ISO/IEC 27001 training: curriculum and assessment

This curriculum is for information-security coordinators, process owners and colleagues handling information or supplier dependencies.

Audience and preparation

This curriculum is for information-security coordinators, process owners and colleagues handling information or supplier dependencies. Define the intended management-system boundary and the learner's responsibilities before choosing modules. Bring a redacted information-flow map and examples of decisions, not passwords, live vulnerabilities or personal records. Technical system knowledge and business-process knowledge may differ across participants. The course teaches risk-based management and does not itself perform a penetration test or grant privacy-law compliance.

Learning sequence and expected records

The programme connects organisational context, confidentiality, integrity and availability with risk criteria, treatment responsibilities and control evidence. Learners examine how the statement of applicability relates to justified control decisions and how additional controls may be necessary. They then consider competence, operational changes, supplier interfaces and performance review. The outcome is a learning map showing the information at issue, responsible decision owner and evidence needed to evaluate a control, not a software shopping list.

Planning exercise

An access list conflicts with the applicability statement, while the backup dashboard reports success. Connect the risk decision to actual permissions and a recorded restore test. Ask the learner to show which evidence supports access control and which supports recovery; the two conclusions should not be merged into one green dashboard status.

Assessment and role limits

Participants submit a justified risk-to-control explanation and a plan for checking the chosen control's operation. They must state assumptions, omitted evidence and who can accept the remaining risk. Agree the technical level, current standard and permitted data before scheduling. QRS can deliver the agreed training and exercises within its stated training role. Attendance is not independent ISO/IEC 27001 certification, approval of software or a guarantee against incidents. Certification bodies and applicable authorities retain their own decision responsibilities.

Official references

A preparation task to discuss with QRS

Illustrative learning task; not an actual customer case or a promised course assessment.

Prepare these practical records

Asset inventory exercise
Risk assessment worksheet
Draft control applicability rationale

Bring an information process, asset list and anonymised security scenario for the practical exercise.

Before agreeing the programme, compare the proposed task with the participant’s role, experience and permitted evidence. Record the criterion, what the learner demonstrated and the remaining gap separately; attendance alone does not demonstrate the work.

Read the original scope guide

Discuss the training plan