ISO in the Sun: Courses on Risk, Information Security, Business Continuity and more in Lanzarote

Overview

This three day course enables participants to develop the necessary expertise to support an organisation in implementing risk management processes related to all assets of relevance for information security based on ISO/IEC 27005:2022.

ISO/IEC 27005:2022 builds onto the generic risk management principles set out in ISO 31000:2018, and applies those to the context of an information security management system (ISMS), thus providing a framework for satisfying the risk management requirements of ISO/IEC 27001:2022.

The course consists of a mix of presentation, discussion and exercises based on real-world examples.

Outline

Introduction to Information Security Risk Management per ISO/IEC 27005:2022

• Concepts and Definitions relating to Risk Management
• Risk Management Standards, Frameworks and Methodologies
• Implementation of a Risk Management Framework
• Understanding an Organization and its Context

Elements of the Risk Management Framework

• Risk Identification
• Risk Analysis and Risk Evaluation
• Risk Treatment
• Risk Acceptance and Residual Risk Management
• Risk Communication and Consultation
• Risk Recording and Reporting
• Risk Monitoring and Review

Examples of Risk Assessment Methodologies

• Operational Critical Threat, Asset and Vulnerability Evaluation (OCTAVE)
• Harmonised Risk Analysis Method (MEHARI)
• Expression of Needs and Identification of Security Objectives (EBIOS)
• NIST Framework
• CCTA Risk Analysis and Management Method (CRAMM)
• Harmonized Threat and Risk Assessment (TRA)

Objectives

Completion of this course will enable students to

• Understand concepts, approaches, methods, tools and techniques for effective information security risk management according to ISO/IEC 27005:2022
• Understand the relationship between risk management, controls and ISO/IEC 27001:2022
• Implement, maintain and manage an ongoing
information security risk management program
• Advise organisations on best practices in information security risk management

Audience

This course is aimed at students with (future) roles like

• Risk managers and Information security officers
• Project managers, consultants and team members implementing and operating information security management systems
• Auditors requiring more risk management insight

Prerequisites

General understanding of common business processes.

Some past exposure to risk management and / or management systems helpful, but not required.

Examination and Certification

The course includes access to PECB's two hour exam available in multiple languages to be taken online any time after the course (own laptop required). Exam and first year certification fees are included in the course fees.

This course is designed by PECB in Canada, who also mark the exam and issue respective certifications as per their criteria. PECB is a personnel certification body, accredited to ISO/IEC 17024:2012 by IAS. See www.pecb.com for full details.

Overview

This training provides a comprehensive review of information security concepts and industry best practices, covering the 8 domains of CISSP CBK (Common Body of Knowledge).

Several types of activities are used throughout the course to reinforce topics and increase knowledge retention. These activities include open ended questions from the instructor to the students, matching and poll questions, group activities, open/closed questions, and group discussions. the interactive learning technique is based on sound adult learning theories.

This training course will help candidates review and refresh their information security knowledge and help identify areas they need to study for the CISSP exam and features.

The vendor-neutral CISSP certification is the ideal credential for those with proven deep technical and managerial competence, skills, experience, and credibility to design, engineer, implement, and manage their overall information security program to protect organizations from growing sophisticated attacks.

The CISSP certification is recognized worldwide.

Outline

Security and Risk Management

Asset Security

Security Engineering

Communications and Network Security

Identity and Access Management

Security Assessment and Testing

Security Operations

Software Development Security

Objectives

Completion of this course will enable students to

• Understand the 8 domains of knowledge that are covered on the CISSP exam
• Analyse questions on the exam and be able to select the correct answer
• Apply the knowledge and testing skills learned in class to pass the CISSP exam
• Understand and explain all of the concepts covered in the 8 domains of knowledge
• Apply the skills learned across the 8 domains to solve security problems when you return to work

Audience

This course is aimed at students with (future) roles like

• Security consultants, architects and managers, IT directors and managers
• Security analysts, security systems engineers, network architects
• Chief information security officers (CISOs), directors of security etc.
• Security auditors

Prerequisites

Basic knowledge of Information Systems is recommended.

Minimum of four students are required to run this course.

Examination and Certification

This course has been designed and is delivered by Nitroxis and their trainers.

Note: this course does not include the CISSP exam. This has to be taken at the dedicated test facilities as defined by (ISC)2. (ISC)2‘s certification requirements apply.

Overview

This training provides a comprehensive review of information security auditing concepts and industry best practices, covering the entire CISA CBK, aligned with the 28th Edition of the CBK, updated for 2024 Job Practice.

The CISA certification is recognized worldwide.

