Zertio
ISO/IEC 27001 Foundation — Self-Study Unit0/72

ISO/IEC 27001 Foundation — Self-Study Unit

Self-study course

ISO/IEC 27001 Foundation

A self-study course on ISO/IEC 27001:2022 (incl. Amd 1:2024) — from the fundamentals of information security through the risk process and the 93 Annex A controls to the path to certification. Each lesson ends with exam questions, each section with a final test.

How the course is structured

Recommended order, but individual sections also work on their own

Course structure

Nine sections that build on each other — from the fundamentals to certification

Learning path across nine sections in four blocks Fundamentals in Sections 1 to 3, the standard at a glance in Section 4, the requirements in Sections 5 to 7, Annex A in Section 8 and certification in Section 9. Fundamentals Sections 1 to 3 · 20 lessons 1 · Information security 2 · Management systems 3 · The ISMS in detail The standard Section 4 4 lessons Structure, Cl. 1–3 Requirements Sections 5 to 7 · 20 lessons 5 · Clauses 4 to 6 6 · Clause 7 7 · Clauses 8 and 9 Annex A Section 8 17 lessons 93 controls Context Section 9 11 lessons Certification Recommended order — but the sections can also be used individually, for example Section 8 as a reference for the controls. Each lesson contains a key message, points to remember with references to the standard, a practical example and two exam questions with feedback. Each section concludes with a final test. Pass mark: 60 percent.

The nine sections

The bar on each tile shows your own progress

How to work with the course

Read and tick off

Each lesson contains a key message, points to remember with references to the standard and a practical example. The tick on the left marks it as completed.

Check instantly

Two multiple-choice questions per lesson. After you select an answer, you receive feedback on your answer, the correct solution and an explanation with the reference to the standard.

Complete the section

Each section ends with a final test of eight to twelve questions. A score of 60 percent or more is a pass.

Look up

Section 8 contains all 93 Annex A controls with filter and full-text search — it can also be used as a reference independently of the course.

Key terms

The terms follow ISO/IEC 27000, to which Clause 3 of the standard refers
ISMS
Information security management system — the structured framework an organization uses to manage information security.
Scope
Boundaries and applicability of the ISMS in accordance with Clause 4.3. Later stated on the certificate.
Interested party
Person or organization that can affect the ISMS or is affected by it (Clause 4.2).
Risk
Effect of uncertainty on objectives — can be positive or negative; this is why the standard refers to risks and opportunities.
Risk owner
Role that decides on the treatment of a risk and the acceptance of the residual risk (Clause 6.1.3 f)).
Statement of Applicability
Statement of Applicability. Lists the controls, justifications, implementation status and justifications for exclusion (Clause 6.1.3 d)).
Risk treatment plan
Plan with actions, responsibilities and deadlines; approved by the risk owners (Clauses 6.1.3 e), 8.3).
Documented information
Umbrella term for documents that set requirements and for records providing evidence (Clause 7.5).
Information security event
Observed occurrence that may be relevant to information security (A.6.8).
Information security incident
Event or series of events likely to compromise operations or information security (A.5.25).
Nonconformity
Non-fulfilment of a requirement. Calls for correction and elimination of the cause (Clause 10.2).
Correction
Eliminates the condition itself — not to be confused with corrective action.
Corrective action
Eliminates the cause so that the nonconformity does not recur (Clause 10.2 b) to e)).
Top management
Person or group of people who directs and controls the organization at the highest level. Addressee of Clauses 5 and 9.3.
Annex SL
Harmonized Structure for management system standards — the reason why 27001, 9001 and 20000-1 share the same structure.
Accreditation
Confirmation of a certification body’s competence by the national accreditation body.