Course Introduction:

This five-day intensive course enables participants to develop the expertise needed to audit an Information Security Management System (ISMS) and to manage a team of auditors by applying widely recognized audit principles, procedures and techniques.

During this training, the participant will acquire the skills and knowledge needed to proficiently plan and perform audits compliant with the certification process of the ISO/IEC 27001:2005 standard. Based on practical exercises, the participant will develop the abilities (mastering audit techniques) and skills (managing audit teams and audit program, communicating with customers, conflict resolution, etc.) necessary to the efficient conducting of an audit.

This course is using PECB accredited course materials (an ANSI applicant personal acceditation body for ISO17024) and is ofered in partnership with PECB

• Maximum number of students: 10
• A copy of the ISO 19011, ISO 27001 and ISO 27002 standards will be provided to participants.
• A certificate of attendance will be given to participants who successfully pass the examination (certified by PECB)

Course Description:

Day 1: Introduction to the management of an Information Security Management System (ISMS)

• Normative, regulatory and legal framework related to Information Security
• Fundamental principles of Information Security
• The ISO/IEC 27001:2005 certification process
• The Information Security Management System (ISMS)
• Detailed presentation of the clauses 4 to 8 of the ISO/IEC 27001:2005 standard

Day 2: Planning and Launching an ISO 27001 audit

• Fundamental concepts and principles of auditing
• Audit approach based on evidence and on risk
• Preparation of an ISO/IEC 27001:2005 certification audit
• Documentation of an ISMS audit
• Conducting an opening meeting

Day 3: Conducting an ISO 27001 audit

• Communication during the audit
• Audit procedures: observation, document review, interview, sampling techniques, technical verification, corroboration and evaluation
• Drafting test plans
• Formulation of audit findings
• Drafting of nonconformity reports

Day 4: Concluding and ensuring the follow-up of an ISO 27001 audit

• Audit Documentation
• Quality Review
• Conducting a closing meeting and Conclusion of an ISO/IEC 27001:2005 audit
• Evaluation of corrective action plans
• Surveillance Audit
• Audit management program

Day 5: Examination

The “ISO/IEC 27001:2005 Lead Auditor” exam is certified by PECB and covers the following domains of knowledge:

• Domain 1: Fundamental principles and concepts in information security
• Domain 2: Information Security Management System (ISMS)
• Domain 3: Fundamental Audit Concepts and Principles
• Domain 4: Audit approach based on evidence and risk
• Domain 5: Writing conclusions and nonconformity reports

3-hour examination leading to certification as an ISO 27001 Lead Auditor. The training course and examination are accredited by PECB, a US certification body.

After successfully completing the exam, the participant can apply for the title of ISO 27001 Provisional Auditor, ISO 27001 Auditor or ISO 27001 Lead Auditor depending on their experience

A participant can register as PECB auditor

Audience:

Anyone interested in implementing a management system as specified in ISO 27001:2005

• Auditor wanting to perform and lead an Information Security Management System (ISMS) audits as the responsible of an audit team
• Project manager or consultant wanting to master the Information Security Management System audit process
• Person responsible for the Information security or conformity in an organization
• Member of the information security team
• Expert advisor in information technology
• Technical expert wanting to prepare for an Information security audit function

Prerequisites:

The ISMS Foundation course or basic knowledge of the ISO 27001 and ISO 27002 standards is recommended.

Accreditaion:

The PECB certification exam is included with the purchase of this course. Instructions on scheduling the exam are provided upon course completion.

Course activities:

• Pre-course work might be required; during course, 2-3 hours of evening work is required in order to take the exam
• Classroom lecturing.
• Individual and group assignments.
• Exam preparation session