Outline

Information Systems Auditing Process

• Planning: IS Audit Standards and Types, Functions, Ethics, Risk-based Approach, Types of Controls and Considerations
• Execution: Project Management, Testing and Sampling, Evidence Collection, Data Analytics, Reporting, QA, Process Improvement

Governance and Management of IT

• IT Governance: Laws, Regulations and Industry Standards, Organisational Structures, IT Governance, Strategy, Policies, Procedures, Enterprise Architecture and Risk Management, Data Privacy, Governance and Classification
• IT Management: IT Resource and Vendor Management, Performance Monitoring and Reporting, Quality Assurance

Information Systems Acquisition, Development and Implementation

• Information Systems Acquisition and Development: Project Governance and Management, Business Case, Feasibility Analysis, System Development Methodologies, Control Identification and Design
• Information System Implementation: System Readiness and Implementation Testing, Configuration and Release Management, System Migration, Infrastructure Deployment and Data Conversion, Post-Implementation Review

Information Systems Operation and Business Resilience

• Information Systems Operations: Asset, Capacity, Incident, Problem, Change, Configuration, Log and Patch Management, Job Scheduling, End-User Computing and Shadow IT, Databases etc.
• Business Resilience: BIA, Backup, Storage, Restoration and Recovery, Business Continuity and Disaster Recovery Plan

Protection of Information Assets

• Information Asset Security and Control: Physical Controls, IAM, DLP, Network, Endpoint, Mobile, Wireless, Virtualization, Cloud and IoT Security, Encryption, PKI
• Security Event Management: Security Awareness, Attacks, Testing, Monitoring, Incident Response, Evidence Collection and Forensics

Objectives

Completion of this course will enable students to

• Know the 5 major areas covered by the CISA® certification
• Understand the concepts of IT audit and IT governance
• Preparing for the CISA Certification Exam, e.g. by using multiple choices questions from previous CISA sessions (or comparable exams).

Audience

This course is aimed at students with (future) roles like

• Information system directors, CISOs
• Auditors moving into the information security domain
• Staff responsible for business continuity
• People for which the control of information security is fundamental in achieving their goals

Prerequisites

Basic knowledge of Information Systems is recommended.

Minimum of two students are required to run this course.

Examination and Certification

This course has been designed and is delivered by Nitroxis and their trainers.

Note: this course does not include the CISA exam. This has to be taken at the dedicated test facilities as defined by ISACA. ISACA‘s certification requirements apply.

Overview

This training provides a comprehensive review of information security concepts and industry best practices, covering the 4 domains of the CISM CBK (Common Body of Knowledge).

This training course will help candidates review and refresh their information security management knowledge and help identify areas they need to study for the CISM exam.

The CISM certification is recognized worldwide.

Outline

Information Security Governance

• Alignment of policy security information on the business strategy and direction
• Policy security information development
• Commitment of senior management and support for information security across the enterprise
• Roles and responsibilities in the governance of information security

Information Security Risk Management and Compliance

• Development of a systematic and analytical approach and the ongoing process of risk management
• Identification, analysis and risk assessment
• Definition of strategies risk treatment
• Risk management communication

Information Security Program Development and Management

• The security information architecture
• System Development Methodologies, Controls
• Methods to define the required security measures
• Contract management and information security requirements
• Metrics and evaluation of IT security performance

Information Security Incident Management

• Components of a security incident management plan
• Concepts and practices in the management of security incidents
• Method classification
• Notification and escalation process
• Detection techniques and incidents analysis

Objectives

Completion of this course will enable students to

• Know the 4 domains covered by the CISM® certification
• Understand the concepts of information security management
• Preparing for the CISM Certification Exam, e.g. by using multiple choices questions from previous CISM sessions (or comparable exams).

Audience

This course is aimed at students with (future) roles like

• Information system directors, CISOs
• Staff responsible for business continuity
• People for which the control of information security is fundamental in achieving their goals
• Auditors requiring more information security management insight

Prerequisites

Basic knowledge of Information Systems is recommended.

Minimum of two students are required to run this course.

Examination and Certification

This course has been designed and is delivered by Nitroxis and their trainers.

Note: this course does not include the CISM exam. This has to be taken at the dedicated test facilities as defined by ISACA. ISACA‘s certification requirements apply.

Overview

This training provides a comprehensive review of information security concepts and industry best practices, covering the 4 key areas of the 8th edition of the CRISC CBK (Common Body of Knowledge).

This training course will help candidates review and refresh their IT risk management knowledge and help identify areas they need to study for the CRISC exam.

The CRISC certification is recognized worldwide.

