Live Online Risk Management for Cybersecurity & Information Security (ISO 27001) Training Course
Live online, instructor-led · next cohort Oct 19, 2026 · from USD 1,700
Ransomware, phishing, insider misuse and supplier breaches hit organisations of every size, and boards, regulators, banks and donors now ask for proof that information risk is managed systematically. An ISO 27001 management system gives that proof, but only if the underlying risk assessment is sound. Ten days take you from first principles to a working, auditable programme.
The first week builds the foundations: information assets and classification, threat and vulnerability analysis, risk methods in ISO 27005 and NIST SP 800-30, likelihood and impact scoring, the Statement of Applicability and the risk treatment plan. You also study the ISO 27001 clauses on context, leadership, planning, support and operation. The second week goes deeper, with Annex A control families, access management, cryptography, secure development, cloud and supplier risk, incident response, business continuity, vulnerability management, security monitoring, internal audit, management review and certification preparation. Practical labs use sample organisations and tools such as risk registers, MITRE ATT&CK mapping and tabletop exercises. The course is designed for information security officers, IT managers, risk and compliance professionals, auditors, consultants and system owners. It is offered in classroom, online and in-house formats, with a CPD-accredited certificate and a drafted risk assessment for your own organisation.
At a Glance
How Live Online Training Works
Live online training, led by a trainer in real time, for participants anywhere.
More about live online training →- Format
- Live online, instructor-led
- Duration
- Mon - Fri (10 Days)
- Fee
- USD 1,700 (KES 160,000)
- Next start dates
- Oct 19, 2026, Nov 16, 2026, Dec 14, 2026
- Certificate
- Certificate of Completion
- What you need
- A computer with a reliable internet connection, a webcam and a headset
About this course
Information is among the most valuable assets an organisation holds, and it is under constant attack. Phishing, credential theft, ransomware and misconfigured cloud services lead to financial loss, operational shutdown and legal exposure. Many organisations respond with a collection of tools but without a clear view of which risks matter most, who owns them and whether controls are really working.
The Risk Management for Cybersecurity & Information Security (ISO 27001) Training Course gives participants a structured way to answer those questions. The first phase teaches the vocabulary and mechanics of information risk: identifying assets and owners, modelling threats, evaluating vulnerabilities, scoring risk and choosing among treat, tolerate, transfer and terminate options. Participants then see how these results feed the requirements of ISO/IEC 27001, including the Statement of Applicability, objectives, documented information and performance evaluation.
The second phase moves into implementation depth. Participants study technical and organisational controls, test them against realistic attack scenarios, assess third-party and cloud exposure, rehearse incident response and learn how to audit and improve the system. Work is lab-based and cumulative, and every participant develops a risk register, a draft Statement of Applicability and an improvement roadmap that can be adapted to their own environment.
Training Objectives
By the end of the course, participants will be able to:
- Explain the structure and requirements of ISO/IEC 27001 and its relationship to ISO 27002 and ISO 27005.
- Define the ISMS scope and build an asset inventory with classification, owners and dependencies.
- Identify threats and vulnerabilities and score risks consistently.
- Prepare a risk treatment plan and a Statement of Applicability.
- Select and evaluate Annex A controls across people, process, physical and technological themes.
- Assess third-party, cloud and supply chain security risk.
- Plan incident response, business continuity and security monitoring.
- Conduct internal audits and management reviews to prepare for external certification.
What you'll learn
Key Takeaways
Participants leave the course with:
- A populated information security risk register based on a sound method.
- A draft Statement of Applicability with justified control choices.
- A risk treatment plan with owners, timelines and residual risk.
- An incident response playbook tested in a tabletop exercise.
- An internal audit checklist aligned to ISO 27001 clauses.
- A roadmap for moving their organisation towards certification readiness.
