Compliance: ISO 27001
ISO/IEC 27001:2022 uses the same Harmonized Structure as other management-system standards, applied to information security. This course covers the Statement of Applicability, where every Annex A control is justified as included or excluded. It explains asset-based and scenario-based risk assessment, risk owners, the four treatment options and residual risk. It walks through Annex A's four themes and the controls that land on a Rails engineering team. It also covers scope definition, the certification lifecycle from the auditee's side, and what a certificate proves to a customer.
What you'll learn
- ✓How the Statement of Applicability records and justifies every Annex A control
- ✓Asset-based and scenario-based risk assessment, risk owners and the four treatment options
- ✓The four Annex A themes and the controls that land on an engineering team
- ✓How scope under clause 4.3 sets what a certificate covers
- ✓Stage 1, stage 2, surveillance and recertification audits, and how nonconformities close
- ✓What a certificate proves and how to answer a security questionnaire honestly
The same machine, pointed at security
The senior course "AI management system: ISO 42001" already taught you the machine. It covered clauses 4 through 10, Plan-Do-Check-Act, an Annex A of controls adopted selectively, internal audit and management review. It also covered nonconformity, corrective action and continual improvement. If…
Read the full lesson free →Curriculum
7 lessonsThe same machine, pointed at security
Presents ISO 27001 as a Harmonized Structure standard for information security and names the five topics specific to it.
The Statement of Applicability
Explains the Statement of Applicability: one row per Annex A control, with inclusion, justification and implementation status.
Risk assessment and risk treatment
Covers asset-based and scenario-based risk assessment, named risk owners, four treatment options and signed-off residual risk.
Annex A after 2022: what lands on engineering
Sorts Annex A's 93 controls into four themes, then goes through the ones a Rails engineering team owns.
Scope: the decision that determines everything
Explains how the clause 4.3 scope sets what a certificate covers, and how a narrow scope misleads customers.
The certification lifecycle: being audited
Describes stage 1 and stage 2 audits, surveillance audits, the three-year cycle and closing minor and major nonconformities.
What certification proves, and a Rails checklist
Sets out what certification proves, how to answer a security questionnaire honestly, and a ten-item Rails checklist.