Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO/IEC 27019 Information Security, Cybersecurity and Privacy Protection Awareness Training has been designed to provide an understanding of information security controls for information technologies, operational technologies and process control systems used in the energy utility sector, and to develop cybersecurity awareness among employees.
The current ISO/IEC 27019:2024, based on ISO/IEC 27002:2022, addresses information security controls for systems used in the generation, transmission, storage and distribution of electricity, gas, oil and heat energy.
The language of the training is Turkish. The training is delivered online.
About the Training
The training covers the purpose and structure of ISO/IEC 27019:2024, its relationship with ISO/IEC 27001 and ISO/IEC 27002, information security and cybersecurity risks in the energy sector, OT and process control systems, the security of SCADA, PLC and field devices, access control, remote maintenance, supplier security, incident management, business continuity and employees' security responsibilities.
Who Should Attend?
- Employees of energy generation, transmission and distribution organisations
- Personnel working in the electricity, gas, oil and heat energy sectors
- Information security and cybersecurity teams
- OT and industrial control system personnel
- Information technology and network management teams
- SCADA and automation systems personnel
- Risk and compliance personnel
- Technical maintenance and operations personnel
- Internal auditors
- Professionals seeking to acquire a basic knowledge of ISO/IEC 27019
Objectives and Outcomes
The aim is for participants to understand the fundamental approach of the ISO/IEC 27019:2024 standard, recognise information security and cybersecurity risks specific to the energy sector, appreciate the importance of protecting OT and process control systems, and develop secure working habits in their daily activities.
By the End of the Training
Participants will be able to:
- Explain the purpose and scope of the ISO/IEC 27019:2024 standard.
- Understand the relationship between ISO/IEC 27001, ISO/IEC 27002 and ISO/IEC 27019.
- Identify information security risks specific to the energy sector.
- Understand the fundamental security differences between IT and OT systems.
- Recognise the fundamental security risks in SCADA, PLC and process control systems.
- Assess access control and remote connection risks.
- Understand their responsibilities in reporting and managing security incidents.
- Recognise cyber risks arising from suppliers and third parties.
- Explain the relationship between business continuity and the security of energy services.
- Apply information security rules in their daily activities.
Programme and Method
Training Topics
- Purpose, Scope and Key Concepts of the ISO/IEC 27019:2024 Standard
- Relationship Between ISO/IEC 27001, ISO/IEC 27002 and ISO/IEC 27019
- Information Security and Cybersecurity Risks in the Energy Sector
- Security of OT, SCADA, PLC and Industrial Control Systems
- Identity Management, Access Control and Remote Access Security
- Network Security, System Segregation and Technical Security Controls
- Physical Security, Maintenance and Change Management
- Supplier, Third-Party and Remote Maintenance Security
- Security Incidents, Business Continuity and Recovery Processes
- Employee Awareness, Secure Working Practices and Continual Improvement
Training Method
The training is delivered through subject presentations, explanations of ISO/IEC 27019 controls, energy sector-specific OT and SCADA security scenarios, examples of cyber incidents, risk assessment exercises and awareness case studies.
Attendance and Certificate
Certification Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must obtain a passing grade in the examination at the end of the training; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
Who is the ISO/IEC 27019 Information Security, Cybersecurity and Privacy Protection Awareness Training suitable for?
It is intended for employees working in information technology, operational technology, automation, information security, cyber security, maintenance, risk and compliance in the electricity, gas, oil and heat energy sectors.
What is the main objective of the training?
The objective is to enable participants to recognise information security and cyber security risks in the energy sector and gain a basic awareness of the security controls implemented under ISO/IEC 27019.
Which systems does ISO/IEC 27019 cover?
The standard covers environments such as centralised and distributed control systems, automation technologies, PLCs, sensors, actuators, related software and applications, and remote maintenance systems used in energy generation, transmission, storage and distribution processes.
Is ISO/IEC 27019 a standalone certification standard?
ISO/IEC 27019 is a sector-specific standard that provides information security controls for the energy utility industry. The primary certification standard for an Information Security Management System is ISO/IEC 27001.
Does the training include practical exercises?
Yes. The training uses examples and case studies relating to OT, SCADA, access control, remote maintenance, security incidents and supplier risks.
Is there an examination at the end of the training?
Yes. An assessment examination is held at the end of the training.
References
- ISO/IEC 27019:2024 Information Security, Cybersecurity and Privacy Protection — Information Security Controls for the Energy Utility Industry
- ISO/IEC 27001 Information Security Management Systems
- ISO/IEC 27002 Information Security Controls
- ISO/IEC 27005 Guidance on Managing Information Security Risks
- ISO 22301 Business Continuity Management Systems
- Relevant energy sector cyber security and information security guidelines
Similar trainings
EXEMPLAR002ISO/IEC 27701 Privacy Information Management System Transition Training8 hours · No session plannedEXEMPLAR011ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Awareness Training8 hours · No session plannedEXEMPLAR012ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training16 hours · No session planned