Security Audit Expert Package: ISO 27001 Lead Auditor & ISACA CISA

Course 1: PECB ISO 27001 Lead Auditor

Module 1: Fundamental principles and concepts of Information Security Management System (ISMS)
Module 2: Information Security Management System (ISMS)
Module 3: Fundamental audit concepts and principles
Module 4: Preparation of an ISO/IEC 27001 audit
Module 5: Conducting an ISO/IEC 27001 audit
Module 6: Closing an ISO/IEC 27001 audit
Module 7: Managing an ISO/IEC 27001 audit program

Course 2: ISACA – Certified Information Systems Auditor (CISA)

Module 1—Information Systems Auditing Process
Providing audit services in accordance with standards to assist organizations in protecting and controlling information systems. Domain 1 affirms your credibility to offer conclusions on the state of an organization’s IS/IT security, risk and control solutions.
A. Planning
• IS Audit Standards, Guidelines, and Codes of Ethics
• Business Processes
• Types of Controls
• Risk-Based Audit Planning
• Types of Audits and Assessments
B. Execution
• Audit Project Management
• Sampling Methodology
• Audit Evidence Collection Techniques
• Data Analytics
• Reporting and Communication Techniques
• Quality Assurance and Improvement of the Audit Process

Module 2—Governance and Management of IT
Module 2 confirms to stakeholders your abilities to identify critical issues and recommend enterprise-specific practices to support and safeguard the governance of information and related technologies.
A. IT Governance
• IT Governance and IT Strategy
• IT-Related Frameworks
• IT Standards, Policies, and Procedures
• Organizational Structure
• Enterprise Architecture
• Enterprise Risk Management
• Maturity Models
• Laws, Regulations, and Industry Standards affecting the Organization
B. IT Management
• IT Resource Management
• IT Service Provider Acquisition and Management
• IT Performance Monitoring and Reporting
• Quality Assurance and Quality Management of IT

Module 3—Information Systems Acquisition, Development and Implementation
A. Information Systems Acquisition and Development
• Project Governance and Management
• Business Case and Feasibility Analysis
• System Development Methodologies
• Control Identification and Design
B. Information Systems Implementation
Testing Methodologies
• Configuration and Release Management
• System Migration, Infrastructure Deployment, and Data Conversion
• Post-implementation Review

Module 4—Information Systems Operations And Business Resilience
Domains 3 and 4 offer proof not only of your competency in IT controls, but also your understanding of how IT relates to business.

A. Information Systems Operations
Common Technology Components
• IT Asset Management
• Job Scheduling and Production Process Automation
• System Interfaces
• End-User Computing
• Data Governance
• Systems Performance Management
• Problem and Incident Management
• Change, Configuration, Release, and Patch Management
• IT Service Level Management
• Database Management
B. Business Resilience
• Business Impact Analysis (BIA)
• System Resiliency
• Data Backup, Storage, and Restoration
• Business Continuity Plan (BCP)
• Disaster Recovery Plans (DRP)

Module 5—Protection Of Information Assets
Cybersecurity now touches virtually every information systems role, and understanding its principles, best practices and pitfalls is a major focus within Domain 5.
A. Information Asset Security and Control
Information Asset Security Frameworks, Standards, and Guidelines
• Privacy Principles
• Physical Access and Environmental Controls
• Identity and Access Management
• Network and End-Point Security Data Classification
• Data Encryption and Encryption-Related Techniques
• Public Key Infrastructure (PKI)
• Web-Based Communication Techniques
• Virtualized Environments
• Mobile, Wireless, and Internet-of-Things (IoT) Devices
B. Security Event Management
• Security Awareness Training and Programs
• Information System Attack Methods and Techniques
• Security Testing Tools and Techniques
• Security Monitoring Tools and Techniques
• Incident Response Management
• Evidence Collection and Forensics