Cyberattacks and data breaches no longer make headlines only when they happen to someone else — they are now a routine risk every organization has to plan for. This Arab British Fellowship Training Academy program is built to prepare participants to lead that response, qualifying them to implement and manage an Information Security Management System (ISMS) in line with the ISO/IEC 27001 standard, the benchmark international organizations rely on.

Rather than treating information security as a purely technical checklist, the program frames it as a management discipline: participants learn to assess risk, build the right policies, manage security incidents, and lead internal audits — all in service of protecting information assets while meeting compliance and governance requirements.

By the end of the program, participants will be equipped with the professional competencies needed to lead an ISMS implementation from the ground up, with the reliability and rigor the ISO/IEC 27001 standard demands.

Who Should Attend?

• Information security managers and IT professionals within organizations.
• Individuals responsible for implementing and managing Information Security Management Systems.
• Consultants and auditors specializing in information security.
• Professionals pursuing ISO/IEC 27001 Lead Implementer certification.

Program Objectives

By the end of the program, participants will be able to:

• Understand the requirements and complete framework of the ISO/IEC 27001 standard.
• Implement and operate an Information Security Management System (ISMS) from scratch.
• Assess and analyze information security risks with real rigor.
• Apply monitoring and continual improvement mechanisms to keep the ISMS effective over time.
• Lead internal audit activities and prepare an organization for certification readiness.

Module 1: Why Information Security and ISO/IEC 27001 Matter

• Core concepts of information security.
• An overview of the ISO/IEC 27001 standard.
• The strategic benefits organizations gain from implementing it.

Module 2: ISMS Structure and Design

• The structure and requirements of an Information Security Management System.
• The role policies and procedures play within the ISMS.
• How different information security processes relate to one another.

Module 3: Defining Scope and Engaging Interested Parties

• Determining system boundaries and where the ISMS applies.
• Identifying interested parties and understanding their requirements.
• Preparing scope and objective documentation.

Module 4: Assessing and Treating Information Security Risk

• Risk assessment methodologies and identifying threats and vulnerabilities.
• Evaluating risk impact and setting priorities.
• Selecting controls from Annex A and documenting the resulting policies and procedures.

Module 5: Resourcing and Building a Security-Aware Culture

• Allocating the human and technical resources an ISMS needs.
• Running effective training and awareness programs.
• Embedding an information security culture across the organization.

Module 6: Monitoring, Measuring, and Continually Improving

• Performance indicators and measurement tools for the ISMS.
• Reviewing and analyzing security events.
• Applying the PDCA cycle to drive continual improvement and build a sustainable security culture.

Module 7: Leading Internal Audits per ISO/IEC 27001

• Audit objectives and methodologies.
• Planning and executing an internal audit.
• Reporting findings and recommendations.

Module 8: Responding to Information Security Incidents

• Types of information security incidents and how to approach each one.
• Developing response and recovery plans.
• Documentation and reporting procedures during and after an incident.