Preparing Your Organization for ISO 27001:2013 Compliance/Certification

By Mike Woolard
ISO/IEC 27001 is an international standard for information security. Companies around the world implement the standard to demonstrate to customers that they meet a strong level of security. This course will guide you through the process of certification.
Play course overview
Course info
Rating
(41)
Level
Intermediate
Updated
Jan 10, 2020
Duration
4h 13m
Table of contents
Course Overview
Course Overview 2m
ISO/IEC 27001 Fundamentals of the Standard
Introduction 11m What Is the Information Security Management System? 4m Developing the ISMS Manual - Context of Organization 3m Developing the ISMS Manual - Requirements of Interested Parties 1m Developing the ISMS Manual - Scope 4m Developing the ISMS Manual - Leadership Commitment 3m
A.8 Asset Management
Responsibilities of Asset Owner 4m Asset Register 2m Acceptable Use Policy 1m Information Classification and Handling 4m
Risk Management
Risk Assessment - Define the Process 5m Risk Assessment - Risk Criteria and Acceptance 2m Risk Assessment - Risk Treatment Process 5m Statement of Applicability 2m Continuous Improvement 2m
A.5 Information Security Policies
Information Security Policy 3m Objectives - Establishing 3m
A.6 Organization of Information Security
Roles and Responsibilities 3m Internal Organization 5m Mobile Device and Teleworking 5m
A.7 Human Resource Security
Prior to Employment 5m During Employment 2m Termination and Change of Employment 6m
A.9 Access Control
Business Requirements 4m Access Management 5m User Responsibilities 1m System and Application Access 3m Password Policies 4m
A.10 Cryptography
Use of Controls 5m Key Management 5m
A.11 Physical and Environmental Security
Secure Areas 4m Access Control Systems 2m Equipment Care 3m User Responsibilities 8m
A.12 Operations Security
Operational Procedures and Responsibilities 3m Change Management 3m Capacity Management 1m Operational Procedures - Environment Separation 1m System and Data Protection 4m Operational Procedures - Logging and Monitoring 2m Technical Vulnerability Management 5m
A.13 Communications Security
Network Controls 3m Network Services Security 1m Network Segregation 2m Information Transfer 2m Electronic Messaging 1m Non-disclosure Agreements 7m
A.14 System Acquisition, Development and Maintenance
Information Security Requirements 4m Public Networks 2m Development Process 3m System Change Control 2m Outsourced Development 4m Testing 3m Test Data 7m
A.15 Supplier Relationships
Security in Supplier Relationships 3m Supplier Agreements 3m Service Level Agreements 2m Supplier Reviews 5m
A.16 Information Security Incident Management
What Is an Incident? 3m Reporting 2m Response 3m Lessons Learned 5m
A.17 Information Security Aspects of Business Continuity Management
Embedding Information Security in Business Continuity 2m Identifying 1m Planning 2m Maintain and Test 1m Redundancies 5m
A.18 Compliance
Identifying Requirements 3m Protection of Intellectual Property Rights 2m Listing and Protecting Records 2m ISMS Compliance 1m Information Security Review 5m
Certification Preparations
Internal Audits 2m Employee Awareness 1m Communication Plan 3m Management Review 5m
Description
Course info
Rating
(41)
Level
Intermediate
Updated
Jan 10, 2020
Duration
4h 13m
Description

27001 is one of the top globally recognized information security standards in the world. In this course, Preparing Your Organization for ISO 27001:2013 Compliance/Certification, you will learn what it takes to prepare your organization for the certification process. First, you will talk through the fundamental pieces that must be in place to start the process. Next, you will go through each domain in the Annex A to understand what an auditor is looking for from your organization if you choose to implement that control. Finally, you will discover the last bits around certification preparations as well as the parts that are ongoing to remain in compliance. When you have finished with this course, you will understand the process required to become certified.

About the author
Mike Woolard
About the author

Mike is an information security manager who has worked in the IT field for 17+ years. The focus of Mike's career now centers on pentesting and risk assessments. An active member in the infosec community and attends or speaks at various conferences.

More from the author
Automate Web Application Scans with OWASP ZAP and Python
Intermediate
1h 8m
Feb 17, 2021
Getting Started with OWASP Zed Attack Proxy (ZAP) for Web Application Penetration Testing
Beginner
1h 55m
Sep 3, 2020
More courses by Mike Woolard
Section Introduction Transcripts
Section Introduction Transcripts

Course Overview
[Autogenerated] Hi, everyone. My name is Michael load and welcome to my course in preparing your organization for ISO 1 29,013 Compliance and certification. I am a risk and compliance manager at a global organization with ISO 27,001 implemented across offices around the world as well as the certified access Mislead Implementer 27,001 is one of the top globally recognized information security standards in the world. And with new data privacy legislation being passed daily, it will continue to gain popularity as organizations look for how to be in conformity with new laws and best practices. This course is not a regurgitation of standard but rather a compliment to it and walks you through an overview of the process to be certified. It then steps through each of the clauses and controls in the annex of the standard and gives you guidance on what the order is looking for so you can focus on what is important and streamline your preparation process. Some of the major topics that will cover include developing the is mess manual, conducting risk assessments in your business, setting a scope and statement of applicability, then we'll walk through all 14 security control clauses and touch on the 114 controls in the annex. By the end of this course, you should have a better understanding of the process to be certified, and the work involved in getting their certification is not an overnight process and depending on the size of the organization and scope involved, could take weeks, months or even a year to prepare. Sit back, grab a copy of the standard and get ready to fill your notebook with an amazing advice you will receive in this course preparing your organization for ISO 1 29,013 Compliance and certification here at Pluralsight.

You're the smartest person in the room

PROVE IT

Your team won't just close the skills gap

THEY'LL HURDLE IT