Information Security, Privacy & IT
ISO/IEC 27001:2022 Information Security – Internal Auditor
Overview
A practical programme that equips staff to audit their own organisation against ISO/IEC 27001:2022. Participants learn to plan an internal audit, gather objective evidence, write clear findings and support corrective action, in line with ISO 19011.
The standard
About the standard
ISO/IEC 27001:2022
Information Security Management System
Lays out requirements for establishing, operating and improving an information security management system that protects the confidentiality, integrity and availability of information. Organizations must assess information security risks and select appropriate controls to treat them. It applies to organizations of any size or sector that need a structured, auditable way to manage cyber and information risk.
Key objectives
- Protect the confidentiality, integrity and availability of organizational information
- Establish a systematic, risk-based process for identifying and treating security threats
- Build organizational resilience against cyber-attacks and data breaches
- Provide a certifiable framework that demonstrates security commitment to stakeholders
- Enable continual improvement of security controls as threats evolve
Who uses it
Organizations that handle sensitive information and need to manage information security risk.
Structure of the standard
1–3Scope, references & terms
Introductory clauses defining the scope of the standard, normative references and key definitions.
4Context of the organisation
Understand internal and external issues, the needs and expectations of interested parties, and the scope of the management system.
5Leadership
Top-management commitment, an appropriate policy, and clearly assigned roles, responsibilities and authorities.
6Planning
Address risks and opportunities, set measurable objectives and plan the actions and changes to achieve them.
7Support
Provide the resources, competence, awareness, communication and documented information the system needs.
8Operation
Plan and control the processes needed to meet information-security requirements and to implement the actions determined by information-security risk assessment and treatment.
9Performance evaluation
Monitor, measure, analyse and evaluate; conduct internal audits and management reviews.
10Improvement
Manage nonconformities and corrective action and continually improve the management system.
Standard overview video
Learning outcomes
What you will be able to do
- Explain the intent and key requirements of ISO/IEC 27001:2022
- Prepare an internal audit plan and checklist
- Gather objective evidence and record findings
- Write nonconformity statements and support root-cause analysis
- Report audit results to management
Who should attend
Staff joining an internal audit team, process owners and quality, safety or compliance coordinators.
More in Information Security, Privacy & IT
All Information Security, Privacy & ITLead AuditorISMS-02Information Security, Privacy & IT
ISO/IEC 27001:2022 Information Security – Lead Auditor
Lead ImplementerISMS-03Information Security, Privacy & IT
ISO/IEC 27001:2022 Information Security – Lead Implementer
Internal AuditorITG-01Information Security, Privacy & IT
ISO/IEC 38500:2015 IT Governance – Internal Auditor
AXIOS · Certification body
Looking for management-system certification?
AXIOS certification is a separate, impartial certification body: audits, certification decisions and the public register of ISO certificates.