ISO 27001

6 Interactive Sessions

Short, interactive sessions: watch it work, try it, then build it yourself. You can go deeper at any time in the written chapters.

1. 1

   What ISO 27001 is

   ISO 27001 is an international standard you can be certified against. At its centre is a way of running security that you repeat and improve, with the controls following from it.

2. 2

   Decide what your ISMS covers

   The scope is the boundary of what your ISMS covers. Draw it wide enough that the certificate means something to buyers, and tight enough that you can actually achieve it.

3. 3

   Let your risks choose your controls

   ISO 27001 starts from risk. You find the risks to your information, decide what to do about each one, and the controls you use follow from that. The Statement of Applicability records the reasons.

4. 4

   The controls in Annex A

   Annex A is a list of 93 controls sorted into four themes: Organizational, People, Physical and Technological. Most are the same basic controls other frameworks ask for, and you use the ones your risk assessment calls for.

5. 5

   Prove that your ISMS runs

   You earn the certificate by proving your controls work: written evidence, an internal audit you run on yourself, a review by your leaders, and a habit of fixing what you find.

6. 6

   Get certified and stay certified

   An accredited body audits your ISMS in two stages and issues a certificate that usually runs for three years, with check-in audits along the way. Keep the ISMS running, or you lose the certificate.

How this certificate is scored

Your certificate shows how many of your written answers met the rubric below, checked by an AI grader. Anyone who checks your certificate sees it.

• You answer 6 short questions, one for each module, in your own words (at least 40 words each).
• An AI grader checks each answer against what its module asks for: it must answer the question, use the course's practice case specifically, and be correct.
• To pass, at least 5 of the 6 answers must meet that bar. The certificate says the answers were graded by AI.

The rubric

1. Module 1, What ISO 27001 Is: A correct model: an ISMS certification (not a report), the trust cert for Europe.
2. Module 2, Scope & the ISMS: A right-sized ISMS scope, its context, and leadership behind it.
3. Module 3, Risk Assessment & the SoA: A risk-driven Statement of Applicability mapping every control to a risk.
4. Module 4, The Controls (Annex A): The Annex A controls mapped by theme to your ISMS.
5. Module 5, Evidence, Internal Audit & Review: An internal-audit, management-review, and continual-improvement rhythm.
6. Module 6, Certification & Staying Certified: A plan for the Stage 1/2 audit and the surveillance cycle that keeps it.

What you walk away with