Live Online Operational Excellence in Cybersecurity & Information Security (ISO 27001) Training Course
Live online, instructor-led · next cohort Nov 2, 2026 · from USD 1,700
Ransomware, phishing, insider misuse and cloud misconfiguration threaten every organisation that holds customer, financial or operational data, and customers and regulators increasingly ask for proof of control. Ten days take you from governance to hands-on defence. Weeks one and two together cover ISMS scope and context, leadership commitment, asset inventories, risk assessment and treatment, the Statement of Applicability, Annex A controls, policies, access management, cryptography, secure development, supplier security and business continuity. Technical labs examine network segmentation, firewalls, vulnerability scanning, log monitoring, endpoint protection, cloud security and incident handling, ending with an integrated project.
The programme is designed for information security officers, IT managers, system and network administrators, risk and compliance managers, internal auditors, data protection officers and security consultants in banks, telecoms, government, health, education and technology firms. Afterwards you can plan and document an ISMS, run a risk assessment, select and evidence controls, conduct an internal audit, respond to an incident and prepare for external certification. Attend in a classroom, online or in-house, with a CPD-accredited certificate awarded on completion.
At a Glance
How Live Online Training Works
Live online training, led by a trainer in real time, for participants anywhere.
More about live online training →- Format
- Live online, instructor-led
- Duration
- Mon - Fri (10 Days)
- Fee
- USD 1,700 (KES 160,000)
- Next start dates
- Nov 2, 2026, Nov 30, 2026, Dec 28, 2026
- Certificate
- Certificate of Completion
- What you need
- A computer with a reliable internet connection, a webcam and a headset
About this course
Cyber attacks and data breaches now rank among the most significant operational risks for organisations of every size. Attackers target weak passwords, unpatched systems, misconfigured cloud services and untrained staff, and the cost of a single incident can include downtime, regulatory penalties, lost customers and legal claims. Many organisations respond with isolated technical purchases, yet resilience comes from a managed system that links risk, policy, technology, people and continual improvement. ISO/IEC 27001 provides the internationally recognised structure for that system.
This ten-day programme combines management system implementation with technical security practice. The first week covers the standard's clauses, context and scope, leadership and policy, asset and information classification, risk assessment methods, risk treatment planning, the Statement of Applicability and the control themes in Annex A. The second week deepens the technical and operational side: identity and access management, cryptography, network and endpoint security, vulnerability and patch management, logging and monitoring, secure development, cloud and supplier security, incident response, forensics basics, business continuity and disaster recovery. It then turns to measurement, internal audit, management review, corrective action and the certification process.
Participants learn through risk workshops, policy drafting, lab exercises, tabletop incident simulations and a closing project in which they assemble the core documentation of an ISMS for a fictional organisation.
Training Objectives
By the end of the ten days, participants will be able to:
- Explain the clauses of ISO/IEC 27001 and the structure of an information security management system.
- Define ISMS scope, context, interested parties and security objectives.
- Carry out an information security risk assessment and prepare a risk treatment plan.
- Produce a Statement of Applicability and select Annex A controls with evidence.
- Configure and review network, endpoint and access controls against common attack paths.
- Run vulnerability management and security monitoring routines.
- Lead incident response and link it to business continuity and recovery.
- Plan and conduct an internal audit and prepare for external certification.
What you'll learn
Key Takeaways
Participants complete the programme with:
- A documented ISMS scope statement and security policy set.
- A completed asset register and risk assessment using a recognised method.
- A draft Statement of Applicability with control justifications.
- A network and endpoint hardening checklist tested in the lab.
- An incident response plan and tabletop exercise report.
- An internal audit programme with checklists and a nonconformity report.
- A roadmap to certification tailored to their own organisation.