Training Methodology
Over ten days the programme alternates explanation with building real documents. Participants experience:
- Instructor-led sessions on the standard and risk methods
- Cumulative labs that produce a risk register and Statement of Applicability
- Threat modelling and configuration review exercises
- Tabletop incident simulations with assigned response roles
- Peer audits of each other's documentation
- Mentoring time for adapting outputs to a home organisation
Day 1: Information Risk and the Threat Landscape
- Confidentiality, integrity and availability in practice
- Current threats: phishing, ransomware, insider misuse and supply chain attacks
- Risk terminology: asset, threat, vulnerability, impact and likelihood
- Overview of the ISO 27000 family
- Roles and responsibilities in security governance
- Case study: anatomy of a breach
Day 2: ISO 27001 Requirements and Scoping
- Structure of ISO/IEC 27001 and the Plan-Do-Check-Act cycle
- Understanding context and interested parties
- Defining the scope and boundaries of the system
- Leadership commitment and the information security policy
- Objectives, resources and competence
- Exercise: drafting a scope statement
Day 3: Asset Identification and Classification
- Building an asset inventory across data, systems, people and suppliers
- Asset ownership and dependency mapping
- Information classification and handling rules
- Business impact analysis for key services
- Data flows and records of processing
- Lab: creating an asset register
Day 4: Risk Assessment Methods
- Qualitative and quantitative risk approaches
- ISO 27005 and NIST SP 800-30 compared
- Threat modelling and vulnerability sources
- Likelihood and impact scales and risk criteria
- Risk acceptance and appetite
- Lab: scoring risks for a sample organisation
Day 5: Risk Treatment and the Statement of Applicability
- Treatment options: modify, retain, avoid and share
- Linking risks to Annex A controls
- Writing the Statement of Applicability
- Residual risk and risk owner approval
- Building the treatment plan and tracking it
- Review: week one integration exercise
Day 6: Organisational and People Controls
- Policies, roles, segregation of duties and asset use
- Screening, onboarding, offboarding and remote work
- Awareness training and phishing simulation
- Supplier relationships and agreement clauses
- Legal, regulatory and contractual requirements
- Workshop: designing a security awareness plan
Day 7: Technological Controls
- Identity, authentication, privileged access and least privilege
- Cryptography and key management
- Network security, segmentation and secure configuration
- Endpoint protection, patching and vulnerability management
- Secure development and change management
- Lab: assessing a configuration against control requirements
Day 8: Cloud, Third-Party and Physical Security Risk
- Shared responsibility model for cloud services
- Supplier due diligence and ongoing monitoring
- Physical and environmental security controls
- Backup, logging and security monitoring
- Mapping attacker techniques with MITRE ATT&CK
- Exercise: reviewing a supplier questionnaire
Day 9: Incident Response and Resilience
- Incident management lifecycle and roles
- Detection, triage, containment and recovery
- Evidence handling and breach notification duties
- Business continuity and disaster recovery planning
- Testing plans through tabletop exercises
- Tabletop simulation: a ransomware incident
Day 10: Audit, Improvement and Certification Readiness
- Monitoring, measurement and security metrics
- Planning and conducting an internal audit
- Nonconformities and corrective action
- Management review inputs and outputs
- Stage 1 and stage 2 certification audit preparation
- Final roadmap presentations and course review
The course is designed for professionals who manage, assess or assure information security, such as:
- Information security officers and managers
- IT managers and systems administrators
- Risk and compliance officers
- Internal and IT auditors
- Data protection officers
- Cloud and network engineers moving into governance roles
- Security consultants and implementers of management systems
- System owners in banks, telecoms, government and NGOs
Participants who attend all ten days and complete the lab work and final roadmap presentation are awarded a CPD-accredited Certificate of Completion by Vision Reach Global Consultancy. The certificate recognises training completed and is not a certification under ISO/IEC 27001.
Choose Where You Want to Learn
Risk Management for Cybersecurity & Information Security (ISO 27001) Training Course Venues
KenyaNairobiNext Nov 9· 13 dates$3,000- KenyaMombasaNext Oct 26· 14 dates$3,200
- KenyaNaivashaNext Nov 2· 13 dates$3,000
- KenyaKisumuNext Oct 26· 14 dates$3,000
- KenyaMachakosNext Nov 2· 13 dates$3,200
UgandaKampalaNext Nov 2· 13 dates$3,800
RwandaKigaliNext Oct 26· 14 dates$3,800
TanzaniaArushaNext Nov 9· 13 dates$3,800- TanzaniaDodomaNext Oct 26· 14 dates$3,600
- TanzaniaDar es SalaamNext Oct 26· 14 dates$4,000
- TanzaniaZanzibarNext Nov 16· 13 dates$5,200
NigeriaLagosNext Nov 16· 13 dates$5,600- NigeriaAbujaNext Nov 9· 13 dates$5,600
South AfricaPretoriaNext Nov 2· 13 dates$6,400- South AfricaJohannesburgNext Nov 2· 13 dates$6,800
- South AfricaCape TownNext Oct 26· 14 dates$7,600
UAEDubaiNext Oct 26· 14 dates$7,600
GhanaAccraNext Nov 16· 13 dates$9,000
Scroll sideways to see all 18 cities →
Frequently Asked Questions About Live Online Risk Management for Cybersecurity & Information Security (ISO 27001) Training Course
Everything you need to know about this course before you register.
By the end of the Risk Management for Cybersecurity & Information Security (ISO 27001) programme, you'll be able to explain the structure and requirements of iso/iec 27001 and its relationship to iso 27002 and iso 27005, define the isms scope and build an asset inventory with classification, owners and dependencies, identify threats and vulnerabilities and score risks consistently, and prepare a risk treatment plan and a statement of applicability. The full breakdown of topics is covered session by session in the Course Outline tab above.
The course is designed for professionals who manage, assess or assure information security, such as: Information security officers and managers, IT managers and systems administrators, Risk and compliance officers, Internal and IT auditors, Data protection officers, Cloud and network engineers moving into governance roles, Security consultants and implementers of management systems, and System owners in banks, telecoms, government and NGOs.
Risk Management for Cybersecurity & Information Security (ISO 27001) Training Course typically runs as 10 Days. It's available as in-person classroom, live virtual, and in-house corporate training — every course can also be delivered on-site for your team on dates that suit you.
