ISO/IEC 27001:2022 Information Security Management Systems Awareness

About Course

Build practical awareness of ISO/IEC 27001:2022, including the 2024 climate amendment, through 12 modules and 36 complete text lessons. Learn confidentiality, integrity and availability; context and obligations; leadership; risk assessment and treatment; the Statement of Applicability; support and operation; and all four Annex A control themes. Apply the learning to access, information sharing, suppliers, cloud services, phishing, remote work, incidents and recovery. Worked calculations, practice activities and feedback support every module. Complete a 40-question quiz and a practical case assignment with a marking rubric. Estimated workload: 6.5 hours. Successful completion earns a W3 course-completion certificate.

LO01: Explain information security, the CIA principles and the purpose and structure of an ISMS.
LO02: Connect organizational context, interested parties, obligations and scope, including climate relevance.
LO03: Recognize leadership commitments, policy responsibilities and appropriate escalation.
LO04: Explain risk assessment, treatment, residual risk and a defensible Statement of Applicability.
LO05: Connect objectives and planned changes to resources, competence, awareness, communication and records.
LO06: Recognize effective operational control, risk reassessment and treatment evidence.
LO07: Apply organizational controls to information handling, access, suppliers, cloud services and incidents.
LO08: Apply people and physical security practices, including remote work and social-engineering response.
LO09: Explain practical technology controls and the evidence needed to show that they work.
LO10: Interpret recovery and performance measures without overstating what the data proves.
LO11: Explain internal audit, management review, correction, corrective action and continual improvement.
LO12: Evaluate a connected information-security case and prepare a role-appropriate action plan.

Course Content

Information security foundations
The learning journey, confidentiality, integrity, availability and the ISO/IEC 27001 management-system structure.

Start here: your learning journey
Confidentiality, integrity and availability
How ISO/IEC 27001 fits together

Context, obligations and scope
Clauses 4.1–4.4: business context, climate relevance, interested parties, requirements, boundaries and interfaces.

Leadership and accountability
Clauses 5.1–5.3: leadership decisions, information-security policy, responsibilities and escalation.

Risk assessment and treatment
Clauses 6.1.1–6.1.3: risk criteria, assessment, treatment, residual risk and the Statement of Applicability.

Objectives, changes and support
Clauses 6.2, 6.3 and 7.1–7.5: objectives, planned changes, competence, awareness, communication and records.

Operating the ISMS
Clauses 8.1–8.3: controlled processes, reassessment, treatment implementation and evidence.

Organizational controls
Annex A.5: information handling, access, suppliers, cloud services and incident management.

People and physical controls
Annex A.6 and A.7: employment, remote work, social engineering, premises and equipment.

Technology controls
Annex A.8: identity protection, secure configuration, data protection, monitoring and secure development.

Resilience and performance evaluation
Recovery practice and clause 9.1 monitoring, including worked recovery and performance calculations.

Audit, review and improvement
Clauses 9.2, 9.3, 10.1 and 10.2: internal audit, management review, corrective action and improvement.

Apply your learning
Integrated case, practical assignment preparation, final quiz instructions and a workplace action plan.

Assessment

Add this certificate to your resume to demonstrate your skills & increase your chances of getting noticed.

Student Ratings & Reviews

No Review Yet

Share this course

About Course

What Will You Learn?

Course Content

Information security foundations The learning journey, confidentiality, integrity, availability and the ISO/IEC 27001 management-system structure.

Start here: your learning journey

Confidentiality, integrity and availability

How ISO/IEC 27001 fits together

Context, obligations and scope Clauses 4.1–4.4: business context, climate relevance, interested parties, requirements, boundaries and interfaces.

Business context and climate relevance

Interested parties and relevant requirements

Scope, boundaries and interfaces

Leadership and accountability Clauses 5.1–5.3: leadership decisions, information-security policy, responsibilities and escalation.

Leadership decisions that support security

Policy that people can apply

Responsibilities, separation and escalation

Risk assessment and treatment Clauses 6.1.1–6.1.3: risk criteria, assessment, treatment, residual risk and the Statement of Applicability.

Identify and assess information-security risks

Treat risks and accept what remains

The Statement of Applicability in practice

Objectives, changes and support Clauses 6.2, 6.3 and 7.1–7.5: objectives, planned changes, competence, awareness, communication and records.

Objectives and planned changes

Resources, competence and awareness

Communication and controlled information

Operating the ISMS Clauses 8.1–8.3: controlled processes, reassessment, treatment implementation and evidence.

Control everyday operations

Reassess risks when conditions change

Implement treatment and verify evidence

Organizational controls Annex A.5: information handling, access, suppliers, cloud services and incident management.

Handle information and access responsibly

Suppliers, cloud services and shared responsibilities

Recognize, report and respond to incidents

People and physical controls Annex A.6 and A.7: employment, remote work, social engineering, premises and equipment.

People security and remote work

Suspicious messages, calls and payment requests

Premises, equipment and physical information

Technology controls Annex A.8: identity protection, secure configuration, data protection, monitoring and secure development.

Protect accounts, endpoints and configurations

Protect data and use logs meaningfully

Secure development, testing and release

Resilience and performance evaluation Recovery practice and clause 9.1 monitoring, including worked recovery and performance calculations.

Maintain security during disruption and recovery

Measure performance that matters

Read percentages and recovery results carefully

Audit, review and improvement Clauses 9.2, 9.3, 10.1 and 10.2: internal audit, management review, corrective action and improvement.

Internal audit: requirements and evidence

Management review and decisions

Correction, corrective action and continual improvement

Apply your learning Integrated case, practical assignment preparation, final quiz instructions and a workplace action plan.

Integrated practice: the customer-records incident

Prepare your practical case submission

Final review and your workplace action plan