Training Methodology
The ten days alternate management system work with technical practice, through:
- Risk assessment and policy drafting workshops on a fictional organisation
- Hands-on labs for access control, hardening, scanning and monitoring
- A tabletop ransomware simulation with defined roles
- Mock internal audit interviews and nonconformity writing
- An integrated ISMS documentation project presented to the group
Day 1: Cyber Threats and the ISO 27001 Framework
- Current threat landscape: ransomware, phishing, insider and supply chain attacks
- Confidentiality, integrity and availability
- The ISO/IEC 27000 family and structure of ISO 27001
- Benefits and costs of certification
- Laws and regulations that interact with information security
- Case study: a breach traced to a missing control
Day 2: Context, Leadership and Scope
- Understanding the organisation and interested parties
- Setting ISMS scope and boundaries
- Leadership commitment, roles and responsibilities
- Information security policy and objectives
- Resources, competence and awareness
- Workshop: drafting a scope statement
Day 3: Assets and Risk Assessment
- Asset inventories and information classification
- Threat, vulnerability and impact identification
- Qualitative and quantitative risk methods
- Risk criteria, acceptance and ownership
- Using ISO 27005 style approaches
- Exercise: assessing risks to a customer database
Day 4: Risk Treatment and the Statement of Applicability
- Treatment options: modify, retain, avoid and share
- Annex A control themes: organisational, people, physical and technological
- Writing the Statement of Applicability
- Residual risk and management approval
- Evidence and documented information requirements
- Exercise: building a treatment plan
Day 5: People, Physical and Organisational Controls
- Screening, onboarding, remote working and exit controls
- Security awareness and phishing simulation design
- Physical security and secure areas
- Information transfer, classification handling and acceptable use
- Supplier and outsourcing security agreements
- Policy drafting lab
Day 6: Identity, Access and Cryptography
- Access control models, least privilege and privileged accounts
- Multi-factor authentication and password management
- Cryptography: encryption, hashing, certificates and key management
- Data loss prevention and backup protection
- Access reviews and joiner-mover-leaver processes
- Lab: configuring role-based access and encryption
Day 7: Network, Endpoint and Cloud Security
- Network segmentation, firewalls and secure remote access
- Endpoint protection, hardening and mobile device management
- Cloud shared responsibility and configuration review
- Email security and web filtering
- Secure development lifecycle and application testing
- Lab: hardening a server and reviewing firewall rules
Day 8: Vulnerability Management, Logging and Monitoring
- Vulnerability scanning, patching and penetration test scoping
- Log collection, SIEM concepts and alert triage
- Threat intelligence and detection use cases
- Change and configuration management
- Metrics for technical control effectiveness
- Lab: scanning a test network and prioritising findings
Day 9: Incident Response and Continuity
- Incident response lifecycle: prepare, detect, contain, eradicate, recover
- Evidence preservation and forensic basics
- Breach notification and communication
- Business impact analysis, recovery objectives and disaster recovery
- Testing continuity and backup restoration
- Tabletop simulation of a ransomware incident
Day 10: Audit, Improvement and Certification
- Performance evaluation, indicators and management review
- Planning and conducting an internal audit
- Nonconformities, corrective action and continual improvement
- Stage 1 and stage 2 certification audits and surveillance
- Integrated project presentation of ISMS documentation
- Personal roadmap and course review
The programme is intended for professionals who protect, govern or assure information systems, including:
- Chief information security officers and information security managers
- IT managers and heads of infrastructure
- Network, systems and cloud administrators
- Security analysts and SOC staff
- Risk, compliance and data protection officers
- Internal and IT auditors
- Business continuity and disaster recovery coordinators
- Software development leads responsible for secure delivery
- Consultants preparing clients for ISO 27001 certification
- Managers in banks, telecoms, health, government and education
Participants who attend all ten days and complete the labs and the integrated project are awarded a CPD-accredited Certificate of Completion issued by Vision Reach Global Consultancy. The certificate recognises course completion and is not an ISO 27001 auditor qualification.
Choose Where You Want to Learn
Operational Excellence in Cybersecurity & Information Security (ISO 27001) Training Course Venues
KenyaNairobiNext Nov 9· 13 dates$3,000- KenyaMombasaNext Oct 26· 14 dates$3,200
- KenyaNaivashaNext Nov 2· 13 dates$3,000
- KenyaKisumuNext Oct 26· 14 dates$3,000
- KenyaMachakosNext Nov 2· 13 dates$3,200
UgandaKampalaNext Nov 2· 13 dates$3,800
RwandaKigaliNext Oct 26· 14 dates$3,800
TanzaniaArushaNext Nov 9· 13 dates$3,800- TanzaniaDodomaNext Oct 26· 14 dates$3,600
- TanzaniaDar es SalaamNext Oct 26· 14 dates$4,000
- TanzaniaZanzibarNext Nov 16· 13 dates$5,200
NigeriaLagosNext Nov 16· 13 dates$5,600- NigeriaAbujaNext Nov 9· 13 dates$5,600
South AfricaPretoriaNext Nov 2· 13 dates$6,400- South AfricaJohannesburgNext Nov 2· 13 dates$6,800
- South AfricaCape TownNext Oct 26· 14 dates$7,600
UAEDubaiNext Oct 26· 14 dates$7,600
GhanaAccraNext Nov 16· 13 dates$9,000
Scroll sideways to see all 18 cities →
Frequently Asked Questions About Live Online Operational Excellence in Cybersecurity & Information Security (ISO 27001) Training Course
Everything you need to know about this course before you register.
By the end of the Operational Excellence in Cybersecurity & Information Security (ISO 27001) programme, you'll be able to explain the clauses of iso/iec 27001 and the structure of an information security management system, define isms scope, context, interested parties and security objectives, carry out an information security risk assessment and prepare a risk treatment plan, and produce a statement of applicability and select annex a controls with evidence. The full breakdown of topics is covered session by session in the Course Outline tab above.
The programme is intended for professionals who protect, govern or assure information systems, including: Chief information security officers and information security managers, IT managers and heads of infrastructure, Network, systems and cloud administrators, Security analysts and SOC staff, Risk, compliance and data protection officers, Internal and IT auditors, Business continuity and disaster recovery coordinators, Software development leads responsible for secure delivery, Consultants preparing clients for ISO 27001 certification, and Managers in banks, telecoms, health, government and education.
Operational Excellence in Cybersecurity & Information Security (ISO 27001) Training Course typically runs as 10 Days. It's available as in-person classroom, live virtual, and in-house corporate training — every course can also be delivered on-site for your team on dates that suit you.
