ISO 27701 Lead Implementer Training - United States

ISO 27701 Lead Implementer Training Course Outline

Module 1: Introduction to ISO 27701

• Introduction
• Scope
• Terms, Definitions, and Abbreviations

Module 2: General

• Structure of this Document
• Application of ISO/IEC 27001:2013 Requirements
• Application of ISO/IEC 27002:2013 Guidelines
• Customer

Module 3: Information Management

• What is Information Management?
• Importance of Information Management
• Areas of Information Management
• Challenges Involved in Information Management

Module 4: PIMS-Specific Requirements Related to ISO/IEC 27001

• General
• Context of the Organization
• Leadership
• Planning
• Support
• Operation
• Performance Evaluation
• Improvement

Module 5: PIMS-Specific Guidance Related to ISO/IEC 27002

• General
• Information Security Policies
• Organization of Information Security
• Human Resource Security
• Asset Management
• Access Control
• Cryptography
• Physical and Environmental Security
• Operations Security
• Communications Security
• Systems Acquisition, Development, and Maintenance
• Supplier Relationships
• Information Security Incident Management
• Information Security Aspects of Business Continuity Management
• Compliance

Module 6: Personally Identifiable Information (PII)

• What is Personally Identifiable Information (PII)?
• Compliance Environment
• PII Security Controls
• Sensitive Vs Non-Sensitive PII
• Safeguarding PII
• PII Vs Personal Data

Module 7: Introduction to Internal Auditing

• What is Internal Audit?
• Who is Internal Auditor?
• Types of Internal Audit
• Internal Audit Functions
• Internal Vs External Audit

Module 8: Information System Audit

• Need for Information System Audit
• Information System Auditing Standards
• Auditing Guidelines

Module 9: Audit Preparation and Planning

• Audit Scope and Charter
• Audit Planning
• Risk-Based Approach
• Audit Staffing
• Audit Schedule
• Communication of Audit Plan
• Computer Assisted Auditing Techniques

Module 10: Information Security Risk Assessment

• Introduction to Risk Management
• Why Perform an Information Security Risk Assessment?
• Principles of Risk Assessment
• Risk Assessment Process
• Quantitative Vs Qualitative Security Risk Assessment Methods

Module 11: Additional ISO/IEC 27002 Guidance for PII Controllers and Processors

• General
• Conditions for Collection and Processing
• Obligations to PII Principals
• Privacy by Design and Privacy by Default
• PII Sharing, Transfer, and Disclosure

Module 12: Implementation of Information Management System

• Steps for Successful Systems Implementation
• Considerations When Implementing an Information Management System
• Potential Pitfalls of New IT System Implementation

Module 13: Implement ISO 27701

• Requirements of ISO 27701
• Why Implementing ISO 27701:2019 Matters?
• Managing Personal Information with ISO/IEC 27701
• Common Fallacies in Implementing ISO 27701
• Maintenance and Continuous Improvement

Module 14: Correlation Between ISO/IEC 27701, ISO/IEC 27001, and ISO/IEC 27002

• Relationship Between ISO/IEC 27701, ISO/IEC 27001, and ISO/IEC 27002
• How Does ISO 27701 Relate to ISO 27001?
• Implement Security Controls
• Be Compliant with the GDPR, ISO 27001, and ISO 27002

Module 15: PII Compliance

• What is PII Compliance?
• PII Data Classification
• PII Compliance Checklist
• Identify and Classify PII
• Create a PII Compliance Policy
• Implement Data Security Tools
• Practice IAM
• Monitor and Respond

Module 16: Logging and Monitoring

• Event Logging
• References ISO 27002 Control 8.15
• Event Types
• Log Protection
• Log Analysis
• Log Monitoring
• Protection of Log Information
• Clock Synchronization