ISO/IEC 27002 Foundation study plan
ISO/IEC 27002 Foundation · Give each week a clear focus.
8 weeks · About 6 hours per week
Fundamental principles and concepts of information security, cybersecurity, and privacy
Define information security, cybersecurity, and privacy protection, and explain how they differ and interrelate
List the three core principles of information security (confidentiality, integrity, availability) and give a real-world example of each
Explain the concept of risk and the relationship between assets, threats, vulnerabilities, and impacts
Identify the main roles and responsibilities in an information security management system (ISMS), such as top management, risk owner, and control owner
Your checkpoint
A one-page glossary of 15 key terms with concise definitions and examples, written in your own words.
Fundamental principles and concepts of information security, cybersecurity, and privacy
Describe the structure and purpose of an ISMS according to ISO/IEC 27001, including the Plan-Do-Check-Act cycle
Explain how ISO/IEC 27002 relates to ISO/IEC 27001 and how it supports control selection
Summarize the risk assessment and risk treatment process steps at a high level
Differentiate between policies, standards, procedures, and guidelines with examples
Your checkpoint
A 300-word summary explaining how ISO/IEC 27002 fits into an ISMS and how controls are selected based on risk.
Fundamental principles and concepts of information security, cybersecurity, and privacy
Explain the relationship between information security, privacy, and data protection principles
Identify key privacy principles such as lawfulness, fairness, transparency, purpose limitation, and data minimization
Describe the concept of personally identifiable information (PII) and give examples
Outline how privacy risk can be addressed within an ISMS
Your checkpoint
A table mapping five privacy principles to corresponding information security controls or practices.
Fundamental principles and concepts of information security, cybersecurity, and privacy & Information security controls based on ISO/IEC 27002
Review all domain 1 concepts and self-test with 20 practice questions, achieving at least 80% correct
Describe the overall structure of ISO/IEC 27002:2022, including its 4 themes and 93 controls
List the 4 themes (organizational, people, physical, technological) and give two example controls from each
Explain the purpose of the control attributes (control type, information security properties, cybersecurity concepts, operational capabilities, security domains)
Your checkpoint
A concept map linking domain 1 principles to the four ISO/IEC 27002 themes, plus a score log of the practice test.
Information security controls based on ISO/IEC 27002
Summarize the organizational controls (5.1–5.37) and explain their intent in your own words
Explain key organizational controls such as policies for information security, roles and responsibilities, segregation of duties, and threat intelligence
Describe the purpose of information classification and labeling
Outline supplier relationship security and incident management at a high level
Your checkpoint
A set of 10 flashcards (question and answer) covering five organizational controls, with accurate clause references.
Information security controls based on ISO/IEC 27002
Summarize the people controls (6.1–6.8) and explain their objectives
Describe controls for screening, terms and conditions of employment, awareness and training, and disciplinary process
Explain the physical controls (7.1–7.14) covering physical security perimeters, entry controls, and clear desk and clear screen
Relate people and physical controls to common risks such as insider threat and unauthorized physical access
Your checkpoint
A two-column comparison of people versus physical controls, listing at least 8 controls with their purpose and one risk each addresses.
Information security controls based on ISO/IEC 27002
Summarize the technological controls (8.1–8.34) and group them by function (e.g., access control, cryptography, logging, network security)
Explain key technological controls such as access control, privileged access rights, cryptography, and logging
Describe secure development and separation of environments at a high level
Identify how technological controls support confidentiality, integrity, and availability
Your checkpoint
A matrix of 10 technological controls mapped to the CIA triad and to at least one relevant risk scenario.
Fundamental principles and concepts of information security, cybersecurity, and privacy & Information security controls based on ISO/IEC 27002
Review all 93 control titles and match each to its correct theme and clause number
Complete a full-length timed practice exam (40 questions) and score at least 85%
Review incorrect answers and close knowledge gaps using the standard text
Explain how ISO/IEC 27002 controls support legal, regulatory, and contractual requirements
Your checkpoint
A personal exam-readiness report listing weak areas, corrected misconceptions, and a final score of 85% or higher on the practice exam.
Milestones
Week 2: Can explain the ISMS PDCA cycle and the role of ISO/IEC 27002 in control selection without notes.
Week 4: Scores at least 80% on a 20-question domain 1 self-test and can name the four ISO/IEC 27002 themes with examples.
Week 6: Can accurately describe the purpose of at least 15 organizational, people, and physical controls with correct clause references.
Week 8: Achieves 85% or higher on a timed 40-question mixed practice exam and can map any control title to its theme.