Information Security Management (ISO/IEC 27001) Fundamentals Training
A one-day fundamentals programme explaining ISO/IEC 27001:2022 and the information security management system, or ISMS, in plain language. Participants learn how an organisation identifies information risks, chooses controls and checks whether its security practices work. The focus is understanding the system and contributing to it, with a simple worked example rather than a full implementation project.
Who should attend: IT and security staff, compliance and risk officers, HR, operations, managers and anyone supporting an ISMS. No prior ISO knowledge or audit experience is required.
HRD Corp claim support available
Programme Agenda
9:00 AM to 10:00 AM
Information Security and the ISMS
Introduce confidentiality, integrity and availability. Explain the roles of ISO/IEC 27001 requirements and ISO/IEC 27002 guidance, and distinguish an organisation's management system certification from a product or personal qualification.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Scope, Leadership and Planning
Walk through clauses 4 to 6 using a small business example: organisational context, interested parties, scope, leadership, roles, objectives and risk assessment. Introduce the requirement to consider whether climate change is relevant under Amendment 1:2024.
11:30 AM to 12:30 PM
Risk Assessment and Treatment
Identify information assets, threats, vulnerabilities and impacts. Compare treating, accepting, avoiding and sharing risk. Build a small risk register and explain why controls should respond to assessed risks.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Annex A and the Statement of Applicability
Introduce the 93 reference controls across organisational, people, physical and technological themes. Use access control, supplier security, awareness and backups as examples. Explain how the Statement of Applicability records necessary controls and justifications for inclusion or exclusion.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Operating and Improving the ISMS
Introduce clauses 7 to 10: competence, documented information, operation, monitoring, internal audit, management review and corrective action. Explain stage 1 and stage 2 certification audits, surveillance and recertification at an overview level.
4:00 PM to 5:00 PM
Practical Exercise: A First ISMS Worksheet
Draft a short scope for a fictional organisation, identify three information risks and propose controls with evidence. Compare ISO 27001 with SOC 2 and explain why an ISMS certificate alone does not establish compliance with the PDPA or GDPR.
Key Outcomes
- Explain the purpose and structure of ISO/IEC 27001:2022
- Describe ISMS scope, ownership and a basic risk assessment
- Recognise the four Annex A control themes and purpose of the Statement of Applicability
- Explain internal audit, management review and continual improvement
- Outline the certification journey and draft a basic ISMS worksheet
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior framework knowledge required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
High relevance across Malaysian industries managing information security, customer assurance and supplier requirements. Certification does not replace applicable legal obligations.
Practical Takeaways
An ISMS scope worksheet and a starter risk, treatment and evidence register.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
This fundamentals programme is not lead implementer or internal auditor qualification training. Its Certificate of Completion is not ISO 27001 certification. Organisational certification requires an independent certification body.
Frequently Asked Questions
Related Fundamentals Training
AI Agent Security & Reliability (AIUC-1) Fundamentals SOC 2 Fundamentals SOC 1 Fundamentals Cybersecurity Risk Management (NIST CSF 2.0) Fundamentals View all fundamentals programmes
Reference material: ISO: ISO/IEC 27001:2022.