Chapter 3.3 · ISO 27001¶
Two Lessons. The first explains what ISO 27001 actually certifies: a management system, not a state of being secure. The second covers the Annex A controls (each tied to the risk it reduces) and the journey to certification, which is the customer's actual requirement.
Objectives¶
- Explain ISO 27001 as an ISMS, and why it is risk-driven by design.
- Relate the Annex A controls to the risks they reduce, and describe the certification journey.
Lessons¶
| Lesson | Title | Time |
|---|---|---|
| 3.3.A | ISO 27001: the ISMS and structure | ~50 min |
| 3.3.B | Annex A controls and the certification journey | ~45 min |
The Chapter quiz is at the end of Lesson 3.3.B.