret the purpose, scope and requirements of ISO/IEC 27001:2022
- Assess information security management system processes and their effectiveness
- Analyse information assets, threats, vulnerabilities and information security risks
- Audit information security risk assessment and risk treatment processes
- Assess information security controls within the scope of ISO/IEC 27002:2022
- Review the processes for preparing and evaluating the Statement of Applicability – SoA
- Apply the principles of confidentiality, integrity and availability of information security to audit processes
- Assess access control, cryptography, network security, incident management and business continuity processes
- Apply audit planning and conduct techniques in accordance with ISO 19011:2026
- Define the audit scope, criteria and objectives
- Manage the audit team and coordinate audit activities
- Collect objective audit evidence and assess nonconformities
- Prepare audit reports and assess the effectiveness of corrective actions
Programme and Method
Training Topics
- ISO/IEC 27001:2022 Requirements
- Information Security Management System
- Context of the Organisation and Leadership
- Risk Assessment
- Risk Treatment
- Information Security Objectives
- Statement of Applicability (SoA)
- Annex A Controls
- Organisational Controls
- People Controls
- Physical Controls
- Technological Controls
- Information Security Events
- Performance and Improvement
- ISO 19011 Auditing Principles
- ISO/IEC 27007 Auditing Guidelines
- ISO/IEC 27006-1 Requirements
- Audit Programme and Plan
- Role of the Lead Auditor
- Audit Team Management
- Interviewing and Sampling
- Evaluation of Technical Evidence
- Writing Nonconformities
- Audit Reporting
- Opening and Closing Meetings
- Corrective Action Follow-up
Training Method
The training is delivered through subject presentations, information security risk scenarios, SoA and control assessments, audit planning, team management, and practical exercises in writing nonconformities and reporting.
Attendance and Certificate
Certificate Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must achieve a passing grade in the examination at the end of the training; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
1. Who is the ISO/IEC 27001 Lead Auditor Training suitable for?
It is suitable for information security specialists, information technology professionals, cybersecurity specialists, quality management system managers, internal auditors and professionals wishing to audit information security management systems.
2. What is the difference between ISO/IEC 27001 and ISO/IEC 27002?
ISO/IEC 27001 defines the requirements for establishing, implementing, maintaining and continually improving an information security management system. ISO/IEC 27002 provides guidance on implementing information security controls.
3. How many information security controls are included in ISO/IEC 27001:2022?
Annex A of ISO/IEC 27001:2022 contains a total of 93 controls across four categories: organisational, people, physical and technological. The applicability of the controls is determined within the framework of the organisation's risk assessment and risk treatment process.
4. What is the difference between the 5-day and 3-day training courses?
The 5-day programme comprehensively covers ISO/IEC 27001 requirements, risk management, Annex A controls and audit processes. The 3-day programme offers intensive content for participants who already have knowledge of information security and auditing.
5. Does the training include practical exercises?
Yes. The training includes practical exercises in information security risk assessment, review of control mechanisms, audit planning, case study analysis, writing nonconformities and audit reporting.
6. Can the training be delivered online or in person?
Yes. The training can be arranged online or in person according to participant and organisational requirements.
7. Is there an examination at the end of the training?
A final examination is planned as part of the programme to assess participants' knowledge and skills.
8. Is a certificate issued at the end of the training?
Yes. The relevant training certificate is issued based on the attendance requirements and assessment results.
Resources
- ISO/IEC 27001:2022 – Information Security Management Systems – Requirements
- ISO/IEC 27001:2022/Amd 1:2024 – Climate Action Changes
- ISO/IEC 27002:2022 – Information Security Controls
- ISO/IEC 27005:2022 – Guidance on Managing Information Security Risks
- ISO 19011:2026 – Guidelines for Auditing Management Systems
- ISO/IEC 27006-1:2024 – Requirements for Bodies Providing Audit and Certification of Information Security Management Systems
- ISO/IEC 17021-1:2015 – Requirements for Bodies Providing Audit and Certification of Management Systems
Similar trainings
EXEMPLAR002ISO/IEC 27701 Privacy Information Management System Transition Training8 hours · No session plannedEXEMPLAR011ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Awareness Training8 hours · No session plannedEXEMPLAR012ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training16 hours · No session planned