ISO 27400 Foundation study plan

ISO 27400 Foundation · Give each week a clear focus.

8 weeks · About 6 hours per week

Week 1

Fundamental concepts and principles of IoT security and privacy

Define IoT from the standard's perspective and list the defining characteristics that separate it from general IT (sensing, network connectivity, actuation, constrained resources, physical exposure)
Map the core security objectives (confidentiality, integrity, availability, authenticity, accountability, privacy) onto concrete IoT device scenarios you can describe from memory
Explain why privacy is treated as a first-class concern in IoT rather than a subset of security, using at least three distinguishing arguments
Sketch the layered reference view of an IoT system (device, network, service/platform, application) and place five example components in each layer

A one-page hand-drawn architecture diagram plus a 300-word glossary of 15 core terms written without consulting notes

Week 2

Describe the fundamental principles of IoT security (security by design, defence in depth, least privilege, fail-safe defaults, minimal attack surface, secure lifecycle) and give one IoT-specific example of each
Explain the concept of trust boundaries in IoT and identify where they occur between device, gateway, cloud, and user
Contrast the security posture of constrained devices with that of general-purpose computing and state the resulting design trade-offs
Identify the stakeholder roles named in the standard's scope (device manufacturer, service provider, application developer, operator, user) and state each role's security responsibility

A comparison table of six security principles with an IoT example and a failure mode for each, plus a trust-boundary sketch

Week 3

Explain the concept of data lifecycle in IoT (collection, transmission, storage, processing, sharing, deletion) and the privacy implications at each stage
Describe what constitutes personal data in an IoT context, including inference and re-identification risks from sensor metadata
Articulate the privacy principles of purpose limitation, data minimisation, transparency, and user control, and apply each to a smart-home or wearable scenario
Distinguish anonymity, pseudonymity, and identifiability and explain why aggregation alone does not guarantee privacy

A data-lifecycle table for one chosen IoT use case listing, per stage, the data involved, the privacy risk, and a mitigating principle

Week 4

Explain the risk-based approach to IoT security and describe how assets, threats, vulnerabilities, and impacts combine into risk
Identify the risk sources introduced by the physical world (theft, tampering, environmental exposure, side channels) and explain why they are distinctive to IoT
Summarise the risk sources arising from long device lifetimes, unpatchable firmware, and supply-chain complexity
Connect the fundamental principles from Domain 1 to the control categories introduced in Domain 2

A risk register of ten IoT-specific risk sources with asset affected, threat, and impact rating, produced in under 90 minutes as a timed exercise

Week 5

Describe device-level security controls: secure boot, hardware root of trust, trusted execution environments, secure key storage, and debug-port disabling
Explain identity and access management controls for IoT, including device identity, credential provisioning, onboarding, and decommissioning
Outline update and patch management controls, including signed firmware, staged rollout, and rollback capability
Explain network-level controls such as segmentation, gateway enforcement, and protocol selection for constrained links

A control catalogue of 20 device-, identity-, and network-level controls, each with the risk it addresses and one implementation example

Week 6

Describe privacy controls including data minimisation at the sensor, local pre-processing, pseudonymisation, consent capture, and retention limits
Explain logging, monitoring, and anomaly detection controls for IoT and what evidence they must preserve for accountability
Outline organisational and contractual controls such as supplier security requirements, secure development practices, and incident response arrangements
Match each control from your catalogue to at least one risk source from Week 4 and note any residual risk

A completed risk-to-control traceability matrix covering all ten Week-4 risks, with residual risk noted for each

Week 7

Rehearse recalling the standard's core definitions and principles in written form without notes
Apply the principles and controls to two unseen IoT scenarios and justify each recommendation by naming the principle or control category
Identify and correct your three weakest areas from the Week-4 and Week-6 deliverables
Explain how privacy and security controls can conflict and how to resolve the tension in a defensible way

Two written scenario analyses of 400 words each, each citing at least five named principles or control categories

Week 8

Consolidate both domains into a single mental map linking principles, risk sources, and controls
Complete timed practice under exam conditions and review every incorrect answer to its root cause
State the standard's scope and intended audience accurately, including what it does not cover
Finalise a one-page recall sheet of definitions, principles, and control categories for last-minute review

A timed 60-question self-test with a written error log, plus the final one-page recall sheet

Week 2: Without notes, explain all six security principles and place three trust boundaries on a blank page in under 15 minutes

Week 4: Produce the ten-item risk register from memory of the categories, then verify against notes and score yourself on coverage

Week 6: Every one of the ten Week-4 risks has at least one mapped control and a stated residual risk

Week 8: Score 80% or higher on the timed self-test and show that every error has a logged root cause and corrective action