Course Outline
ISO/IEC 27002:2022 is the latest international standard providing practice guidelines for information security controls alongside ISO/IEC 27001 for establishing, implementing, and improving an Information Security Management System (ISMS). This enhanced outline aligns with the 2022 revision and incorporates current HR and recruitment terminology used in information security job descriptions.
Foundations of Information Security, Cybersecurity, and Privacy
- Information security fundamentals: confidentiality, integrity, and availability (CIA triad) in modern enterprise environments
- Evolution of cybersecurity threats: ransomware, nation-state attacks, insider threats, and supply chain compromises
- Privacy by design and regulatory alignment with GDPR, CCPA, and global data protection frameworks
- Information governance: ownership, accountability, and stakeholder alignment across departments
- Trust management and the zero-trust architecture paradigm in hybrid and cloud-infrastructure environments
The ISO/IEC 27001–27002 Framework and ISMS Governance
- ISO/IEC 27001 ISMS lifecycle: Plan-Do-Check-Act (PDCA) and certification pathways
- Relationship between ISO/IEC 27001 and the updated ISO/IEC 27002:2022 control catalog
- Information security policy development and top-level governance structures
- Regulatory compliance mapping: NIST CSF, CIS Controls, SOC 2, and HIPAA alignment strategies
- Information security metrics, key performance indicators (KPIs), and continuous improvement reporting
Organizational Controls — The Control Group 5 Framework
- Information security roles, responsibilities, and segregation of duties across organizational tiers
- Threat intelligence programs and security information management platforms (SIEM, SOAR)
- Cloud security posture management (CSPM) and infrastructure-as-code compliance
- Social media, BYOD, and remote-work security: mobile device management and endpoint protection
- Monitoring, incident detection, and third-party risk management in complex IT ecosystems
People Controls — The Security Workforce
- Security awareness, behavior-change techniques, and phishing simulation programs
- Background vetting, employment lifecycle security onboarding and offboarding controls
- Remote workforce resilience and flexible-working secure-access policies
- Competency frameworks: aligning information security training with roles at all levels
- Building a security-first culture and cross-functional collaboration in risk management
Physical Controls — Facility and Asset Security
- Secure facility design: perimeter security, surveillance systems, and physical access controls
- Equipment maintenance, supply chain assurance, and asset lifecycle management
- Data center security: environmental controls, power redundancy, and disaster recovery readiness
- Secure disposal methods for sensitive media: sanitization standards and supply-chain integrity
- Emerging physical threats: IoT device security and smart-building attack surfaces
Technological Controls and Advanced Security Domains
- Cryptographic controls: key lifecycle management, PKI, and AI-driven encryption optimization
- Application security: secure SDLC, API security, DevSecOps integration, and SAST/DAST tooling
- Network architecture controls: segmentation, micro-segmentation, firewalls, and next-gen IDS/IPS
- Email security: anti-phishing, DMARC/SPF/DKIM, and Business Email Compromise (BEC) defense
- Artificial intelligence and machine learning in cybersecurity: automated threat detection and adversarial AI mitigation
Information Security Risk Assessment and Compliance
- ISO/IEC 27005-aligned risk assessment methodologies: identification, analysis, and evaluation
- Risk treatment planning and the statement of applicability (SOA)
- Compliance audit readiness: internal/external audit coordination and evidence-based auditing
- Penetration testing methodologies and vulnerability management lifecycle
- Emerging threats: quantum computing risk, environmental sustainability (green IT), and privacy-enhancing technologies (PETs)
PECB Exam Preparation and Real-World Application
- PECB ISO/IEC 27002 Foundation exam structure, competency domains, and preparation strategies
- Sample case studies: information security implementation in financial services, healthcare, and technology sectors
- Building an information security awareness and culture within your organization post-certification
- Certification maintenance, professional development, and career pathways for information security roles
Summary of Research
The existing two-day outline is heavily condensed and omits the substantial scope of ISO/IEC 27002:2022, which introduced 93 controls grouped into four themes (Organizational, People, Physical, Technological) — up from 114 controls across 14 control categories in the 2013 version. Key trends in information security recruitment for 2024–2026 include zero-trust architecture, AI-driven security operations, cloud security posture management, DevSecOps integration, supply chain security, privacy-enhancing technologies, quantum-ready cryptography, and third-party risk management. HR listings for roles such as Information Security Analyst, ISMS Lead, Compliance Officer, Cybersecurity Specialist, and Risk Manager consistently demand these competencies.
Requirements
There are no specific requirements needed to attend this course.
Testimonials (4)
Theory followed by practical examples and exercices. Job well done!
Vincenzo Delle Donne - Department of National Defence
Course - ISO 37301 Compliance Management System
the expertise & knowledge of the trainer
Erica DeRosa DeRosa - Aecon Group INc.
Course - ISO 37001 Anti-Bribery Management System
I enjoyed the quizzes, and Driton's style of teaching.
Chloe - SEEC MM Ltd.,
Course - ISO 9001 Lead Implementer
With both my 2022 ISO 9001 audit prep-related training & the recently completed ISO 9001 audit prep refresher course; Dereck has helped me significantly with regards to gaining a new & practical perspective of the ISO 9001:2015 clauses & sections & how they apply to our business. Dereck has also helped me with both training courses --- to improve my ISO-related communications both with our company's employees and the external ISO Auditors .
