Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO/IEC 27019 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training has been designed to provide the knowledge and auditor skills required to assess information security controls for information technology, operational technology and industrial control systems used in the energy utility sector and to conduct effective internal audits.
The training is based on the current ISO/IEC 27019:2024 requirements and the ISO 19011:2026 guidance for management system audits. ISO/IEC 27019:2024 covers information security controls for systems used in the generation, transmission, storage and distribution of electricity, gas, oil and heat energy.
The language of the training is Turkish. The training is delivered online.
About the Training
The training covers the structure of the ISO/IEC 27019:2024 standard, its relationship with ISO/IEC 27001 and ISO/IEC 27002, cybersecurity risks specific to the energy sector, the security of OT and industrial control systems, SCADA and PLC environments, access and network security, supplier risks, security incident management, internal audit planning, the collection of objective evidence, reporting nonconformities and following up corrective actions.
Who Should Attend?
- ISO/IEC 27019 internal auditors and auditor candidates
- ISO/IEC 27001 internal auditors
- Information security and cybersecurity personnel
- Technical personnel working in the energy sector
- OT, SCADA and industrial control system teams
- Information technology and network management personnel
- Risk and compliance teams
- Technical maintenance and operations personnel
- Personnel responsible for information security management systems
Objectives and Outcomes
The aim is to enable participants to interpret the requirements of ISO/IEC 27019:2024 correctly, assess information security and cybersecurity controls in the energy sector using a risk-based approach and objective evidence, and conduct internal audits in accordance with the principles of ISO 19011:2026.
By the End of the Training
Participants will be able to:
- Explain the purpose and scope of ISO/IEC 27019:2024.
- Evaluate the relationship between ISO/IEC 27001, ISO/IEC 27002 and ISO/IEC 27019.
- Identify information security risks specific to the energy sector.
- Assess controls for OT, SCADA, PLC and industrial control systems.
- Audit access, network and remote connection security.
- Define the scope, criteria and plan for an internal audit.
- Collect and evaluate objective audit evidence.
- Apply interview and sampling techniques.
- Report nonconformities objectively.
- Monitor the implementation and effectiveness of corrective actions.
Programme and Method
Training Topics
- Relationship between ISO/IEC 27019:2024, ISO/IEC 27001 and ISO/IEC 27002
- Information Security, Cybersecurity and Risk Management in the Energy Sector
- Security of OT, SCADA, PLC and Industrial Control Systems
- Access Control, Network Security, Remote Access and Technical Controls
- Supplier, Third-Party and Incident Management, and Business Continuity
- ISO 19011:2026 Auditing Principles and Internal Auditor Competence
- Internal Audit Planning and Determination of Scope and Audit Criteria
- Conducting the Audit, Interviewing, Sampling and Objective Evidence
- Audit Findings, Writing Nonconformities and Reporting
- Follow-up of Corrective Actions and Evaluation of Audit Effectiveness
Training Method
The training is delivered through subject presentations, evaluation of ISO/IEC 27019 controls, OT and SCADA security scenarios, internal audit planning exercises, interviewing and sampling exercises, objective evidence assessments, case studies and nonconformity writing exercises.
Attendance and Certificate
Certification Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must obtain a passing grade in the examination at the end of the training; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
Who is the ISO/IEC 27019 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training suitable for?
It is intended for professionals working in information security, cybersecurity, OT, SCADA, automation, information technology, risk, compliance and internal auditing in the energy sector.
What is the main objective of the training?
To enable participants to evaluate information security controls in the energy sector systematically and objectively and conduct effective ISO/IEC 27019 internal audits.
Which areas are assessed during an internal audit?
OT and industrial control systems, SCADA and PLC environments, access and network security, remote connections, physical security, suppliers, security incidents, business continuity and relevant information security controls are assessed.
Which sector is ISO/IEC 27019 intended for?
ISO/IEC 27019:2024 addresses information security controls for information and operational technologies used in the generation, transmission, storage and distribution of electrical, gas, oil and heat energy.
Does the training include practical exercises?
Yes. The training includes internal audit planning, OT and SCADA control assessments, objective evidence gathering, interviewing, sampling, case studies and nonconformity writing exercises.
Is there an examination at the end of the training?
Yes. An assessment examination is administered at the end of the training.
References
- ISO/IEC 27019:2024 Information Security, Cybersecurity and Privacy Protection — Information Security Controls for the Energy Utility Industry
- ISO/IEC 27001 Information Security Management Systems
- ISO/IEC 27002 Information Security Controls
- ISO/IEC 27005 Guidance on Managing Information Security Risks
- ISO 19011:2026 Guidelines for Auditing Management Systems
- ISO 22301 Business Continuity Management Systems
Similar trainings
EXEMPLAR002ISO/IEC 27701 Privacy Information Management System Transition Training8 hours · No session plannedEXEMPLAR011ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Awareness Training8 hours · No session plannedEXEMPLAR012ISO/IEC 27011 Information Security, Cybersecurity and Privacy Protection Internal Auditor Training16 hours · No session planned