ISO 27001 LI study plan

Define the ISMS scope boundary and justify every inclusion and exclusion in writing

Map the Clause 4 to Clause 10 structure of ISO/IEC 27001 onto a real or simulated organization

Explain confidentiality, integrity and availability, and how risk-based thinking drives ISMS decisions

Identify interested parties and translate their information security requirements into obligations

Distinguish the roles of top management, ISMS owner, risk owner and internal auditor

Construct an asset-based risk register with at least 15 assets and a named owner for each

Apply a documented likelihood x impact methodology consistently to every identified risk

Determine risk treatment options (mitigate, accept, transfer, avoid) for all high and medium risks

Assign risk owners with authority to accept residual risk

Record risk acceptance criteria at the organizational level before scoring individual risks

Select applicable Annex A controls and document justification for every inclusion and exclusion

Write information security objectives that are measurable, assigned and time-bound

Produce a risk treatment plan linking each treatment action to owner, resource and target date

Explain how the risk assessment, risk treatment plan and Statement of Applicability interlock

Verify that every control in the SoA traces back to a risk or a legal/contractual obligation

Draft all mandatory documented information: scope, policy, risk methodology, SoA and objectives

Define roles, responsibilities and authorities in a RACI matrix covering the full ISMS lifecycle

Design competence, awareness and communication activities appropriate to different staff groups

Establish document control rules for identification, review, approval and retention

Check the draft documentation set against every 'documented information' requirement in Clauses 4-10

Implement the operational controls addressing the highest-ranked risks and capture operating evidence

Define monitoring and measurement metrics with formula, data source, frequency and owner

Build a risk-based internal audit programme covering all clauses and all included Annex A controls

Write audit plan, audit checklist and nonconformity report templates

Select and brief internal auditors, addressing impartiality of the audit of their own work

Conduct a tabletop internal audit against at least three clauses and log objective evidence

Classify findings as major nonconformity, minor nonconformity, observation or opportunity for improvement

Prepare a management review agenda covering every Clause 9.3 input and expected output

Write a corrective action record that separates containment, root cause and effectiveness verification

Explain how audit results, metrics and management review feed the improvement cycle

Log improvement opportunities sourced from audit findings, metrics, incidents and management review

Apply corrective action that eliminates causes rather than symptoms

Map the Stage 1 and Stage 2 certification audit process and what each auditor examines

Assemble an evidence index linking each clause and each included Annex A control to a document or record

Draft the answers and evidence references for the questions auditors most often ask

Run a full mock Stage 2 audit using the evidence index as the audit checklist

Close every gap flagged in the evidence index and re-verify each closure

Rehearse concise answers to the 15 most likely auditor questions with document references

Complete two timed 60-question practice sets spanning all six domains

Review every missed practice question and write the underlying concept in your own words