ISO 27001 Foundation study guide
ISO 27001 Foundation · Work through your exam, one topic at a time.
The ISO/IEC 27001 Certification is an APMG International certification listed in the Cyber Security category of its certification portfolio, which APMG describes as enabling professionals to safeguard data and manage evolving threats. It suits practitioners who build, run, audit or support an information security management system (ISMS) - security and risk officers, IT and service managers, compliance and audit staff, consultants, and team members whose work touches information security governance. The ISO 27001 Foundation study guide has 4 sections and about 1,750 words.
01ISMS Fundamentals and the ISO/IEC 27001 Standard
An information security management system (ISMS) is a systematic, risk-driven framework of policies, processes, roles, and controls used to protect the confidentiality, integrity, and availability (the CIA triad ) of information. ISO/IEC 27001 is the international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS.
365 words, about 2 min02Context of the Organization
Clause 4 of ISO/IEC 27001 asks the organization to understand why it needs an ISMS before it builds one. This means determining the external and internal issues relevant to its purpose (often summarised as SWOT or PESTLE-style analysis), and identifying interested parties and their requirements .
354 words, about 2 min03Leadership and Planning
Clause 5 (Leadership) and Clause 6 (Planning) are where top management commits and where risk is turned into action. Under leadership , top management must demonstrate commitment by ensuring the information security policy is established and compatible with strategic direction, integrating ISMS requirements into business processes, providing resources, communicating the importance of the ISMS, and promoting continual improvement.
350 words, about 2 min04Support, Operation and Performance Evaluation
Clauses 7–9 cover the day-to-day running and checking of the ISMS. Support (Clause 7) requires resources, competence (determine necessary competence, ensure people are competent, take action to acquire it, and retain evidence), awareness (staff understand the policy and their contribution), communication (what, when, with whom, how), and documented information (creating and updating documents with proper identification, review, and control; and controlling access, retrieval, retention, and disposal).
681 words, about 3 min