Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO/IEC 27017 Information Technology — Security Techniques Internal Auditor Training has been designed to provide the knowledge and auditor skills required to assess information security controls implemented in cloud computing environments in accordance with ISO/IEC 27017 guidance, and to plan, conduct, report and follow up internal audits.
The language of the training is Turkish. The training is delivered online.
About the Training
The training covers the purpose and structure of ISO/IEC 27017, its relationship with ISO/IEC 27001 and ISO/IEC 27002, the responsibilities of cloud service providers and cloud service customers, information security controls in cloud environments, access management, virtual environment security, data and asset management, security incidents, and internal auditing practices based on the principles of ISO 19011.
Who Should Attend?
- ISO/IEC 27017 internal auditors and auditor candidates
- Information security internal auditors
- ISO/IEC 27001 internal auditors
- Information technology and cloud systems personnel
- Cybersecurity specialists
- Personnel working for cloud service providers
- Risk and compliance teams
- Personnel responsible for information security management systems
- Personnel responsible for supplier and third-party management
Objectives and Outcomes
The aim is to enable participants to interpret the ISO/IEC 27017 guidance correctly, assess information security controls in cloud services using a risk-based approach, and conduct systematic and objective internal audits in accordance with ISO 19011 principles.
By the End of the Training
Participants will be able to:
- Explain the purpose and scope of ISO/IEC 27017.
- Evaluate the relationship between ISO/IEC 27001, ISO/IEC 27002 and ISO/IEC 27017.
- Distinguish between the responsibilities of the cloud service customer and the cloud service provider.
- Identify information security risks in the cloud environment.
- Evaluate access, data and virtual environment security controls.
- Define the internal audit scope, criteria and plan.
- Collect and evaluate objective audit evidence.
- Apply interviewing and sampling techniques.
- Document nonconformities objectively.
- Monitor the implementation and effectiveness of corrective actions.
Programme and Method
Training Topics
- Relationship Between ISO/IEC 27017, ISO/IEC 27001 and ISO/IEC 27002
- Responsibilities of the Cloud Service Provider and Cloud Service Customer
- Information Security Risks and Controls in Cloud Environments
- Access Control, Virtual Environments, Data and Asset Security
- Supplier and Third-Party Management, Incident Management and Service Continuity
- ISO 19011 Internal Audit Principles and Auditor Competence
- Internal Audit Planning and Determination of Scope and Criteria
- Conducting the Audit, Interviewing, Sampling and Objective Evidence
- Audit Findings, Documenting Nonconformities and Reporting
- Follow-up of Corrective Actions and Evaluation of Audit Effectiveness
Training Method
The training is delivered through presentations, evaluation of ISO/IEC 27017 controls, cloud security scenarios, audit planning exercises, objective evidence assessments, interviewing and sampling exercises, case studies and nonconformity-writing exercises.
Attendance and Certificate
Certificate Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must achieve a passing grade in the examination at the end of the training; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
Who is ISO/IEC 27017 Information Technology — Security Techniques Internal Auditor Training suitable for?
It is intended for professionals working in information security, information technology, cyber security, risk, compliance and internal auditing in organisations that use or provide cloud services.
What is the main objective of the training?
To enable participants to assess information security controls in cloud environments systematically and objectively and to conduct effective ISO/IEC 27017 internal audits.
Which areas are assessed during an internal audit?
The responsibilities of the cloud service provider and customer, access controls, virtual environment security, data and asset management, security incidents, supplier management, monitoring activities and related information security controls are assessed.
Is ISO/IEC 27017 a standalone certification standard?
No. ISO/IEC 27017 provides guidance on implementing information security controls for cloud services. The primary certification standard for an Information Security Management System is ISO/IEC 27001.
Is the training practical?
Yes. The training includes audit planning, cloud security control assessments, objective evidence gathering, interviewing, sampling, case studies and nonconformity writing exercises.
Is there an examination at the end of the training?
Yes. An assessment examination is conducted at the end of the training.
References
- ISO/IEC 27017 Information Technology — Security Techniques — Code of Practice for Information Security Controls Based on ISO/IEC 27002 for Cloud Services
- ISO/IEC 27001 Information Security Management Systems
- ISO/IEC 27002 Information Security Controls
- ISO/IEC 27005 Guidance on Managing Information Security Risks
- ISO/IEC 27018 Protection of PII in Public Clouds
- ISO 19011 Guidelines for Auditing Management Systems
Similar trainings
EXEMPLAR002ISO/IEC 27701 Privacy Information Management System Transition Training8 hours · No session plannedEXEMPLAR017ISO/IEC 27019 Information Security, Cybersecurity and Privacy Protection Awareness Training8 hours · No session plannedEXEMPLAR018ISO/IEC 27019 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training16 hours · No session planned