ISO 27001 Overview

Fundamentals

• ISO 27001 Knowledge Base MOC
• Information Security Management System
• Field of Application, Usage, and Compliance
• ISO 27001 Clauses 4-10 vs Annex A
• Annex A and the Statement of Applicability
• Statement of Applicability
• Information Security Policy
• Roles and Responsibilities
• Segregation of Duties
• Management Responsibilities
• Access Control
• Risk Assessment
• Internal Audit
• Management Review

ISO/IEC 27002

• ISO 27002 Knowledge Base MOC
• ISO 27002 Annex A Control Interpretation Map
• ISO 27002 Control Attributes Evidence Map
• ISO27002 Control Attributes
• Control Attributes and Risk Treatment Effects

ISO/IEC 27005

• ISO 27005 Knowledge Base MOC
• ISO 27005 Risk Management Guide MOC
• ISO 27005 Risk Process Notes

Annex A controls covered

• A.5 Organizational Controls MOC
• A.6 People Controls MOC
• A.7 Physical Controls MOC
• A.8 Technological Controls MOC

Implementer guide

• ISO 27001 Implementer Guide MOC
• ISMS Implementation Roadmap
• A.5 Organizational Controls Implementation Guide
• A.6 People Controls Implementation Guide
• A.7 Physical Controls Implementation Guide
• A.8 Technological Controls Implementation Guide

Auditor guide

• ISO 27001 Auditor Guide MOC
• Internal Audit Execution Guide
• A.5 Organizational Controls Audit Guide
• A.6 People Controls Audit Guide
• A.7 Physical Controls Audit Guide
• A.8 Technological Controls Audit Guide

Crosswalks

• ISO 27001 Implementer Auditor ISO 27005 Mapping
• A.5 Controls Implementation Audit Risk Mapping
• A.6 People Controls Implementation Audit Risk Mapping
• A.7 Physical Controls Implementation Audit Risk Mapping
• A.8 Technological Controls Implementation Audit Risk Mapping
• Asset Threat Vulnerability Risk Control Evidence Data Model

Roadmap and data model

• Standards Roadmap
• 16 Week ISO Study Plan
• GRC Knowledge Model MOC

Templates

• Templates MOC

Audit

• Audit Evidence Index

Exam

• Exam Cues
• Common Exam Traps
• Quiz Review - Control Attributes and Compliance
• EXAM-017-Awareness-Education-and-Training
• EXAM-018-Disciplinary-Termination-and-Confidentiality
• EXAM-019-Remote-Working-and-Event-Reporting
• EXAM-020-Physical-Perimeters-and-Entry
• EXAM-021-Room-Security-and-Physical-Monitoring
• EXAM-022-Environmental-Secure-Areas-and-Clear-Desk
• EXAM-023-Equipment-Siting-and-Protection
• EXAM-024-Off-Premises-Assets-and-Storage-Media
• EXAM-025-Supporting-Utilities
• EXAM-026-Cabling-Maintenance-and-Equipment-Disposal
• EXAM-027-Endpoint-and-Privileged-Access
• EXAM-028-Source-Code-Authentication-and-Capacity
• EXAM-029-Malware-Protection
• EXAM-030-Vulnerability-and-Configuration-Management
• EXAM-031-Deletion-and-Data-Masking
• EXAM-032-DLP-and-Backup
• EXAM-033-Redundancy-and-Logging
• EXAM-034-Monitoring-Activities
• EXAM-035-Software-Installation-and-Network-Security
• EXAM-036-Network-Services-Segregation-and-Web-Filtering
• EXAM-037-Use-of-Cryptography
• EXAM-038-Secure-Development-and-Architecture
• EXAM-039-Secure-Coding-and-Security-Testing
• EXAM-040-Outsourced-Development-and-Environment-Separation
• EXAM-041-Change-Test-Information-and-Audit-Testing