ISO/IEC 27001:2022 Information Security Management Systems Foundation Level Training and Certification Program

Programme Summary

Build an understanding of information security management using ISO/IEC 27001:2022. Participants connect information risks, justified security controls and assurance evidence with responsibilities and performance measures. Exercises based on a cloud enabled business information case develop requirement interpretation, evidence selection and gap recognition. The programme establishes a foundation for proportionate protection of information and business services and further implementation or auditor development.

Training Objectives

1 Explain information security management requirements; 2 Connect requirements with operational responsibilities; 3 Recognise unsupported control exclusions; 4 Select relevant implementation evidence; 5 Prepare for further practical development.

Learning Outcomes

1 Define information security system boundaries; 2 Assess information risks consistently; 3 Justify security control applicability; 4 Evaluate treatment and incident records; 5 Select security effectiveness indicators.

Target Audience

Information Security Managers; IT Risk Managers; Security Governance Analysts; IT Operations Managers; Management System Coordinators.

Target Industries

Financial Services; Cloud and IT Services; Telecommunications; Healthcare Providers; Government Digital Services.

Course Contents

• Module 1 Standard Purpose and Practical Application: Management system purpose and intended outcomes; Requirement guidance and evidence distinctions; Course case scope and learning responsibilities.
• Module 2 Information Context and Security Scope: Information assets processes and service boundaries; Interested party and contractual security needs; Security objectives and climate relevance.
• Module 3 Security Risk Assessment: Risk criteria and repeatable assessment methods; Threat vulnerability and impact scenarios; Risk ownership evaluation and prioritisation.
• Module 4 Risk Treatment and Applicability: Treatment options and control selection; Annex A comparison and exclusion justification; Statement of applicability and treatment approval.
• Module 5 Security Governance and Human Controls: Policy roles and management accountability; Competence awareness and personnel security; Communication and documented information controls.
• Module 6 Physical and Technical Security Interfaces: Access lifecycle and privileged permissions; Physical protection and information handling; Configuration monitoring and vulnerability management.
• Module 7 Supplier Cloud and Development Interfaces: Supplier security and contractual controls; Cloud responsibility and service dependencies; Secure development and change management.
• Module 8 Incident and Continuity Controls: Event reporting and incident response coordination; Evidence preservation and learning from incidents; Information security during disruption and recovery.
• Module 9 Security Evaluation and Improvement: Control effectiveness and performance indicators; Internal audit and management review; Corrective action and evolving information risks.
• Module 10 Interpreting Requirements in Context: Mandatory requirements and proportionate application; Interfaces with applicable legal obligations; Supported judgements and unresolved interpretation issues.
• Module 11 Selecting Relevant Management System Evidence: Risk assessment and treatment records; Statement of applicability; Access and incident records.
• Module 12 Foundation Application Workshop: Map responsibilities within the supplied case; Match controls to relevant requirements; Explain gaps and practical next steps.

Assessment

• 60 single best answer questions, including applied scenarios; one mark per question.
• 90 minute invigilated digital examination with identity verification. Approved accessibility adjustments preserve the assessed competence.
• Clean standard text and supplied case documents permitted; internet, messaging and external AI tools prohibited.
• Individual applied assessment (45 minutes): Using a supplied cloud enabled business information case, produce an information risk register and control rationale, link three controls to relevant requirements and explain one unresolved weakness.
• Assessment criteria: Accurate interpretation of information security management requirements; Relevant use of risk assessment and treatment records; Clear connection between controls responsibilities and identified gaps.
• Pass each component separately: 45/60 written marks (75%) and at least 70% on the applied task.
• All mandatory criteria must pass: Do not fabricate evidence or knowingly present unsupported conformity conclusions; Protect confidential or personal information within supplied case material.
• Individual results and feedback are provided. One reassessment may follow coaching under the published enrolment terms.

Certification

• Successful learners receive a TQCSI Arabia digital Certificate of Successful Completion.
• The certificate records the learner name, exact programme title, teaching hours, completion date and unique verification reference.
• Verified identity, full attendance and separate written and applied passes are required; all mandatory critical criteria must be met.
• Proposed issue target: within 30 calendar days of approved results and settlement of applicable fees.
• Records assessed foundation knowledge of information security management; it does not establish professional auditor status, independent personnel certification or organisational certification.
• Attendance confirmation may record completed hours for unsuccessful learners; it does not certify successful completion.

Programme Profile

Number of daysNumber of daysNumber of days

333

Total teaching hoursTotal teaching hoursTotal teaching hours

18 hours; breaks, pre course work and formal final assessments excluded.18 hours; breaks, pre course work and formal final assessments excluded.18 hours; breaks, pre course work and formal final assessments excluded.

Delegates allowedDelegates allowedDelegates allowed

Maximum 20 delegates.Maximum 20 delegates.Maximum 20 delegates.

Training prerequisitesTraining prerequisitesTraining prerequisites

No formal qualification required. Familiarity with information security management activities and everyday business processes is recommended.No formal qualification required. Familiarity with information security management activities and everyday business processes is recommended.No formal qualification required. Familiarity with information security management activities and everyday business processes is recommended.

Pre course assignment and assessmentPre course assignment and assessmentPre course assignment and assessment

Complete a 20-minute diagnostic and identify how risk assessment and treatment records support a supplied operational case.Complete a 20-minute diagnostic and identify how risk assessment and treatment records support a supplied operational case.Complete a 20-minute diagnostic and identify how risk assessment and treatment records support a supplied operational case.

End of course assessmentEnd of course assessmentEnd of course assessment

60 question written exam (90 minutes) and individual applied task (45 minutes).60 question written exam (90 minutes) and individual applied task (45 minutes).60 question written exam (90 minutes) and individual applied task (45 minutes).

Passing criteriaPassing criteriaPassing criteria

75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.