Outline

Governance

• Organizational Structure, Strategy, Goals and Objectives
• Business Process Review, Organization Asset Management
• Enterprise Risk Management and Risk Management Frameworks
• Lines of Defence
• Risk Profile, Appetite, Tolerance and Capacity
• Risk Frameworks, Legal, Regulatory and Contractual Requirements

Risk Assessment

• Threat Modelling and Threat Landscape
• Risk Scenario Development
• Risk Assessment Concepts, Standards and Frameworks
• Business Impact Analysis, Risk Analysis Methodologies
• Inherent, Residual and Current Risk

Risk Response and Reporting

• Risk Response Options, Risk and Control Ownership
• Vendor/Supply Chain Risk Management
• Control Design, Selection, Implementation and Analysis
• Risk and Control Testing, Monitoring and Reporting Techniques
• Risk Actions Plans, Risk and Control Metrics

Technology and Security

• Enterprise Architecture, Operations, Portfolio and Project Management
• System Development and Data Life Cycle Management
• Emerging Technologies
• Security Concepts, Frameworks and Standards
• Security/Risk Awareness and Training
• Data Privacy and Data Protection Principles

Objectives

Completion of this course will enable students to

• Master the risk management approach according the CRISC
• Apply the best response strategies to the risks weighing on the information systems
• Use best risk monitoring practices
• Define information system controls
• Use best risk and control monitoring practices
• Preparing for the CRISC Certification Exam, e.g. by using multiple choices questions from previous CRISC sessions (or comparable exams).

Audience

This course is aimed at students with (future) roles like

• Governance, information and cyber security consultants, CISOs
• Risk and control professionals
• IT and compliance professionals
• Project managers, business analysts
• Auditors requiring more IT risk management insight
• People working with an ERM (Enterprise Risk Management) framework

Prerequisites

Basic knowledge of Information Systems is recommended.

Minimum of two students are required to run this course.

Examination and Certification

This course has been designed and is delivered by Nitroxis and their trainers.

Note: this course does not include the CRISC exam. This has to be taken at the dedicated test facilities as defined by ISACA. ISACA‘s certification requirements apply.

Overview

This five day course enables participants to develop the necessary expertise to support an organisation in implementing and managing an Artificial Intelligence Management System based on ISO/IEC 42001:2023.

It provides participants with the necessary competencies to effectively translate AI strategies into actionable solutions. It aims to provide a comprehensive understanding of AI implementation best practices and a framework for its successful integration within organizations, equipping you with the hands-on expertise to drive AIMS implementation projects in a responsible manner.

The course consists of a mix of presentation, discussion and exercises based on real-world examples

Outline

Introduction to AIMS Concepts per ISO/IEC 42001:2023

• Normative, Regulatory and Legal Framework
• Fundamental Principles of Artificial Intelligence
• Fundamental Principles of Artificial Intelligence
• Artificial Intelligence Management System (AIMS)

Planning the AIMS Implementation

• Context of the Organization and Gap Analysis
• Defining Scope and Objectives of the AIMS
• Development of AI Policies
• AI Risk Management: Approach, Methodology, Identification,Analysis, Evaluation and Treatment of Risk
• Drafting the AI Statement of Applicability

Implementing the AIMS

• Implementation of a Document Management Framework
• Design of Controls and Writing Procedures
• Awareness, Training und Communication
• Management of AI Operations

Performance Evaluation and Improving the AIMS

• Monitoring the AIMS with Metrics, Performance Indicators etc
• Internal Audit, Management Review and Corrective Actions
• Continual Improvement
• Preparing for the Certification Audit

Objectives

Completion of this course will enable students to

• Understand the principles of an AIMS conforming to ISO/IEC 42001:2023, including the relationship to an ISMS per ISO/IEC 27001:2013/2022 and regulatory frameworks
• Apply concepts, approaches, standards, methods and techniques for the effective operation of an AIMS
• Advise organisations on AIMS best practices
• Manage teams implementing ISO/IEC 42001:2023

Audience

This course is aimed at students with (future) roles like

• Project managers, consultants and team members implementing an AIMS
• CxO and senior managers of an AI / AIMS scope
• Auditors requiring more AIMS implementation insight

Prerequisites

General understanding of common business processes.

Some past exposure to AI, information or IT security, management systems and / or project management helpful, but not required.

Examination and Certification

The course includes access to PECB's three hour exam available in multiple languages to be taken online on the last day or any time after the course (own laptop required). Exam and first year certification fees are included in the course fees.

This course is designed by PECB in Canada, who also mark the exam and issue respective certifications as per their criteria. PECB is a personnel certification body, accredited to ISO/IEC 17024:2012 by IAS. See www.pecb.com for full details.

Overview

This three day course enables participants to develop the necessary expertise to support an organisation in implementing risk management processes related to all assets of relevance for information security based on ISO/IEC 27005:2022.

