ISO 27001 Foundation study plan
ISO 27001 Foundation · Give each week a clear focus.
8 weeks · About 6 hours per week
Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard
Define the purpose and scope of an ISMS in your own words without notes
Map the Plan-Do-Check-Act cycle to the clause structure of the standard
List the mandatory documented information the standard requires and where each is referenced
Explain the difference between the standard's requirements and its guidance annex
Your checkpoint
One-page hand-drawn ISMS model diagram with clause references and a 15-item documented-information checklist
Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard
Describe the risk assessment and risk treatment process steps in correct order
Distinguish risk owners, risk sources, and risk consequences
Explain the statement of applicability and what it must contain
Compare the main risk treatment options and when each is appropriate
Your checkpoint
Completed risk register template with 10 worked sample risks and a draft statement of applicability outline
Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard & Context of the organization, leadership and planning
Analyze internal and external issues that affect an ISMS and record them in a structured list
Identify interested parties and their information security requirements
Explain how leadership commitment and the information security policy are demonstrated in practice
Summarize how organizational roles and responsibilities are assigned for information security
Your checkpoint
Context analysis worksheet covering 8 issues, 5 interested parties, and a one-page draft information security policy
Context of the organization, leadership and planning
Translate identified risks into measurable information security objectives
Explain the planning actions needed to address risks and opportunities
Describe how changes to the ISMS are planned and controlled
Your checkpoint
Two measurable information security objectives with owners, resources, timelines, and evaluation criteria
Support, operation and performance evaluation
Identify the resources, competence, awareness, and communication needs the standard requires
Explain how competence is determined and how records of competence are kept
Describe how awareness of the information security policy is maintained
Your checkpoint
Competence matrix for 6 roles plus a one-page awareness communication plan
Support, operation and performance evaluation
Describe the operational planning and control requirements for outsourced and internal processes
Explain how performance is monitored, measured, analyzed, and evaluated
Outline the internal audit program requirements including auditor independence
Describe the inputs, outputs, and attendees of a management review
Your checkpoint
Filled management review agenda and minutes template with inputs and outputs mapped to the standard
Improvement and certification readiness
Distinguish nonconformity, corrective action, and continual improvement
Walk through a corrective action from detection to effectiveness check
Explain how monitoring and audit findings feed improvement
Your checkpoint
Completed corrective action record for a simulated nonconformity including root cause and effectiveness verification
Improvement and certification readiness & Information security management system (ISMS) fundamentals and the ISO/IEC 27001 standard
Assemble a readiness checklist covering all mandatory documented information
Identify typical certification audit stages and what each assesses
Practice answering scenario questions across all four domains under time pressure
Close remaining knowledge gaps identified in practice tests
Your checkpoint
Full readiness checklist with 100% of mandatory documents marked as present or gap-flagged, plus a written gap remediation list
Milestones
Week 2: Score 80% or higher on a 20-question self-quiz covering ISMS fundamentals and risk management
Week 4: Explain context, leadership, and planning requirements aloud in under 10 minutes without notes
Week 6: Complete a mock management review and internal audit walkthrough with all required inputs and outputs identified
Week 8: Score 85% or higher on a full-length timed practice exam and have zero unresolved items on the readiness checklist