|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/isoiec-27001-lead-auditor-for-information-security/
课程评论：没有评论
课程名称：ISO/IEC 27001 信息安全首席审计员培训 课程概述： 该课程旨在帮助学员掌握信息安全管理系统（ISMS）审计以及ISO/IEC 27001:2022的要求，为在快速发展的信息安全领域中推进职业生涯提供基本技能。遵循国际标准，如ISO/IEC 27001，已成为各行业（包括金融、工程、IT、运输、专业服务和制造业）组织的关键要求。具备合规评估和帮助组织加强信息安全能力的专业人才需求旺盛。 通过注册本在线课程，您将深入理解审计基础知识、ISO/IEC 27001的具体要求、标准建议的安全控制措施，以及如何在ISMS审计过程中评估合规性。 第一部分将介绍信息安全管理系统的基础概念。您将学习ISMS的定义、ISO/IEC 27000系列标准的概况，以及ISO/IEC 27001:2022的目的和结构。 接下来的部分提供管理系统审计基础的全面概述。您将学习审计人员必须遵循的核心原则、有效收集审计证据的方法，以及重要文件如审计计划、审计方案和审计报告。这一部分还将深入讨论远程审计、如何分析审计结果和结论，以及首席审计员与审计员的区别，内部审计与外部审计的差异。 随后，课程将重点审计ISO/IEC 27001的管理系统要求。主要主题包括审计信息安全风险评估、评估ISMS的范围、审查信息安全政策和目标、评估管理评审及ISMS的内部审计、审计适用性声明和风险处理计划，以及如何管理不合规情况。每个主题都从审计员的视角进行分析，强调合规评估期间的关键评估领域。 课程的后四个部分讨论ISO/IEC 27001:2022中列出的信息安全控制的主要主题，包括： - 组织控制：如政策、供应商关系、事件管理、个人信息隐私保护、访问控制、威胁情报、信息分类和资产清单标记。 - 人员控制：包括人员筛选、纪律程序、信息安全教育与培训、保密及不披露协议。 - 物理控制：重点保护基础设施，抵御自然和环境威胁，布线安全，保护场外资产或管理存储介质的整个生命周期。 - 技术控制：覆盖加密、恶意软件保护、网络安全、安全开发、容量管理、备份、信息删除、数据掩码、安全漏洞管理或系统冗余等课题。 本课程提供评估ISMS审计中面临挑战的建议，如远程工作或个人设备（BYOD）的使用。您将获得审计员如何有效评估与这些控制措施合规性的实用见解。 最后一部分着重于关闭ISMS审计，涵盖如何形成审计结果和结论、如何召开结束会议以及规划必要的后审计活动。 本课程提供了对ISO/IEC 27001要求的完整和详细的探讨，并结合ISO/IEC 27002、ISO/IEC 27005和ISO/IEC 27035等相关标准的内容，理论与实践实例相结合，为审计员提供有价值的指导，重点关注收集有意义证据的方向。无论您是希望作为ISMS审计员提升职业生涯的专业人士，还是准备即将进行的审计，此课程都提供了系统而全面的方法，帮助您熟练掌握ISO/IEC 27001:2022 ISMS审计。
This course will help you master Information Security Management System (ISMS) auditing and the requirements of ISO/IEC 27001:2022, equipping you with essential skills to advance your career in the rapidly growing field of information security.Compliance with international standards, such as ISO/IEC 27001, is now a critical requirement for organizations across industries, including finance, engineering, IT, transportation, professional services or manufacturing. Professionals skilled in assessing compliance and in guiding organizations to strengthen their information security are in high demand.By enrolling in this online course, you will gain a solid understanding of auditing fundamentals, the specific requirements of ISO/IEC 27001, the standard's proposed security controls, and how to evaluate compliance during an ISMS audit.The first part of the course introduces the foundational concepts of information security management systems. You will explore what an ISMS is, the standards within the ISO/IEC 27000 series, and the purpose and structure of ISO/IEC 27001:2022.Next, the course provides a comprehensive overview of management system auditing basics. You will learn about the core principles auditors must adhere to, effective methods for collecting audit evidence, and critical documents such as the audit programme, audit plan, and audit report. This section also delves into remote auditing, how to analyze audit findings and conclusions, and the differences between lead auditors and auditors, as well as internal and external audits.The subsequent section focuses on auditing the management system requirements of ISO/IEC 27001. Key topics include auditing the information security risk assessment, assessing the scope of the ISMS, reviewing the information security policy and objectives, evaluating the management reviews and the internal audits of the ISMS, auditing the statement of applicability and the risk treatment plan or reviewing how the organization manages nonconformities. Each topic is analyzed from an auditor's perspective, emphasizing the critical areas to evaluate during compliance assessments.The following four sections of the course address the main themes of information security controls as outlined in ISO/IEC 27001:2022:Organizational Controls, such as policies, supplier relationships, incident management, privacy and protection of personally identifiable information, access control, threat intelligence, information classification and labelling of the inventory of information and assets.People Controls, including screening, disciplinary process, information security education and training, confidentiality and non-disclosure agreements.Physical Controls, focusing on securing the infrastructure, protecting against natural and environmental threats, cabling security, protecting assets off-premises or managing storage media throughout its life cycle.Technological Controls, covering topics like cryptography, malware protection, network security, secure development, capacity management, backups, information deletion, data masking, vulnerability management or system redundancy.This course provides suggestions for assessing during the ISMS audit challenges such as those posed by remote working, or the use of personal devices for work purposes (BYOD). You will gain actionable insights into how auditors can evaluate compliance with these controls effectively.The final section of the course focuses on closing the ISMS audit, covering how to formulate the audit's findings and conclusions, how to conduct the closing meeting and plan the necessary post-audit activities.This course provides a complete and detailed exploration of ISO/IEC 27001 requirements, with inputs from related standards such as ISO/IEC 27002, ISO/IEC 27005, and ISO/IEC 27035. It combines theoretical knowledge with practical examples, offering auditors valuable guidance on where to focus to gather meaningful evidence.Whether you are a professional aiming to advance your career as an ISMS auditor or preparing for an upcoming audit, this course offers a structured and comprehensive approach to mastering ISO/IEC 27001:2022 ISMS auditing.
