ISO 27005 Lead Auditor - Costa Rica

ISO 27005 Lead Auditor Course Outline

Module 1: Introduction to ISO 27005 Standard

• Introduction
• Concepts, Key Definitions, and Background
• Quality Management System (QMS)
• Information Security Risk Management
• Role and Importance
• Understanding the Situation in an Organisation
• Reviewing and Monitoring
• Octave Method
• EBIOS Method
• MEHARI
• Harmonised TRA Method

Module 2: Interaction with Other ISO

• How ISO 27005 Interacts with ISO 27001?
• Quantifying the Business Impact
• Impact Severity

Module 3: Planning Individual Internal Audits

• Internal Audit Approach
• Risk Assurance Mapping
• Audit Plan
• Research the Audit Area
• Conduct Process Walk-Throughs
• Map Risks to the Organisation, Process, or Function
• Obtain Data Prior to Fieldwork

Module 4: Conducting Internal Audit and Handling the Interview Process

• Identify Risks
• Plan and Audit Activities
• Validate the Facts and Complete the Work
• Develop a Deliverable or Report that will Drive Action
• Follow Up

Module 5: Understanding Risk Management in an Internal Audit

• Introduction
• Risk Management Process

Module 6: Preparation of an ISO 27005 Audit

• Define Audit Objectives and Scope
• Select Audit Criteria
• Establish Audit Teams
• Develop Audit Plan

Module 7: Conducting an ISO 27005 Audit

• Risk Management Process
  • Context Establishment
  • Risk Assessment
  • Risk Treatment
  • Risk Acceptance
  • Risk Communication and Consultation
  • Risk Monitoring and Review

Module 8: Closing an ISO 27005 Audit

• Prepare Audit Report
• Distribute Audit Report
• Conduct Audit Follow-up

Module 9: Managing an ISO 27005 Audit Program

• Know What and When to Audit
• Create an Audit Schedule
• Pre-Planning the Scheduled Audit
• Conducting the Audit
• Record the Findings
• Report Findings

Module 10: Key Concepts, Terminology, and Definitions Lead Implementer

• Internal Context
• Risk

Module 11: Introduction to Risk Management

• Monitoring and Reviewing Potential Risks
• Risk Management Methodologies
• Information Security Risk Management Framework and Process Model
• Information Assets Classification, Identification, and Threats
• Threat Vulnerabilities
• Controls
• Controlling Vulnerabilities
• Vulnerability Categories and Sources
• Consequences of Vulnerabilities
• Incident Scenarios
• Types of Vulnerabilities
• Methods for Risk Assessment
• Scales and Simple Calculations
• Acceptance Strategies
• Improvement of Risk Assessment and Risk Management
• Risk Assessment and Risk Management
• Implementation of Risk Management Programmes
• Risk Communication and Consultation
• Communicating Risk
• Principles of Risk Communication
• Accurate Communication
• Risk Communication Procedures

Module 12: Risk Identification and Analysis

• Risk Analysis and Scoring
• Risk Identification
• Risk Estimation
  • Methodologies
  • Components
• Risk Assessment Techniques
• Assumptions Analysis
• Checklist Analysis
• SWOT Analysis
• Prompt Lists
• Interviewing and Brainstorming

Module 13: Role and Responsibilities of a Risk Manager

• Risk Acceptance and Making Changes
• Information Security
• Types of Risks and Associated Threats
• Security Controls and Measures
• Scope and Boundaries of Process
• Constraints that Affect an Organisation
• Impact of Risks
• Information Security Risk Management
• Train and Make Employees Aware of Risks

Module 14: Identifying, Evaluating, and Treating Risk Specified in ISO 27005

• Risk Treatment
• Mitigating Control Measures
• Risk Analysis Tools and Evaluation

Module 15: Role of an Auditor

• Qualifications of an Auditor
• IRCA Code of Conduct
• Internal and External Audits
• Roles and Responsibilities of a Lead Auditor

Module 16: Preparation and Planning of an Audit

• Auditing Definition
• Pre-Audit
• Setting Audit Standards
• Defining Targets

Module 17: Review and Monitoring

• Monitoring and Logging
• Intrusion and Penetration Testing

Module 18: Auditing Principles and Techniques

• Auditing Principles
• Auditing Techniques
• Gap Analysis
• Gap Analysis Process
• 5-Whys
• Communication Planning
• Audit Steps
• Plans and Programs
• Activities of an Auditor
• Verification Techniques
• Inspection Writing

Module 19: Closure of Audit

• Report Evaluation
• Follow-up Actions
• Auditing Results
• Higher Management
• Audit Evidence and Findings
• Audit Follow-up