Organisations in every sector now depend on digital systems for revenue, service delivery and trust. Customers, regulators, lenders and tender evaluators increasingly ask for evidence that information is protected by a managed system rather than by a collection of tools. ISO/IEC 27001 is the best-known international standard for such a system, and recognised certification is a frequent requirement in banking, outsourcing, cloud and public sector contracts.

This ten-day programme gives participants a full working understanding of the standard and the governance behind it. The first five days build the management system: understanding context and interested parties, setting scope, gaining leadership support, assessing and treating risk, selecting controls, writing the Statement of Applicability and preparing policies, procedures and records. The second five days focus on operating and proving it, with deeper technical and organisational controls, incident handling and resilience, performance measurement, internal audit and the certification process.

Compliance is treated as an ongoing discipline. Participants consider how the system interacts with data protection obligations, supplier contracts and sector regulations, and how to keep documentation proportionate. Teaching is lab and workshop based around a case organisation, so that by the end each participant has produced a draft ISMS pack and an audit report and has a roadmap for their own organisation.

On completing the programme, participants will be able to:

• Interpret the clauses and Annex A controls of ISO 27001 and relate them to business needs.
• Define ISMS scope, context and interested party requirements.
• Carry out an information security risk assessment, prepare a risk treatment plan and produce a Statement of Applicability with justified control selection.
• Write core policies, procedures and records proportionate to the organisation.
• Design incident response and business continuity arrangements, and evaluate technical controls such as access management, encryption, logging and vulnerability handling.
• Define security metrics and run an effective management review.
• Plan and conduct an internal audit and raise clear nonconformities.
• Prepare an organisation for certification audits and sustain improvement afterwards.

The programme is intended for professionals responsible for protecting information and demonstrating compliance, including:

• Chief information security officers and information security managers
• IT managers and systems administrators with security duties
• Risk, compliance and governance officers
• Internal and IT auditors
• Data protection officers and privacy managers
• Business continuity and disaster recovery managers
• Security consultants preparing clients for certification
• Project managers leading ISMS implementation
• Procurement and vendor managers assessing supplier security

Participants leave with a body of practical work, including:

• A draft ISMS scope statement and information security policy.
• A completed asset and risk register using a recognised method.
• A Statement of Applicability with rationale for each control.
• Templates for incident reports, access reviews and supplier assessments.
• An internal audit programme, checklist and sample audit report.
• A management review agenda with a set of security metrics.
• A phased certification roadmap for their own organisation.

The ten days are structured around the build of one management system for a case organisation:

• Clause-by-clause explanation linked to practical documentation tasks
• Risk, control and audit labs using realistic registers and evidence
• Tabletop incident simulations and cloud migration scenarios
• Mock internal audit with role-play of auditor and auditee
• Template pack and individual feedback on each participant's roadmap

Participants who attend the ten days and complete the practical exercises receive a CPD-accredited Certificate of Completion issued by Vision Reach Global Consultancy. It records training hours and does not replace personal certification by an independent body.