ISO/IEC 27001:2022 Lead Implementer Training

ISO/IEC 27001:2022 is the certifiable standard for an information security management system, and since the 2013 edition's transition period closed on 31 October 2025 every valid certificate is issued against the 2022 requirements. This course teaches the implementer's side of that standard: how to win the mandate, define a scope that stands up, run a risk assessment that produces defensible decisions, select and operate controls, and take the management system through Stage 1 and Stage 2 to an accredited certificate.

The programme follows the order in which the work is actually done, mapping each step to the clause it satisfies: business case and project governance; context, interested parties and the scope statement with its boundaries and interfaces; policy, objectives and the duties top management cannot delegate; risk assessment and treatment at 6.1.2 and 6.1.3 with ISO/IEC 27005:2022 as the method reference, comparing asset-threat-vulnerability and event-based identification; the Statement of Applicability as the document tying the 93 Annex A controls to the treatment decisions, including justified exclusions and controls adopted for non-risk reasons; the 2022 Annex A themes, attributes and eleven new controls, using ISO/IEC 27002:2022 as implementation guidance — guidance that cannot itself be certified against; the support and operation clauses; and performance evaluation, internal audit and management review.

It is written for CISOs, IT and security managers, GRC staff and consultants who own an ISMS project. No prior ISO/IEC 27001 knowledge is assumed; a working IT background is.

Assessment is a 30-question online exam with a 70% pass mark, and successful learners receive a verifiable SKEDMIA certificate. Approximately 16.5 hours of self-paced study, with downloadable scope, risk register and SoA templates and a nine-month implementation plan.