ISO/IEC 27002. Information security controls

Explore ISO/IEC 27002:2022 Information Security Controls

Gain a comprehensive understanding of the 93 controls essential for building a robust Information Security Management System (ISMS) with this in-depth course. This course provides a detailed overview of the internationally recognized ISO/IEC 27002 standard, a cornerstone of information security best practices.

What you'll learn:

• Introduction to ISO/IEC 27000: Understand the broader ISO/IEC 27000 family of standards and the specific role and purpose of ISO/IEC 27002.
• Key Concepts Defined: Get clear definitions of critical terms like information security, cybersecurity, and privacy. Learn what constitutes an ISMS and its essential components.
• Organizational Controls: Delve into 37 organizational controls crucial for a strong security posture. Topics covered include:
  • Roles and Responsibilities: Defining clear security roles within your organization.
  • Segregation of Duties: Preventing fraud and errors through separation of responsibilities.
  • Threat Intelligence: Proactively identifying and mitigating potential threats.
  • Project Management Security: Integrating security into project lifecycles.
  • Information Classification & Labelling: Properly categorizing and protecting sensitive data.
  • Access Control: Implementing secure access management practices.
  • Information Transfer: Securely sharing information both internally and externally.
  • Supplier Relationship Security: Managing security risks associated with third-party vendors.
  • ICT Continuity: Ensuring business operations can continue in the event of disruptions.
  • Privacy & PII Protection: Safeguarding personal information.
  • Documented Operating Procedures: Establishing clear security guidelines.
• People Controls: Learn how to manage security risks associated with personnel:
  • Screening Procedures: Background checks and vetting processes.
  • Employment Terms & Conditions: Incorporating security responsibilities into employment agreements.
  • Security Awareness Training: Educating employees about security threats and best practices.
  • Disciplinary Processes: Addressing security violations.
  • Remote Working Security: Securing remote access and devices.
• Physical Controls: Implement measures to protect physical assets:
  • Secure Areas: Restricting access to sensitive areas.
  • Entry Controls: Implementing physical access controls.
  • Clear Desk & Clear Screen: Minimizing data exposure.
  • Storage Media Security: Protecting physical storage devices.
  • Equipment Disposal: Securely disposing of outdated equipment.
• Technological Controls: Implement technical safeguards to protect your systems and data:
  • Endpoint Device Security: Securing laptops, desktops, and mobile devices.
  • Data Masking: Protecting sensitive data by obscuring it.
  • Information Deletion: Securely removing data.
  • Backup & Recovery: Ensuring data can be restored in case of loss.
  • Cryptography: Encrypting data at rest and in transit.
  • Logging & Monitoring: Tracking system activity for security events.
  • Network Security: Protecting your network infrastructure.
  • Secure Development & Coding: Building secure applications.
  • Test Information Protection: Safeguarding data used in testing environments.
  • Web Filtering: Blocking access to malicious websites.
  • Secure Authentication: Implementing strong authentication methods.
  • Access to Source Code: Controlling access to source code repositories.
  • Privileged Utility Programs: Managing access to powerful system tools.
• ISO/IEC 27001 & 27002 Certification: Understand the process of achieving certification for both organizations and individuals.

This course is designed to equip you with the knowledge and skills to implement and maintain an effective information security management system aligned with ISO/IEC 27002:2022.