ISO 27001:2022-Compliant Cybersecurity: Getting Started

Course details

Discover why the ISO 27001-2022 standard is one of the most popular frameworks for building effective cybersecurity programs and learn what it takes to comply with and get certified as compliant with this standard. In this course, cybersecurity director Marc Menninger provides an overview of how to build an ISO 27001-2022-compliant cybersecurity program. Learn what this standard is and discover why it is used around the world as the guidebook for constructing information security programs that work. Dive into how the standard is organized and get a description of the certification process. Explore a step-by-step plan that you can follow if you want to build a cybersecurity program that complies with the ISO 2700-2022 standard. Additionally, go over gaps and criticisms of the standard and examine ways to fill those gaps. With the information in this course, you can begin to build a cybersecurity program that is both effective and compliant with ISO 27001-2022.

Concepts

0. Introduction

01 - The international standard for information security
02 - Who this course is for and prerequisites

1. ISO 27001 Overview

03 - What is the ISO 27001 standard
04 - Breaking down the ISO 27001 standard
05 - Why build an ISO 27001-compliant cybersecurity program
06 - ISO 27001 gaps and criticisms
07 - ISO 27001 - 2013 and ISO 27001 - 2022 differences and mapping

2. Complying with ISO 27001

08 - ISO 27001 compliance and certification
09 - What to expect when getting ISO 27001 certified
10 - Building your ISO 27001 compliance plan
11 - Begin the ISO 27001 compliance process - Introduction to Clauses 4 through 10

3. Context of the Organization (Clause 4)

12 - Context of the organization and needs of interested parties (Clauses 4.1 and 4.2)
13 - The information security management system (ISMS) and its scope (Clauses 4.3 and 4.4)

4. Leadership (Clause 5)

14 - Leadership and commitment (Clause 5.1)
15 - Policy (Clause 5.2)
16 - Organizational roles, responsibilities, and authorities (Clause 5.3)

5. Planning (Clause 6)

17 - Information security risk assessment (Clause 6.1.2)
18 - Information security risk treatment (Clause 6.1.3)
19 - Information security objectives and planning to achieve them (Clause 6.2)

6. Support and Operation (Clauses 7 and 8)

20 - Resources, competence, and awareness (Clauses 7.1, 7.2, and 7.3)
21 - Communication (Clause 7.4)
22 - Documented information (Clause 7.5)
23 - Operational planning and control, risk assessment, and risk treatment (Clauses 8.1, 8.2, and 8.3)

7. Performance Evaluation and Improvement (Clauses 9 and 10)

24 - Monitoring, measurement, analysis, and evaluation (Clause 9.1)
25 - Internal audit (Clause 9.2)
26 - Management review (Clause 9.3)
27 - Nonconformity, corrective actions, and continual improvement (Clauses 10.1 and 10.2)

Conclusion

28 - Continuing your ISO 27001 compliance journey