ISO 27005 Lead Auditor Course Outline
Module 1: Introduction to ISO 27005 Standard
- Introduction
- Concepts, Key Definitions, and Background
- Quality Management System (QMS)
- Information Security Risk Management
- Role and Importance
- Understanding the Situation in an Organisation
- Reviewing and Monitoring
- Octave Method
- EBIOS Method
- MEHARI
- Harmonised TRA Method
Module 2: Interaction with Other ISO
- How ISO 27005 Interacts with ISO 27001?
- Quantifying the Business Impact
- Impact Severity
Module 3: Planning Individual Internal Audits
- Internal Audit Approach
- Risk Assurance Mapping
- Audit Plan
- Research the Audit Area
- Conduct Process Walk-Throughs
- Map Risks to the Organisation, Process, or Function
- Obtain Data Prior to Fieldwork
Module 4: Conducting Internal Audit and Handling the Interview Process
- Identify Risks
- Plan and Audit Activities
- Validate the Facts and Complete the Work
- Develop a Deliverable or Report that will Drive Action
- Follow Up
Module 5: Understanding Risk Management in an Internal Audit
- Introduction
- Risk Management Process
Module 6: Preparation of an ISO 27005 Audit
- Define Audit Objectives and Scope
- Select Audit Criteria
- Establish Audit Teams
- Develop Audit Plan
Module 7: Conducting an ISO 27005 Audit
- Risk Management Process
- Context Establishment
- Risk Assessment
- Risk Treatment
- Risk Acceptance
- Risk Communication and Consultation
- Risk Monitoring and Review
Module 8: Closing an ISO 27005 Audit
- Prepare Audit Report
- Distribute Audit Report
- Conduct Audit Follow-up
Module 9: Managing an ISO 27005 Audit Program
- Know What and When to Audit
- Create an Audit Schedule
- Pre-Planning the Scheduled Audit
- Conducting the Audit
- Record the Findings
- Report Findings
Module 10: Key Concepts, Terminology, and Definitions Lead Implementer
Module 11: Introduction to Risk Management
- Monitoring and Reviewing Potential Risks
- Risk Management Methodologies
- Information Security Risk Management Framework and Process Model
- Information Assets Classification, Identification, and Threats
- Threat Vulnerabilities
- Controls
- Controlling Vulnerabilities
- Vulnerability Categories and Sources
- Consequences of Vulnerabilities
- Incident Scenarios
- Types of Vulnerabilities
- Methods for Risk Assessment
- Scales and Simple Calculations
- Acceptance Strategies
- Improvement of Risk Assessment and Risk Management
- Risk Assessment and Risk Management
- Implementation of Risk Management Programmes
- Risk Communication and Consultation
- Communicating Risk
- Principles of Risk Communication
- Accurate Communication
- Risk Communication Procedures
Module 12: Risk Identification and Analysis
- Risk Analysis and Scoring
- Risk Identification
- Risk Estimation
- Risk Assessment Techniques
- Assumptions Analysis
- Checklist Analysis
- SWOT Analysis
- Prompt Lists
- Interviewing and Brainstorming
Module 13: Role and Responsibilities of a Risk Manager
- Risk Acceptance and Making Changes
- Information Security
- Types of Risks and Associated Threats
- Security Controls and Measures
- Scope and Boundaries of Process
- Constraints that Affect an Organisation
- Impact of Risks
- Information Security Risk Management
- Train and Make Employees Aware of Risks
Module 14: Identifying, Evaluating, and Treating Risk Specified in ISO 27005
- Risk Treatment
- Mitigating Control Measures
- Risk Analysis Tools and Evaluation
Module 15: Role of an Auditor
- Qualifications of an Auditor
- IRCA Code of Conduct
- Internal and External Audits
- Roles and Responsibilities of a Lead Auditor
Module 16: Preparation and Planning of an Audit
- Auditing Definition
- Pre-Audit
- Setting Audit Standards
- Defining Targets
Module 17: Review and Monitoring
- Monitoring and Logging
- Intrusion and Penetration Testing
Module 18: Auditing Principles and Techniques
- Auditing Principles
- Auditing Techniques
- Gap Analysis
- Gap Analysis Process
- 5-Whys
- Communication Planning
- Audit Steps
- Plans and Programs
- Activities of an Auditor
- Verification Techniques
- Inspection Writing
Module 19: Closure of Audit
- Report Evaluation
- Follow-up Actions
- Auditing Results
- Higher Management
- Audit Evidence and Findings
- Audit Follow-up