ISO/IEC 27001 Lead Implementer

Outcomes

• Pass the TRECCERT® ISO/IEC 27001 Lead Implementer exam
• Lead an ISO 27001 implementation project from scratch
• Define your ISMS scope, conduct a gap analysis
• Perform a complete risk assessment
• Implement all 93 Annex A controls from ISO 27002:2022
• Prepare your organization for the Stage 1 and Stage 2 audit

What's included?

• Access to video course

  On-demand access to 12 hours of video lessons.

• Exam Voucher + 1 Free Retake

  Become a certified TRECCERT® ISO/IEC 27001 Lead Implementer with the included voucher, backed by a free retake option.

• Training Material

  Master ISO/IEC 27001 at your own pace with the official TRECCERT® 500-page training material.

• 1 Practice Exam

  Our practice exam is designed to closely mirror the style and format of the real exam, so you can prepare with confidence.

• ISO 27001 Toolkit

  Kickstart your ISO 27001 project with ready-to-use templates and a structured project plan, minimizing setup time and reducing costs.

Courses

ISO/IEC 27001 Lead Implementer

22 sections • 218 lessons

View curriculum

Course Introduction

1.Welcome to the Course

2.Course Disclaimer

3.TRECCERT ISO/IEC 27001 Lead Implementer Certification

4.TRECCERT ISO/IEC 27001 Lead Implementer Exam

Course Resources

1.ISO/IEC 27001 Toolkit

2.Project Plan

3.Policy Templates

4.Process Templates

5.Record Templates

6.Mind Map Collection

7.Bonus Resources

Chapter 1: Information Security Fundamentals

1.Chapter 1 Overview

2.Information Assets

3.What is Information Security?

