Internal auditor of the Information Security Management System ISO 27001 (in cooperation with CIS Spółka z o. o.)

Training for internal auditors preparing them to perform this function in the company based on the latest edition of the PN-EN ISO 27001:2017-06 standard.

Training duration: 2 days / 16 hours

Confirmation document: Certificate of "Internal Auditor of the Information Security Management System (ISO 27001)"„

This is a two-day (16-hour) practice-oriented training during which:

• you will become familiar with the Information Security Management System (ISMS) compliant with the requirements of the PN-EN ISO 27001:2017-06 standard
• you will learn how to audit this system and document audit activities and how to deal with risks
• you will learn to build an appropriate relationship with the auditee
• you will learn about the most common mistakes made when implementing an Information Security Management System

Training courses we provide respond to the real needs of companies, they give in hand specific tools, which can be tested and applied directly in the company. This is appreciated by CIS training participants, who evaluate them on 9,5 – 10 points on a 10-point scale.

Who might benefit from participating in the training?:

• Persons responsible for implementing information security
• Senior and middle management, in particular those responsible for information security, including personal data protection officers, personal data controllers (DPAs), and security officers
• Auditors who want to gain basic knowledge in the field of Information Security Management System auditing
• Employees responsible for contacts with key clients, contractors and business partners

Module I: INFORMATION SECURITY MANAGEMENT SYSTEM ACCORDING TO THE PN-EN ISO 27001:2017-06 STANDARD
1) Introduction to the Information Security Management System (ISMS) compliant with PN-EN ISO 27001:2017-06:

• Terminology
• System components
• Interpretation and analysis of system requirements
• ISO 2700x family of standards

2) Information Security Management System (ISMS)
3) Dealing with risk in a process approach
4) Design, implementation and certification of an information security system
5) Security

• Security Analysis
• Interpretations of the provisions of Normative Annex A of the PN-EN ISO 27001:2017-06 standard

Module II: CONDUCTING INTERNAL AUDITS
1) The essence of the audit:

• Internal audit
  • Audit preparation
  • The purpose of conducting an audit
  • Audit scope and criteria
• Principles of conducting internal audits
• A Practical Approach to Information Security Auditing
• Overview of ISO 27001 compliant system controls

2) Security and practice:

• Annex A of the PN-EN ISO 27001:2017-06 standard

3) Conducting audits:

• Tools supporting the work of the auditor
• Audit documentation and reporting, checklists
• Characteristics and competencies of an auditor
  • Character traits
  • Predispositions
  • Auditor's responsibilities
• Communication during the audit – verbal and non-verbal speech
• Planning and preparations related to the implementation of the audit
  • Audit plan
  • Stages of the audit process
  • Preparations for the audit
  • Documents related to the auditing process
  • Creating a checklist with questions
• Discussion of the audit implementation
  • Opening meeting
  • Fact gathering and establishment
  • Obtaining audit evidence
  • Recording the information you learn
  • Conformity assessment and classification of non-conformities
• Audit results
  • Documenting and reporting non-conformities
• Post-audit activities
  • Creating a final report
  • Closing meeting
• Audit effectiveness

Module III: TRAINING SUMMARY AND EXAMINATION

• Training summary - effectiveness evaluation.
• Exam - lasts an hour and consists of two parts: a single-choice test and a descriptive part during which the recommendations of the standard and the tool must be applied.