Operational Excellence in Cybersecurity & Information Security (ISO 27001) Training Course is scheduled in-classroom in Nairobi, Kenya, Mombasa, Kenya, Naivasha, Kenya, and Kisumu, Kenya, and 14 other locations, plus a live interactive virtual classroom you can join from anywhere. Check the schedule panel above for exact upcoming dates and fees in each location.
The next live virtual cohort of Operational Excellence in Cybersecurity & Information Security (ISO 27001) starts November 2, 2026, with new classroom cohorts also running on a rolling basis. Pick a date and location in the schedule panel above, then click "Register for the Course" — it takes a few minutes and your seat is confirmed once payment or a signed purchase order is received.
Yes — delegates who meet the attendance requirement receive a Certificate of Completion for Operational Excellence in Cybersecurity & Information Security (ISO 27001) Training Course from Vision Reach Global Consultancy, issued in the name you register with, so double-check the spelling at checkout.
Operational Excellence in Cybersecurity & Information Security (ISO 27001) Training Course is pitched at advanced professionals. If you're unsure whether it's the right fit for your current role or background, message our training advisors before you register and they'll help you confirm.
Fees for Operational Excellence in Cybersecurity & Information Security (ISO 27001) Training Course vary by delivery location and format and are shown in real time in the schedule panel above once you pick a date. Register 3 or more delegates on the same course together and a 5% team discount is applied automatically — larger cohorts can request a custom corporate quote.
Yes — Operational Excellence in Cybersecurity & Information Security (ISO 27001) Training Course can be delivered on-site at your offices (or virtually for distributed teams), with case studies and examples tailored to your industry and the specific challenges your team is working through. Switch to the "In-House" tab in the schedule panel above to request a proposal.
Related Training
More Computing and Information Technology Courses
Data Analytics for Cybersecurity Training Course
Key Skills You'll Learn
- Understand core data analytics for cybersecurity principles and how they fit together in practice.
- Apply practical techniques for cybersecurity analytics in day-to-day implementation.
Vision Reach Global
From $3,000 · KSh 230,000
Cloud Computing and Infrastructure Management
Key Skills You'll Learn
- Develop comprehensive expertise in the course subject area
- Apply practical skills in real-world scenarios
Vision Reach Global
From $3,000 · KSh 230,000
Cybersecurity and Network Defense Training
Key Skills You'll Learn
- Develop comprehensive expertise in the course subject area
- Apply practical skills in real-world scenarios
Vision Reach Global
From $3,000 · KSh 230,000
ICT Infrastructure Management Training
Key Skills You'll Learn
- Develop comprehensive expertise in the course subject area
- Apply practical skills in real-world scenarios
Vision Reach Global
From $3,000 · KSh 230,000
Also Live Online
Other Live Online Courses
A-Z for Risk, Reliability and Safety Management Training
Key Skills You'll Learn
- Master core concepts and frameworks in a-z for risk, reliability and safety man
- Apply practical tools and methodologies to your own organizational context
Vision Reach Global
From $1,500 · KSh 115,000
Accounting for NGOs Using QuickBooks Training
Key Skills You'll Learn
- Master core accounting for ngos using quickbooks training concepts and frameworks.
- Apply relevant tools and techniques in your organizational context.
Vision Reach Global
From $1,500 · KSh 115,000
Accounts Payable and Operations Training Course
Key Skills You'll Learn
- Understand core accounts payable and operations principles and how they fit together in practice.
- Apply practical techniques for accounts payable and operations in day-to-day implementation.
Vision Reach Global
From $1,500 · KSh 110,000
Accounts Receivable Management and Development of Credit Policies Training
Key Skills You'll Learn
- Understand core accounts receivable management and development of credit policies principles and how they fit together in practice.
- Apply practical techniques for accounts receivable module 1 in day-to-day implementation.
Vision Reach Global
From $1,500 · KSh 115,000
Achievement of Gender Equity in Development Projects Training
Key Skills You'll Learn
- Master core achievement of gender equity in development projects training concepts and frameworks.
- Apply relevant tools and techniques in your organizational context.
Vision Reach Global
From $1,500 · KSh 115,000
Achieving Strategy through Leadership: Strategy and Innovation Training Course
Key Skills You'll Learn
- Understand core achieving strategy through leadership: strategy and innovation principles and how they fit together in practice.
- Apply practical techniques for managing strategic risks in day-to-day implementation.
Vision Reach Global
From $1,500 · KSh 115,000
What Our Clients Say
VRG brings strategic discipline to complex organizational challenges. Their approach is structured, data-driven, and outcome-focused.
Levis Wabwire
Managing Director
They facilitated our strategy review, we improved departmental KPI alignment by 35% and reduced operational bottlenecks significantly.
David Oketch
Strategy Lead
Employee engagement scores increased following the leadership training program. The difference in accountability culture is evident.
Wendy Albright
Program Manager
Looking for a different city or delivery format? See every date for Operational Excellence in Cybersecurity & Information Security (ISO 27001) Training Course or browse every live online course.