4.The CIA Triad

5.Authenticity and Nonrepudiation

6.QUIZ: Review Questions: Chapter 1

7.Chapter 1 Summary

Chapter 2: ISO/IEC 27001

1.Chapter 2 Overview

2.Management Systems

3.Information Security Management Systems

4.International Standards

5.ISO/IEC 27000 Family of Standards

6.ISO/IEC 27001 Overview

7.History of ISO/IEC 27001

8.Other Frameworks worth knowing

9.QUIZ: Review Questions: Chapter 2

10.Chapter 2 Summary

Chapter 3: Implementation Project

1.Chapter 3 Overview

2.Normative Requirements

3.Clause 7.5 Documented Information

4.Project Deliverables

5.Implementation Project

6.QUIZ: Review Questions: Chapter 3

7.Chapter 3 Summary

Step 1: Scope of the ISMS

1.Step 1 Overview

2.Context Analysis Process

3.Clause 4.1 Understanding the Organization and its Context

4.Clause 4.2 Understanding the Needs and Expectations of interested Parties

5.Control A.5.31 Legal, statutory, regulatory and contractual Requirements

6.Clause 4.3 Determining the Scope of the ISMS

7.Clause 4.4 Information Security Management System

8.QUIZ: Review Questions: Step 2

9.BlitzX Engineering - Company Profile

10.Case Study: Scope of the ISMS

11.Step 1 Summary

Step 2: Gap Analysis

1.Step 2 Overview

Step 3: Management Support

1.Step 3 Overview

2.Business Case

3.Clause 5.1 Leadership and Commitment

4.Clause 5.3 Organizational Roles, Responsibilities and Authorities

5.Information Security Governance Process

6.QUIZ: Review Questions: Step 1

7.Step 3 Summary

Step 4: Information Security Policy

1.Step 4 Overview

2.Clause 6.2 Information Security Objectives

3.Clause 5.2 Policy

4.Policy Management Process

5.Clause 7.4 Communication

6.Communication Process

7.QUIZ: Review Questions: Step 4

8.Case Study: Information Security Objectives

9.Step 4 Summary

Step 5: Competence Assurance

1.Step 5 Overview

2.Clause 7.2 Competence

3.Clause 7.3 Awareness

4.Control A.6.3 Information Security Awareness, Education and Training

5.Security Awareness and Training Process

6.QUIZ: Review Questions: Step 5

7.Step 5 Summary

Step 6: Inventory of Assets

1.Step 6 Overview

2.A.5.9 Inventory of Information and other Associated Assets

3.A.5.12 Classification of Information

4.A.5.13 Labelling of Information

5.QUIZ: Review Questions: Step 6

6.Case Study: Asset Inventory

7.Step 6 Summary

Step 7: Risk Management Methodology

1.Step 7 Overview

2.Risk Management Fundamentals

3.Risk Management Process

4.6.1.1 General

5.6.1.2 Information Security Risk Assessment

6.Risk Assessment Process

7.6.1.3 Information Security Risk Treatment

8.Risk Treatment Process

9.QUIZ: Review Questions: Step 7

10.Step 7 Summary

Step 8: Information Security Risk Assessment

1.Step 8 Overview

2.Clause 8.2 Information Security Risk Assessment

3.Threats

4.Vulnerabilities

5.Case Study: Risk Assessment

6.Step 8 Summary

Step 9: Information Security Risk Treatment

1.Step 9 Overview

2.Clause 7.1 Resources

3.Resource Management Process

4.Security Controls

5.Annex A

6.Clause 8.3 Information Security Risk Treatment

7.Case Study: Risk Treatment

8.QUIZ: Review Questions: Step 9

9.Step 9 Summary

Step 10: Performance Evaluation

1.Step 10 Overview

2.Clause 9.1 Monitoring, Measurement and Analysis

3.Performance Evaluation Process

4.Clause 9.2 Internal Audit

5.Internal Audit Process

6.Clause 9.3 Management Review

7.Management Review Process

8.QUIZ: Review Questions: Step 10

Step 11: Summary

1.Step 11 Overview

2.Clause 10.1 Continual Improvement

3.Clause 10.2 Nonconformity and Corrective Action

4.ISMS Improvement Process

5.QUIZ: Review Questions: Step 11

Step 12: Certification Audit

1.Step 12 Overview

2.Certification Process

3.QUIZ: Review Questions: Step 12

4.Step 12 Summary

Annex A: 5. Organizational Controls

1.A.5 Organizational Controls

2.A.5.1 Policies for information security

3.A.5.2 Information security roles and responsibilities

4.A.5.3 Segregation of duties

5.A.5.4 Management responsibilities

6.A.5.5 Contact with authorities

7.A.5.6 Contact with special interest groups

8.A.5.7 Threat intelligence

9.A.5.8 Information security in project management

10.A.5.9 Inventory of information and other associated assets

11.A.5.10 Acceptable use of information and other associated assets

12.A.5.11 Return of assets

13.A.5.12 Classification of information

14.A.5.13 Labelling of information

15.A.5.14 Information transfer

16.A.5.15 Access control

17.A.5.16 Identity management

18.A.5.17 Authentication information

19.A.5.18 Access rights

20.A.5.19 Information security in supplier relationships

21.A.5.20 Addressing information security within supplier agreements

22.A.5.21 Managing information security in the information and communication technology supply chain

23.A.5.22 Monitoring, review and change management of supplier services

24.A.5.23 Information security for use of cloud services

25.A.5.24 Information security incident management planning and preparation

26.A.5.25 Assessment and decision on information security events

27.A.5.26 Response to information security incidents

28.A.5.27 Learning from information security incidents

29.A.5.28 Collection of evidence

30.A.5.29 Information security during disruption

31.A.5.30 ICT readiness for business continuity

32.A.5.31 Legal, statutory, regulatory and contractual requirements

33.A.5.32 Intellectual property rights

34.A.5.33 Protection of records

35.A.5.34 Privacy and protection of personal identifiable information (PII)

36.A.5.35 Independent review of information security

37.A.5.36 Compliance with policies, rules and standards for information security

38.A.5.37 Documented operating procedures

Annex A: 6. People Controls

1.A.6 People Controls

2.A.6.1 Screening

3.A.6.2 Terms and Conditions of Employment

4.A.6.3 Information Security Awareness, Education and Training

5.A.6.4 Disciplinary Process

6.A.6.5 Responsibilities after Termination or Change of Employment

7.A.6.6 Confidentiality or Non-Disclosure Agreements

8.A.6.7 Remote Working

9.A.6.8 Information Security Event Reporting

Annex A: 7. Physical Controls

1.A.7 Physical Controls

2.A.7.1 Physical Security Perimeters

3.A.7.2 Physical Entry

4.A.7.3 Securing Offices, Rooms and Facilities

5.A.7.4 Physical Security Monitoring

6.A.7.5 Protecting against Physical and Environmental Threats

7.A.7.6 Working in Secure Areas

8.A.7.7 Clear Desk and Clear Screen

9.A.7.8 Equipment Siting and Protection

10.A.7.9 Security of Assets Off-Premises

11.A.7.10 Storage Media

12.A.7.11 Supporting Utilities

13.A.7.12 Cabling Security

14.A.7.13 Equipment Maintenance

15.A.7.14 Secure Disposal or Re-Use of Equipment

Annex A: 8. Technological Controls

1.A.8 Technological Controls

2.A.8.1 User Endpoint Devices

3.A.8.2 Privileged Access Rights

4.A.8.3 Information access restriction

5.A.8.4 Access to source code

6.A.8.5 Secure authentication

7.A.8.6 Capacity management

8.A.8.7 Protection against malware

9.A.8.8 Management of technical vulnerabilities

10.A.8.9 Configuration management

11.A.8.10 Information deletion

12.A.8.11 Data masking

13.A.8.12 Data leakage prevention

14.A.8.13 Information backup

15.A.8.14 Redundancy of information processing facilities

16.A.8.15 Logging

17.A.8.16 Monitoring activities

18.A.8.17 Clock synchronization

19.A.8.18 Use of privileged utility programs

20.A.8.19 Installation of software on operational systems

21.A.8.20 Networks security

22.A.8.21 Security of network services

23.A.8.22 Segregation of networks

24.A.8.23 Web filtering

25.A.8.24 Use of cryptography

26.A.8.25 Secure development life cycle

27.A.8.26 Application security requirements

28.A.8.27 Secure system architecture and engineering principles

29.A.8.28 Secure coding

30.A.8.29 Security testing in development and acceptance

31.A.8.30 Outsourced development

32.A.8.31 Separation of development, test and production environments

33.A.8.32 Change management

34.A.8.33 Test information

35.A.8.34 Protection of information systems during audit testing

Practice Exam

1.QUIZ: Full-length Practice Exam

2.How to maintain a TRECCERT Certification?

See all sections

Who is this for?

• Security managers, IT leads, and compliance officers responsible for an ISO 27001 implementation project.
• Professionals preparing for the TRECCERT® ISO/IEC 27001 Lead Implementer certification exam.
• Consultants and advisors guiding clients through ISO 27001 certification for the first time.
• Anyone who has read the standard but doesn't know where to start or what to do.
• Risk and GRC professionals looking to add ISO 27001 implementation skills to their practice.