Risk Management for Cybersecurity & Information Security (ISO 27001) Training Course is scheduled in-classroom in Nairobi, Kenya, Mombasa, Kenya, Naivasha, Kenya, and Kisumu, Kenya, and 14 other locations, plus a live interactive virtual classroom you can join from anywhere. Check the schedule panel above for exact upcoming dates and fees in each location.
The next live virtual cohort of Risk Management for Cybersecurity & Information Security (ISO 27001) starts November 16, 2026, with new classroom cohorts also running on a rolling basis. Pick a date and location in the schedule panel above, then click "Register for the Course" — it takes a few minutes and your seat is confirmed once payment or a signed purchase order is received.
Yes — delegates who meet the attendance requirement receive a Certificate of Completion for Risk Management for Cybersecurity & Information Security (ISO 27001) Training Course from Vision Reach Global Consultancy, issued in the name you register with, so double-check the spelling at checkout.
Risk Management for Cybersecurity & Information Security (ISO 27001) Training Course is pitched at advanced professionals. If you're unsure whether it's the right fit for your current role or background, message our training advisors before you register and they'll help you confirm.
Fees for Risk Management for Cybersecurity & Information Security (ISO 27001) Training Course vary by delivery location and format and are shown in real time in the schedule panel above once you pick a date. Register 3 or more delegates on the same course together and a 5% team discount is applied automatically — larger cohorts can request a custom corporate quote.
Yes — Risk Management for Cybersecurity & Information Security (ISO 27001) Training Course can be delivered on-site at your offices (or virtually for distributed teams), with case studies and examples tailored to your industry and the specific challenges your team is working through. Switch to the "In-House" tab in the schedule panel above to request a proposal.
Related Training
More Computing and Information Technology Courses
Data Analytics for Cybersecurity Training Course
Key Skills You'll Learn
- Understand core data analytics for cybersecurity principles and how they fit together in practice.
- Apply practical techniques for cybersecurity analytics in day-to-day implementation.
Vision Reach Global
From $3,000 · KSh 230,000
Cloud Computing and Infrastructure Management
Key Skills You'll Learn
- Develop comprehensive expertise in the course subject area
- Apply practical skills in real-world scenarios
Vision Reach Global
From $3,000 · KSh 230,000
Cybersecurity and Network Defense Training
Key Skills You'll Learn
- Develop comprehensive expertise in the course subject area
- Apply practical skills in real-world scenarios
Vision Reach Global
From $3,000 · KSh 230,000
ICT Infrastructure Management Training
Key Skills You'll Learn
- Develop comprehensive expertise in the course subject area
- Apply practical skills in real-world scenarios
Vision Reach Global
From $3,000 · KSh 230,000
Also Live Online
Other Live Online Courses
A-Z for Risk, Reliability and Safety Management Training
Key Skills You'll Learn
- Master core concepts and frameworks in a-z for risk, reliability and safety man
- Apply practical tools and methodologies to your own organizational context
Vision Reach Global
From $1,500 · KSh 115,000
Accounting for NGOs Using QuickBooks Training
Key Skills You'll Learn
- Master core accounting for ngos using quickbooks training concepts and frameworks.
- Apply relevant tools and techniques in your organizational context.
Vision Reach Global
From $1,500 · KSh 115,000
Accounts Payable and Operations Training Course
Key Skills You'll Learn
- Understand core accounts payable and operations principles and how they fit together in practice.
- Apply practical techniques for accounts payable and operations in day-to-day implementation.
Vision Reach Global
From $1,500 · KSh 110,000
Accounts Receivable Management and Development of Credit Policies Training
Key Skills You'll Learn
- Understand core accounts receivable management and development of credit policies principles and how they fit together in practice.
- Apply practical techniques for accounts receivable module 1 in day-to-day implementation.
Vision Reach Global
From $1,500 · KSh 115,000
Achievement of Gender Equity in Development Projects Training
Key Skills You'll Learn
- Master core achievement of gender equity in development projects training concepts and frameworks.
- Apply relevant tools and techniques in your organizational context.
Vision Reach Global
From $1,500 · KSh 115,000
Achieving Strategy through Leadership: Strategy and Innovation Training Course
Key Skills You'll Learn
- Understand core achieving strategy through leadership: strategy and innovation principles and how they fit together in practice.
- Apply practical techniques for managing strategic risks in day-to-day implementation.
Vision Reach Global
From $1,500 · KSh 115,000
What Our Clients Say
VRG brings strategic discipline to complex organizational challenges. Their approach is structured, data-driven, and outcome-focused.
Levis Wabwire
Managing Director
They facilitated our strategy review, we improved departmental KPI alignment by 35% and reduced operational bottlenecks significantly.
David Oketch
Strategy Lead
Employee engagement scores increased following the leadership training program. The difference in accountability culture is evident.
Wendy Albright
Program Manager
Looking for a different city or delivery format? See every date for Risk Management for Cybersecurity & Information Security (ISO 27001) Training Course or browse every live online course.