ISO/IEC 27001 training: curriculum and assessment

Audience and preparation

This curriculum is for information-security coordinators, process owners and colleagues handling information or supplier dependencies. Define the intended management-system boundary and the learner's responsibilities before choosing modules. Bring a redacted information-flow map and examples of decisions, not passwords, live vulnerabilities or personal records. Technical system knowledge and business-process knowledge may differ across participants. The course teaches risk-based management and does not itself perform a penetration test or grant privacy-law compliance.

Learning sequence and expected records

The programme connects organisational context, confidentiality, integrity and availability with risk criteria, treatment responsibilities and control evidence. Learners examine how the statement of applicability relates to justified control decisions and how additional controls may be necessary. They then consider competence, operational changes, supplier interfaces and performance review. The outcome is a learning map showing the information at issue, responsible decision owner and evidence needed to evaluate a control, not a software shopping list.

Planning exercise

In a hypothetical course request, HR proposes uploading a real payroll export to a shared online classroom so that IT and supplier staff can practise risk analysis. Plan an authorised simulated dataset and role-based exercises instead. HR needs to identify the business information and disclosure limits; IT reviews technical controls; supplier coordinators examine contract and access responsibilities. Assessment rejects exposing personal records simply because the activity is labelled training. The submitted plan must explain data minimisation, access permissions and the learning evidence each role can safely provide.

Assessment and role limits

Participants submit a justified risk-to-control explanation and a plan for checking the chosen control's operation. They must state assumptions, omitted evidence and who can accept the remaining risk. Agree the technical level, current standard and permitted data before scheduling. Kayra may provide the agreed learning and preparation, but attendance is not independent ISO/IEC 27001 certification, approval of software or a guarantee against incidents. Certification bodies and applicable authorities retain their own decision responsibilities.

Official references

• ISO