EXIN ISFS study plan
EXIN ISFS · Give each week a clear focus.
8 weeks · About 7 hours per week
Information security fundamentals and ISO/IEC 27001
Define information security and distinguish it from IT security and privacy, writing your own one-sentence definition and two contrasting examples
Explain the CIA triad (confidentiality, integrity, availability) and give a concrete business failure scenario for each leg
Relate the concepts of threat, vulnerability, risk, and control, and correctly classify ten short given scenarios into these four categories
Describe why information security is a management responsibility rather than a purely technical one, listing three organisational reasons
Your checkpoint
A one-page glossary of 15 core terms (information security, CIA triad, threat, vulnerability, risk, control, asset, impact, likelihood, and five more) with your own examples, self-scored against a checklist
Information security fundamentals and ISO/IEC 27001
Map the structure of ISO/IEC 27001: its scope, normative references, terms, and the main clauses 4 through 10
Summarise the Plan-Do-Check-Act logic and explain how each main clause fits the cycle
Outline the role of Annex A and its control themes, and explain how Annex A relates to ISO/IEC 27002
Describe the concept of an Information Security Management System (ISMS) and what it means for an organisation to operate one
Your checkpoint
A hand-drawn or digital diagram of the ISMS clause structure mapped onto PDCA, annotated with one sentence per clause, reviewed for completeness
Information security fundamentals and ISO/IEC 27001
Explain the purpose of a risk assessment and distinguish risk identification, risk analysis, and risk evaluation
Apply a simple qualitative risk matrix (likelihood x impact) to eight scenarios and rank them
Distinguish risk treatment options: mitigate, transfer, avoid, and accept, and justify a choice for each of four cases
Describe the role of a Statement of Applicability and explain why it is central to ISO/IEC 27001 certification
Your checkpoint
A completed risk register for a fictional 20-person company with at least 10 risks, each scored, ranked, assigned a treatment option, and an owner
Information security fundamentals and ISO/IEC 27001
Describe the content and purpose of an information security policy and how supporting policies cascade from it
Explain the concepts of roles, responsibilities, segregation of duties, and the principle of least privilege
Outline awareness, training, and education as distinct activities and explain why awareness programmes matter
Summarise the human-factor controls around employment: screening, terms of employment, and termination of responsibilities
Your checkpoint
A draft one-page information security policy for the fictional company, plus a role-responsibility matrix covering at least six roles
Information security fundamentals and ISO/IEC 27001
Classify assets and explain information classification schemes and labelling
Describe physical and environmental controls: zoning, access control, clear desk and clear screen, and equipment protection
Explain access control concepts: identification, authentication, authorisation, and accountability, and how they chain together
Distinguish authentication factors (something you know, have, are) and give a realistic example of multi-factor authentication
Your checkpoint
An asset inventory of 12 items with classification levels, owners, and the matching access control rule for each, plus a short note on how accountability is logged
Information security fundamentals and ISO/IEC 27001
Explain the purpose of incident management and outline the phases from detection through evaluation, response, and learning
Distinguish an event, an incident, and a weakness, and classify ten given examples
Describe business continuity and disaster recovery at a conceptual level and distinguish RTO from RPO
Explain the role of supplier relationships and third-party risk in an ISMS
Your checkpoint
An incident response runbook outline for one scenario (lost laptop) with named roles, escalation steps, and three lessons-learned questions
Information security fundamentals and ISO/IEC 27001
Describe the purpose of internal audit, management review, and continual improvement in the ISMS cycle
Distinguish a nonconformity from an observation and outline corrective action steps
Explain the difference between certification, accreditation, and conformity assessment in the ISO/IEC 27001 context
Identify the main performance evaluation inputs and outputs a management review expects
Your checkpoint
A mock internal audit checklist of 20 questions mapped to ISMS clauses, with a short management review agenda
Information security fundamentals and ISO/IEC 27001
Consolidate all eight weeks into a single concept map linking terms, clauses, and controls
Answer 60 practice questions under timed conditions and review every wrong answer to its source concept
Re-explain the five weakest concepts aloud or in writing without notes
Recite the ISMS clause structure and PDCA mapping from memory
Your checkpoint
A timed 60-question mock exam with a written error log listing each missed concept, its correct definition, and a one-line memory hook
Milestones
Week 2: Can draw the ISO/IEC 27001 clause structure and PDCA mapping from memory and explain each clause in one sentence
Week 4: Risk register is complete and internally consistent: every risk has a score, a treatment, and an owner, and the Statement of Applicability rationale is explainable
Week 6: Can distinguish event, incident, and weakness correctly on at least 9 of 10 examples, and explain RTO versus RPO without notes
Week 8: Scores at least 80 percent on the timed 60-question mock and has a written error log covering every missed item