Course Outline
ISO/IEC 27002:2022 represents the latest international standard, offering practical guidelines for information security controls in conjunction with ISO/IEC 27001 to establish, implement, and enhance an Information Security Management System (ISMS). This updated outline reflects the 2022 revision and integrates current HR and recruitment terminology found in information security job descriptions.
Foundations of Information Security, Cybersecurity, and Privacy
- Core principles of information security: confidentiality, integrity, and availability (CIA triad) within modern enterprise environments
- The evolution of cybersecurity threats: ransomware, nation-state attacks, insider threats, and supply chain compromises
- Privacy by design and regulatory alignment with GDPR, CCPA, and global data protection frameworks
- Information governance: establishing ownership, accountability, and stakeholder alignment across departments
- Trust management and the zero-trust architecture paradigm in hybrid and cloud-infrastructure environments
The ISO/IEC 27001–27002 Framework and ISMS Governance
- ISO/IEC 27001 ISMS lifecycle: Plan-Do-Check-Act (PDCA) and certification pathways
- The relationship between ISO/IEC 27001 and the updated ISO/IEC 27002:2022 control catalog
- Development of information security policies and top-level governance structures
- Regulatory compliance mapping: strategies for aligning with NIST CSF, CIS Controls, SOC 2, and HIPAA
- Information security metrics, key performance indicators (KPIs), and continuous improvement reporting
Organizational Controls — The Control Group 5 Framework
- Information security roles, responsibilities, and segregation of duties across organizational tiers
- Threat intelligence programs and security information management platforms (SIEM, SOAR)
- Cloud security posture management (CSPM) and infrastructure-as-code compliance
- Security for social media, BYOD, and remote work: mobile device management and endpoint protection
- Monitoring, incident detection, and third-party risk management in complex IT ecosystems
People Controls — The Security Workforce
- Security awareness, behavior-change techniques, and phishing simulation programs
- Background vetting, and employment lifecycle security controls for onboarding and offboarding
- Resilience of the remote workforce and secure-access policies for flexible working arrangements
- Competency frameworks: aligning information security training with roles at all levels
- Fostering a security-first culture and cross-functional collaboration in risk management
Physical Controls — Facility and Asset Security
- Secure facility design: perimeter security, surveillance systems, and physical access controls
- Equipment maintenance, supply chain assurance, and asset lifecycle management
- Data center security: environmental controls, power redundancy, and disaster recovery readiness
- Secure disposal methods for sensitive media: sanitization standards and supply-chain integrity
- Emerging physical threats: IoT device security and smart-building attack surfaces
Technological Controls and Advanced Security Domains
- Cryptographic controls: key lifecycle management, PKI, and AI-driven encryption optimization
- Application security: secure SDLC, API security, DevSecOps integration, and SAST/DAST tooling
- Network architecture controls: segmentation, micro-segmentation, firewalls, and next-gen IDS/IPS
- Email security: anti-phishing, DMARC/SPF/DKIM, and Business Email Compromise (BEC) defense
- Artificial intelligence and machine learning in cybersecurity: automated threat detection and adversarial AI mitigation
Information Security Risk Assessment and Compliance
- ISO/IEC 27005-aligned risk assessment methodologies: identification, analysis, and evaluation
- Risk treatment planning and the statement of applicability (SOA)
- Compliance audit readiness: internal/external audit coordination and evidence-based auditing
- Penetration testing methodologies and vulnerability management lifecycle
- Emerging threats: quantum computing risk, environmental sustainability (green IT), and privacy-enhancing technologies (PETs)
PECB Exam Preparation and Real-World Application
- PECB ISO/IEC 27002 Foundation exam structure, competency domains, and preparation strategies
- Sample case studies: information security implementation in financial services, healthcare, and technology sectors
- Building an information security awareness and culture within your organization post-certification
- Certification maintenance, professional development, and career pathways for information security roles
Summary of Research
The previous two-day outline was heavily condensed and omitted the substantial scope of ISO/IEC 27002:2022, which introduced 93 controls grouped into four themes (Organizational, People, Physical, Technological) — an increase from 114 controls across 14 categories in the 2013 version. Key trends in information security recruitment for 2024–2026 include zero-trust architecture, AI-driven security operations, cloud security posture management, DevSecOps integration, supply chain security, privacy-enhancing technologies, quantum-ready cryptography, and third-party risk management. Job postings for roles such as Information Security Analyst, ISMS Lead, Compliance Officer, Cybersecurity Specialist, and Risk Manager consistently require these competencies.
Requirements
There are no specific requirements to participate in this course.
Testimonials (4)
Theory followed by practical examples and exercices. Job well done!
Vincenzo Delle Donne - Department of National Defence
Course - ISO 37301 Compliance Management System
the expertise & knowledge of the trainer
Erica DeRosa DeRosa - Aecon Group INc.
Course - ISO 37001 Anti-Bribery Management System
With both my 2022 ISO 9001 audit prep-related training & the recently completed ISO 9001 audit prep refresher course; Dereck has helped me significantly with regards to gaining a new & practical perspective of the ISO 9001:2015 clauses & sections & how they apply to our business. Dereck has also helped me with both training courses --- to improve my ISO-related communications both with our company's employees and the external ISO Auditors .
Dana Foster - Corrigan Oil Company
Course - ISO 9001 Foundation
Speed of response and communication
