Certified ISO 27001 ISMS Lead Implementer and Lead Auditor Combination Training Course

Training course outline

Certified ISO 7001 Lead Auditor

This course is designed to develop practical knowledge and auditing skills based on the core audit requirements as outlined in the ISO 19011 standard. For implementation managers, understanding the requirements and the methodology employed by an external ISO 27001 auditor are crucial to the success of any ISO 27001 implementation project.

Certified ISO 27001 Lead Implementer

The flagship of our ISO 27001 implementation Learning Pathway, this Advanced-level course is focused on developing the in-depth knowledge and skills required to implement and deliver an ISMS.

---

Certified ISO 27001 Lead Implementer and Lead Auditor training course benefits

A complete introduction to ISO 27001

Save time and travel costs with ISO 27001 online training delivered to any location with Internet access.

Designed by experts

Developed by acknowledged ISO 27001 experts Alan Calder and Steve Watkins.

Delivered by professionals

Delivered by an experienced ISO 27001 trainer and consultant who will use a combination of formal training, practical exercises and relevant case studies.

Aligned with best practice

Aligned with the best-practice ISO 19011:2011 (Guidelines for auditing management systems) audit methodology.

---

Who should attend this course?

This course is aimed at individuals who want a globally-recognized ISO 27001 lead auditor qualification to further their careers, and anyone involved in information security management, writing information security policies or implementing ISO 27001, either as a lead implementer or as part of an implementation team:

• IT/ Information security manager

• Compliance auditor

• GDPR consultant

• IT/ Information security consultant

• Cyber security consultant

• Head of IT

• Information and risk manager

• IT/ Information security officer

• IT/ Information security analyst

• Internal auditor

• ISMS manager

• Information security project manager

• CISO (Chief Information Security Officer)

• Network manager

---

Why choose IT Governance for your training needs?

• We’re internationally recognized as the authority on ISO 27001 – our team led the world’s first ISO 27001 certification project, and since then we have trained more than 8,000 professionals on information security management system (ISMS) implementations and audits.

• Trained by industry experts – our trainers are working consultants with years of practical, hands-on experience.

• Choose the method that suits you – we offer instructor-led online, self-paced online, e-learning and in-house training options.

• Access your training anywhere – all our course materials are provided as a digital copy, allowing you to access them anywhere and at any time. Documents will be made available 20 days before your course.

• Business solutions to suit you – whether you’re a multinational wanting us to manage all your training needs or a small business wishing to boost your workforce skills, we offer a range of training solutions.

Certified ISO 7001 Lead Auditor

This course is designed to develop practical knowledge and auditing skills based on the core audit requirements as outlined in the ISO 19011 standard. For implementation managers, understanding the requirements and the methodology employed by an external ISO 27001 auditor are crucial to the success of any ISO 27001 implementation project.

Certified ISO 27001 Lead Implementer

The flagship of our ISO 27001 implementation Learning Pathway, this Advanced-level course is focused on developing the in-depth knowledge and skills required to implement and deliver an ISMS.

Course details

What does this course cover?

• The key concepts, principles, and main requirements of ISO/IEC 27001:2013

• The terms and definitions used in the Standard, including risk and options for risk assessments

• How to interpret the requirements of ISO/IEC 27001:2013 to determine the scope of your ISMS

• How to secure senior management commitment by building a compelling business case

• How to structure and manage your ISO 27001 project

• How to review and map your existing controls to Annex A of ISO 27001

• The importance of the Statement of Applicability (SoA), and justifications for inclusions and exclusions

• How to carry out an information security risk assessment – the core competence of information security management

• The key elements of management review

• How to develop a management framework, write policies, and produce other critical documentation

• The importance of staff, an effective communication strategy and general awareness training

• How to prepare for your ISO 27001 certification audit and ensure you that you pass first time

• How to manage and drive continual improvement under ISO 27001

• An overview of the audit process used by certification bodies

• Best-practice audit methodology based on ISO 19011

• How to establish, maintain, and manage an audit program

• How to plan, conduct, report, summarize, and follow-up on an audit

• Effective interviewing techniques and observation skills

• How to use audits to identify nonconformities and ensure appropriate corrective action is taken

• How the audit process is used in first, second and third-party audits

---

Course agenda:

Course agenda (day 1-3):

• Project mandate
• Project initiation
• ISMS initiation
• Management framework
• Baseline security criteria
• Risk management
• Implementation
• Annex A controls
• Measure, monitor, review, and improve
• Certification

Course agenda (day 4-8):

• Purpose and benefits of audits
• Role of auditors
• Role of standards in audits
• Audit terms and definitions
• Principles of auditing
• Managing an audit program
• Performing an audit
• Observing and listening
• Reporting and Summarizing Audit Findings
• Conducting Audit Follow-up
• Competence and Evaluation of Auditors
• Accredited Certification Audit specifics
• Auditing an Information Security Management System to ISO 27001:2013

---

What’s included in this course?

• Full course materials (digital copy provided as a PDF file)
• The ISO 27001 Certified ISMS Lead Implementer exam
• The ISO 27001 Certified ISMS Lead Auditor exam
• A certificate of attendance

---

What equipment should I bring?

This course is delivered as a WebEx Live Online session. Anyone booked on this course is expected to have a reliable Internet connection at their home or office. We will check and confirm that you have the WebEx application installed, and that you can correctly log on to our WebEx training centre before the course.

To sit the online exam you will need:

• Internet Explorer 9 (or later) or Mozilla Firefox version 16 (or later)
• Internet access for the full time of the exam
• To deactivate the pop-up blocker
• A working webcam on the machine you are using to sit the exam

---

Course duration and times

9:00 am – 5:00 pm CST each day course is run

---

CPD/CPE points

This course is equivalent to 56 CPD/CPE points.

Exams and qualifications

Certified ISO 27001 Lead Implementer and Lead Auditor exams

The ISO 27001 Certified ISMS Lead Implementer (CIS LI) exam:

• Delivery method: Online
• Duration: 60 minutes
• Questions: 40
• Format: Multiple choice
• Pass mark: 75%

The ISO 27001 Certified ISMS Lead Auditor (CIS LA) exam:

• Delivery method: Online
• Duration: 90 minutes
• Questions: 40
• Format: Multiple choice
• Pass mark: 75%

Both the ISO 27001 Lead Implementer and Lead Auditor exams are set by IBITGQ ( International Board for IT Governance Qualifications). There are no extra charge for these exams.

---

What qualifications will I receive?

• Certified ISO 27001 ISMS Lead Auditor (CIS LA).
• Certified ISO 27001 ISMS Lead Implementer (CIS LI).

---

Accreditation

This course is accredited by IBITGQ, as well as CIISec (The Chartered Institute of Information Security), it satisfies the CIISec Knowledge Areas requirements at Level 1: A1, A3, A7, C1, C2, D2, E3, F2, H1 and H2; and at Level 1+: A2, A4, A5, A6, B1, B2, D1, E1, E2, F1 and G1

You can demonstrate your professional and practical knowledge and expertise by registering your qualification on the IBITGQ/ GASQ successful candidate register.

The PCI SSC (Payment Card Industry Security Standards Council) has indicated that it accepts GASQ certifications in relation to the IBITGQ-accredited courses as meeting the requirements of an individual applying to become a PCI DSS (Payment Card Industry Data Security Standard) QSA (Qualified Security Assessor).

---

How will I receive my exam results and certificates?

Provisional exam results will be given immediately after completing the exam; confirmed results will be issued within 10 working days, after which you’ll receive your certificate by email if you passed.

---

Do I need to bring proof of identity?

Delegates must bring a form of photographic ID with them as the invigilator may request to check it prior to the exam.

---

Can exams be retaken?

Yes, if you are unsuccessful on the first attempt you can retake the exam for an additional fee. You can email us to schedule the retest.

Prerequisites

Are there any prerequisites for this course?

There are no formal entry requirements but it is assumed that you have taken the ISO27001 Certified ISMS Foundation training course or you have a good working knowledge of ISO 27001 gained through practical experience.

---

Is there any recommended reading?

We strongly recommend you purchase and read the standard prior to attending the course:

• ISO IEC 27001 2013 and ISO IEC 27002 2013

We also recommend that you purchase and read the following textbooks:

• ISO27001/ISO27002 – A Pocket Guide
• An Introduction to Information Security and ISO27001:2013 – A Pocket Guide