ISO/IEC 27001 Information Security Management System is a course in setting up an ISMS from the ground up, covering clauses 4 to 10, scoping, risk assessment, Annex A controls, the Statement of Applicability, internal audit and certification, with links to PDPA. It suits IT leaders, information security owners, internal auditors and organisations asked by clients for certification.
Plenty of organizations get asked by a customer or partner for ISO/IEC 27001 certification, then discover the standard is hard to read, full of specialist vocabulary and never states plainly what the organization has to do. Many respond by hiring a consultant to produce the paperwork, end up with a certificate that does not reflect how the business actually works, cannot maintain it afterwards and have spent the budget for nothing. This course explains the standard in language you can act on, then works through it step by step in the order an
organization should really follow. It covers what an information security management system is, the structure of clauses 4 through 10, defining a scope that fits the organization, assessing and treating risk systematically, selecting controls from all four Annex A groups and writing the Statement of Applicability, the documents and records you genuinely need, internal audit and management review, and finally the certification process and what assessors typically ask. It also maps the standard onto Thailand Personal Data Protection Act obligations. (2 days, 6 hours per day, 12 hours in total, no prior ISMS background required.)
Course Details
A 2-day course, 6 hours per day (12 hours in total), delivered as lectures with workshops that produce real documents. No prior ISMS background required. The content follows the latest ISO/IEC 27001 and draws on ISO/IEC 27002 for implementation detail. Learners take home a template set covering asset register, risk register, Statement of Applicability and audit plan, plus their own organizational risk register and draft SoA. This is a knowledge and readiness course, not an assessment or certification. Certification must be obtained separately from an accredited certification body.
Section 1: What an Information Security Management System Is
Information security defined: confidentiality, integrity and availability
Why buying security products differs from running a management system that endures
The real benefits beyond having a certificate to show partners
The common trap: outsourced paperwork producing a system nobody actually follows
Section 2: The Structure of the Standard
An overview of clauses 4 through 10 and how they form a continual improvement cycle
The role of top management and what the standard demands of them directly
Mandatory clauses versus selectable Annex A controls
Its relationship to other management system standards and running them together
Section 3: Scope and Organizational Context
Analyzing internal and external context and identifying interested parties
Defining a scope that covers what matters without exceeding your capacity
Setting a security policy and measurable security objectives
Workshop: draft your own scope statement and security policy
Section 4: Asset Identification and Risk Assessment
Building an information asset register and assigning asset owners
Identifying threats and vulnerabilities and rating likelihood against impact
Setting risk acceptance criteria and prioritizing what to treat first
Workshop: assess the risk of a core business system into the risk register
Section 5: Risk Treatment and Control Selection
Treatment options: reduce, accept, transfer or avoid, and how to decide
Selecting Annex A controls proportionate to the risk and the budget
Writing the Statement of Applicability and justifying excluded controls
Workshop: produce a draft SoA from your risk assessment
Section 6: Organizational and People Controls
Policies, defined roles and segregation of duties
Managing external suppliers and security requirements in contracts
Managing people before, during and after employment
Building awareness and training that actually changes behaviour
Section 7: Physical and Technological Controls
Controlling access to premises and server rooms, and managing equipment
System access control, privilege management and authentication
Encryption, backup, and vulnerability and patch management
Logging, event monitoring and network security controls
Section 8: Required Documents and Records
The documents the standard mandates and the level of detail that suffices
Document control, versioning and retaining records as evidence
Keeping documentation from growing until nobody can follow it
Lab: compare your existing documents against the mandated list
Section 9: Internal Audit and Management Review
Planning the internal audit programme and selecting independent auditors
Audit technique: interviewing, requesting evidence and recording findings
Handling nonconformities and corrective action that reaches the root cause
Workshop: run a simulated internal audit and record findings against a checklist
Section 10: Certification and Assessment Readiness
The certification path: stage one, stage two and annual surveillance audits
Choosing a certification body and what to ask before committing
The questions assessors typically ask and the evidence to prepare in advance
Keeping the system alive after the certificate arrives
Section 11: Mapping to PDPA and the Rollout Plan
Where the standard already satisfies PDPA security obligations
Sharing the asset and risk registers across both programmes to avoid duplicate work
Assessing organizational readiness and planning the project against a real budget
Workshop: build your own 12-month implementation plan and present it
No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770
The SoA is the document stating which Annex A controls of ISO/IEC 27001 the organisation applies and which it excludes, with the reason for each and its implementation status. It must be consistent with the risk assessment and risk treatment plan. Auditors often use the SoA as their starting point, so justifications for excluded controls should be clear and traceable back to the risks.
Start by building an information asset register with an owner for each asset. Identify the relevant threats and vulnerabilities, assess likelihood and impact on confidentiality, integrity and availability, and compare the resulting risk level with the acceptance criteria set by management. Then choose a treatment, reduce, accept, transfer or avoid, and record everything in a risk register. This course practises it on a core system from your own organisation.
Once the management system has been running for a while and you have completed an internal audit and management review, you apply to a certification body. The audit has two stages: stage one reviews documentation and readiness, and stage two checks that the system is actually implemented as documented. A successful audit leads to a certificate valid for three years, with surveillance audits each year in between.
It suits executives and IT heads leading an ISO/IEC 27001 project, information security and risk management staff, internal auditors, and organisations whose clients or partners require this certification. No prior knowledge of standards or management systems is needed, but you should have a reasonable understanding of your organisation's processes and how information flows through it.
You will be able to explain clauses 4 to 10, set the ISMS scope and security policy, build an asset register and assess risks, select Annex A controls and produce an SoA, apply organisational, people, physical and technological controls, manage documents, plan internal audits and prepare your organisation for a certification audit. Participants who complete the training receive a Certificate of Completion with its own number, which can be verified online.
Yes. It can be run in-house for your team, with examples adapted to your own work, such as using your core business systems to build the risk register and draft the SoA together. You can request a quotation from this page, or contact us on LINE @itgenius or by phone on 02-570-8449.
Thailand's Personal Data Protection Act B.E. 2562 (PDPA) is now fully in force, and most of the day-to-day workload falls on IT teams and data custodians: knowing what personal data the organization holds and where, maintaining records of processing…
An organization can only defend well when it understands how attackers think and operate. This course teaches ethical penetration testing following a standard methodology: defining scope and obtaining written authorization, reconnaissance, scanning and…
