Certified Internal Information Security Auditor

Course Outline

1. Introduction to Information Security Management

• Importance of information security in organizations
• Benefits of implementing ISO/IEC 27001
• Key concepts: confidentiality, integrity, and availability (CIA)
• Relationship between ISO 27001, ISO 27002, and other standards

2. Overview of ISO/IEC 27001:2022

• Structure of the standard (High-Level Structure – Annex SL)
• Key terms and definitions
• Risk-based approach and the Plan–Do–Check–Act (PDCA) cycle
• Understanding the ISMS scope and organizational context

3. ISMS Requirements

• Context of the organization (Clause 4)
• Leadership and commitment (Clause 5)
• Planning, including risk assessment and risk treatment (Clause 6)
• Support, resources, competence, awareness, and communication (Clause 7)
• Operational control, monitoring, and measurement (Clauses 8–9)
• Improvement and corrective actions (Clause 10)

4. Introduction to Auditing Concepts

• Purpose and principles of internal auditing
• Types of audits: first-party (internal), second-party, third-party
• Auditor responsibilities, competencies, and ethics
• Overview of ISO 19011:2018 Guidelines for Auditing Management Systems

5. Internal Audit Planning

• Establishing an internal audit program for ISMS
• Developing audit plans and checklists
• Document review and preparation
• Sampling techniques for information security processes

6. Conducting the Internal Audit

• Opening meeting and interview techniques
• Collecting and verifying objective evidence
• Evaluating ISMS processes, controls, and risk treatment effectiveness
• Identifying nonconformities, observations, and opportunities for improvement

7. Audit Reporting and Corrective Actions

• Writing audit findings and reports
• Communicating results to management
• Root cause analysis for nonconformities
• Implementing corrective actions and follow-up

8. Auditor Skills and Professional Development

• Effective communication during audits
• Handling sensitive information and confidentiality
• Managing challenging audit situations professionally

9. Practical Exercises and Case Studies

• Audit planning and simulation exercises
• Interview role-plays and evidence verification
• Writing nonconformity reports
• Risk-based audit evaluation exercises