ISO/IEC 27005:2022 builds onto the generic risk management principles set out in ISO 31000:2018, and applies those to the context of an information security management system (ISMS), thus providing a framework for satisfying the risk management requirements of ISO/IEC 27001:2022.

The course consists of a mix of presentation, discussion and exercises based on real-world examples.

Outline

Introduction to Information Security Risk Management per ISO/IEC 27005:2022

• Concepts and Definitions relating to Risk Management
• Risk Management Standards, Frameworks and Methodologies
• Implementation of a Risk Management Framework
• Understanding an Organization and its Context

Elements of the Risk Management Framework

• Risk Identification
• Risk Analysis and Risk Evaluation
• Risk Treatment
• Risk Acceptance and Residual Risk Management
• Risk Communication and Consultation
• Risk Recording and Reporting
• Risk Monitoring and Review

Examples of Risk Assessment Methodologies

• Operational Critical Threat, Asset and Vulnerability Evaluation (OCTAVE)
• Harmonised Risk Analysis Method (MEHARI)
• Expression of Needs and Identification of Security Objectives (EBIOS)
• NIST Framework
• CCTA Risk Analysis and Management Method (CRAMM)
• Harmonized Threat and Risk Assessment (TRA)

Objectives

Completion of this course will enable students to

• Understand concepts, approaches, methods, tools and techniques for effective information security risk management according to ISO/IEC 27005:2022
• Understand the relationship between risk management, controls and ISO/IEC 27001:2022
• Implement, maintain and manage an ongoing
information security risk management program
• Advise organisations on best practices in information security risk management

Audience

This course is aimed at students with (future) roles like

• Risk managers and Information security officers
• Project managers, consultants and team members implementing and operating information security management systems
• Auditors requiring more risk management insight

Prerequisites

General understanding of common business processes.

Some past exposure to risk management and / or management systems helpful, but not required.

Examination and Certification

The course includes access to PECB's two hour exam available in multiple languages to be taken online any time after the course (own laptop required). Exam and first year certification fees are included in the course fees.

This course is designed by PECB in Canada, who also mark the exam and issue respective certifications as per their criteria. PECB is a personnel certification body, accredited to ISO/IEC 17024:2012 by IAS. See www.pecb.com for full details.

Overview

This training provides a comprehensive review of information security concepts and industry best practices, covering the 4 key areas of the 8th edition of the CRISC CBK (Common Body of Knowledge).

This training course will help candidates review and refresh their IT risk management knowledge and help identify areas they need to study for the CRISC exam.

The CRISC certification is recognized worldwide.

Outline

Governance

• Organizational Structure, Strategy, Goals and Objectives
• Business Process Review, Organization Asset Management
• Enterprise Risk Management and Risk Management Frameworks
• Lines of Defence
• Risk Profile, Appetite, Tolerance and Capacity
• Risk Frameworks, Legal, Regulatory and Contractual Requirements

Risk Assessment

• Threat Modelling and Threat Landscape
• Risk Scenario Development
• Risk Assessment Concepts, Standards and Frameworks
• Business Impact Analysis, Risk Analysis Methodologies
• Inherent, Residual and Current Risk

Risk Response and Reporting

• Risk Response Options, Risk and Control Ownership
• Vendor/Supply Chain Risk Management
• Control Design, Selection, Implementation and Analysis
• Risk and Control Testing, Monitoring and Reporting Techniques
• Risk Actions Plans, Risk and Control Metrics

Technology and Security

• Enterprise Architecture, Operations, Portfolio and Project Management
• System Development and Data Life Cycle Management
• Emerging Technologies
• Security Concepts, Frameworks and Standards
• Security/Risk Awareness and Training
• Data Privacy and Data Protection Principles

Objectives

Completion of this course will enable students to

• Master the risk management approach according the CRISC
• Apply the best response strategies to the risks weighing on the information systems
• Use best risk monitoring practices
• Define information system controls
• Use best risk and control monitoring practices
• Preparing for the CRISC Certification Exam, e.g. by using multiple choices questions from previous CRISC sessions (or comparable exams).

Audience

This course is aimed at students with (future) roles like

• Governance, information and cyber security consultants, CISOs
• Risk and control professionals
• IT and compliance professionals
• Project managers, business analysts
• Auditors requiring more IT risk management insight
• People working with an ERM (Enterprise Risk Management) framework

Prerequisites

Basic knowledge of Information Systems is recommended.

Minimum of two students are required to run this course.

Examination and Certification

This course has been designed and is delivered by Nitroxis and their trainers.

Note: this course does not include the CRISC exam. This has to be taken at the dedicated test facilities as defined by ISACA. ISACA‘s certification requirements apply.