ISO 27001 Fundamentals: sample practice worksheet

Fictional practice only. Use invented details; do not enter personal, client or confidential data.
This preview is not a completed assessment, legal opinion, audit or certification.

Exercise: Practical Exercise: A First ISMS Worksheet
Draft a short scope for a fictional organisation, identify three information risks and propose controls with evidence. Compare ISO 27001 with SOC 2 and explain why an ISMS certificate alone does not establish compliance with the PDPA or GDPR.

1. Describe the fictional organisation, process or system and its scope.

2. Identify three relevant risks or obligations. For each, record a control, owner and evidence you would request.

3. List assumptions, gaps and two questions to ask before relying on the result.

4. Propose one next action and explain how you would check that it worked.

Learning takeaway: An ISMS scope worksheet and a starter risk, treatment and evidence register.

This fundamentals programme is not lead implementer or internal auditor qualification training. Its Certificate of Completion is not ISO 27001 certification. Organisational certification requires an independent certification body.

Programme: https://orbixtech.my/training-iso-27001-isms-awareness-malaysia