Attacks against organisations in East Africa and beyond have grown more frequent and more costly, while regulators, funders and customers ask for evidence of sound information security. Many institutions respond by buying tools, only to discover that unmanaged risk, untrained staff and unclear responsibilities leave them just as exposed. Lasting protection depends on technical safeguards and a management system that is planned, measured and improved.

Applied Cybersecurity & Information Security (ISO 27001) Training Course is a ten-day programme that joins the two. The first block builds technical competence in threats and attack techniques, secure network design, firewalls, endpoint protection, authentication, encryption, patching, vulnerability management and security monitoring. The second block covers the ISO/IEC 27001 framework from scoping and context through risk assessment, risk treatment, the Statement of Applicability and Annex A controls, documentation, awareness, supplier management, incident handling, continuity, internal audit and management review. The closing days apply everything to a simulated organisation.

Participants spend most of each day on practical work. Lab sessions use virtual machines and open-source tools, while case files and templates support the management system work. Each person finishes with a risk register, a set of draft policies and a readiness plan that can be taken back to their workplace.

By the end of the programme, participants will be able to:

• Analyse common cyber threats, attack techniques and the weaknesses they exploit.
• Configure and test network, endpoint and access controls using recognised hardening practice.
• Apply encryption, authentication and key management appropriately to business systems.
• Run vulnerability scans, prioritise findings and plan remediation.
• Conduct an information security risk assessment and select treatments.
• Build the core documents of an ISO/IEC 27001 management system, including the Statement of Applicability.
• Plan and manage incident response, evidence handling and business continuity.
• Carry out an internal audit and prepare an organisation for certification review.

The programme is intended for technical and management staff who protect or assure information systems, including:

• Information security officers and managers
• Systems, network and database administrators
• IT managers and heads of ICT
• Risk, compliance and internal audit professionals
• Security operations and incident response team members
• Data protection officers working alongside IT
• Software and cloud engineers responsible for secure delivery
• Consultants preparing clients for ISO 27001 certification
• Government and banking ICT staff in regulated environments

Participants leave the programme with:

• A completed information security risk register for a sample organisation.
• A draft Statement of Applicability and risk treatment plan.
• A hardening checklist for servers, workstations and network devices.
• An incident response plan with roles, playbooks and escalation steps.
• An internal audit programme and checklist for an ISO 27001 system.
• A step-by-step certification readiness roadmap.

Because the subject is practical, most time is spent doing rather than listening:

• Instructor-led labs on virtual machines with open-source security tools
• Attack and defend exercises that show why each control matters
• Management system workshops using sample policies and templates
• A simulated incident and tabletop response exercise
• An integrated closing project with group presentations and feedback

On finishing the ten days with full attendance and completed labs and exercises, each participant receives a Certificate of Completion from Vision Reach Global Consultancy, accredited for CPD. The certificate records completion of this training and is not an ISO 27001 auditor or practitioner qualification.