ISO 27001 LI study guide
ISO 27001 LI · Work through your exam, one topic at a time.
The ISO/IEC 27001 Lead Implementer credential is a professional certification offered by PECB for people who plan, build, operate and improve an information security management system (ISMS) against the requirements of ISO/IEC 27001. It suits information security managers, ISMS project leads, consultants, risk and compliance staff, and technical specialists who are moving from supporting a programme to owning its delivery. The ISO 27001 LI study guide has 6 sections and about 2,179 words.
01Fundamental Concepts, Principles and Initiating an ISMS
An information security management system is the part of an organization's management system used to govern information security. ISO/IEC 27000 vocabulary defines information security as the preservation of confidentiality, integrity and availability (CIA); related principles worth naming in exam answers include authenticity, accountability, non-repudiation and reliability.
393 words, about 2 min02Planning the Implementation of an ISMS (ISO/IEC 27001, Clause 6)
Clause 6 requires planning to address risks and opportunities. The information security risk assessment process (6.1.2) must define and apply risk acceptance criteria and criteria for performing assessments, ensure repeatable results, identify risk owners, and be applied consistently.
372 words, about 2 min03Implementing the ISMS (Clauses 7 and 8)
Implementation depends on support processes. Resources (7.1) must be determined and provided.
339 words, about 2 min04Monitoring, Internal Audit and Management Review (Clause 9)
The organization decides what to monitor and measure, the methods, when it happens, who analyses and evaluates results, and when evaluation occurs - and retains evidence. Monitoring is ongoing checking; measurement assigns values; analysis and evaluation turn data into judgement about ISMS performance and effectiveness.
361 words, about 2 min05Continual Improvement of an ISMS (Clause 10)
Continual improvement means enhancing the suitability, adequacy and effectiveness of the ISMS - deliberately, not accidentally. Inputs come from monitoring results, internal audits, management review outputs, incidents, nonconformities, changes in context, and identified opportunities.
334 words, about 2 min06Preparation for an ISMS Certification Audit
Certification is performed by an accredited certification body operating to ISO/IEC 17021-1 and ISO/IEC 27006, using auditors competent in information security and in auditing (ISO/IEC 19011 guidance). Certification is a third-party attestation of conformity with ISO/IEC 27001 - not a guarantee that the organization is secure, and not a consultancy engagement.
380 words, about 2 min