ISO 27001:2022 - Audit: Information Security Management System

In one day, learn how to prepare and conduct an audit of an information security management system in accordance with ISO 27001:2022. This training provides a clear method for analysing requirements, collecting evidence, formulating findings, and presenting conclusions that support continual improvement.

By the end of the training, participants will be able to:

• Understand the principles, challenges, and governance of an information security management system according to ISO 27001:2022
• Identify key requirements, information security risks, and interested-party expectations applicable to the organisation
• Assess security measures, responsibilities, controls, and evidence associated with an ISMS
• Prepare and conduct an audit of the information security management system using a structured, objective, and pragmatic approach
• Formulate relevant audit findings and propose improvement actions to strengthen information security

• I nteractive roundtable: participants’ expectations, information security challenges, and the context of ISMS audits
• Introduction to the information security management system: purpose, principles, governance, and continual improvement
• Guided review of ISO 27001:2022: structure, key requirements, organisational context, and interested-party expectations
• Practical workshop: identifying assets, threats, vulnerabilities, and risks related to information security
• Case study: analysing security measures, responsibilities, applicable controls, and associated evidence
• Simulation: preparing an ISMS audit – scope, objectives, criteria, audit plan, and sampling
• Role play: conducting audit interviews with objectivity, confidentiality, and active listening
• Group exercise: collecting audit evidence, formulating findings, qualifying nonconformities, and assessing the effectiveness of security controls
• Collective debrief: presenting clear, objective audit conclusions focused on improving the ISMS
• Final summary: building an action plan to strengthen information security and support continual improvement

At the end of the training, participants will receive a certificate of attendance issued by the House of Training.