Introduction:

ISO/IEC 27002 is an international standard that provides a structured framework for selecting and managing information security controls. It supports organizations in protecting the confidentiality, integrity, and availability of data while aligning with global compliance requirements. This training program provides comprehensive instruction on how to apply these controls across organizational environments. It enables participants to identify security risks, manage protective measures, and ensure the security of critical information assets.

Program Objectives:

At the end of this program, participants will be able to:

Identify the information security controls and control rules in accordance with ISO/IEC 27002 standards.
Explore of the methods and processes employed in the establishment and efficient administration of information security controls
Acquire the knowledge required to assist a business in organizing, putting into place, and administering information security measures.
Identify the value of risk management in identifying the best information security controls.
Evaluate the compliance, audit, and continual improvement processes necessary to maintain and enhance information security controls in accordance with ISO/IEC 27002.

Targeted Audience:

Managers or consultants who want to establish information security controls in an ISMS built on ISO/IEC 27001.
Employees in charge of preserving an organization's information security, compliance, risk, or governance.
IT consultants or professionals.
Information security or ISMS deployment team members.

Program Outline:

Unit 1:

Introduction to ISO/IEC 27002 Information Security Controls:

The importance of information security controls.
Overview of ISO/IEC 27002 standards.
Identifying the scope and objectives of information security controls.
Exploring the relationship between ISO/IEC 27001 and ISO/IEC 27002.
Introduction to the structure and content of ISO/IEC 27002.

Unit 2:

Governance and Management of Information Security Controls:

How to establish an information security management system (ISMS).
Defining roles, responsibilities, and governance structures.
How to implement policies, procedures, and processes for information security.
How to conduct risk assessments and managing risk.
Monitoring, measuring, and reviewing criteria of the effectiveness of information security controls.

Unit 3:

Asset Management and Access Control:

The process of identifying and classifying information assets.
How to implement controls for the management of information assets.
Key activities used for enforcing access controls and user management.
Frameworks for managing privileged access and user responsibilities.
Monitoring techiques and auditing access principles to information assets.

Unit 4:

Operational Security and Incident Management:

How to implement controls for secure operations.
Key activities used for managing secure configuration and change management.
Protection measures of information during operations.
Incident management mechanisms and response procedures.
How to achieve business continuity planning and disaster recovery.

Unit 5:

Compliance, Audit, and Continual Improvement:

Ensuring compliance with legal, regulatory, and contractual requirements.
The significant role of conducting internal and external audits of information security controls.
The process of monitoring and reviewing compliance with ISO/IEC 27002 standards.
Importance of continually improving the effectiveness of information security controls.

ISO IEC 27002 Information Security Controls