Covering the 2013 edition, this presentation walks staff through ISO 27001 clause by clause and then through the Annex A control groups from information security policies to compliance.

Effective Training Presentations

This presentation is supplied in fully editable MS PowerPoint format, so slides can be added, removed or edited to suit your organisation and your audience.

alphaZ documents - tried and tested training material. No junk, jargon or unnecessary content. Simple and usable training material developed over 25 years through practical use in the real world.

Further Reading

Further guidance on ISO 27001 and information security awareness:

• ISO 27001 Clause 7.3 - Awareness
• ISO 27001 Annex A Controls
• Awareness of the Management System
• ISO 27001 knowledge base

Logo Update Service

Download this presentation with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like hands-on help with your ISO 27001 information security management system, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

ISO 27001:2013 Awareness Training Course

The ISO 27001:2013 Awareness Training Course is a PowerPoint presentation for introducing staff to the 2013 edition of the ISO 27001 information security management system standard. It opens with what ISO 27001 is and how it developed from BS 7799, sets out the High Level Structure, then works through clauses 4 to 10 in plain terms, referenced to the clause number, and closes with the Annex A control groups A.5 to A.18.

The course supports ISO 27001 clause 7.3 Awareness, which requires personnel to be aware of the information security policy, their contribution to the ISMS and the implications of not conforming. It also gives managers a clause by clause overview of the 2013 edition, from risk assessment and treatment to the Statement of Applicability.

What the Presentation Covers

• What is ISO 27001 - the standard for the requirements of an information security management system (ISMS), and its history from BS 7799 in 1999 to the first edition of ISO/IEC 27001 in 2005 and the 2013 edition
• High Level Structure - the clause headings of the High Level Structure (Annex SL) and the sub-clauses under each, from context of the organisation through to nonconformity and continual improvement
• Clauses 1, 2 and 3 - scope, normative references and terms and definitions, which are not requirements, so organisations certified to ISO 27001 demonstrate compliance with clauses 4 to 10
• Clause 4 Context of the Organisation - internal and external issues, interested parties and their requirements, the scope of the ISMS, and establishing, implementing, maintaining and continually improving the ISMS
• Clause 5 Leadership - top management commitment, keeping the information security policy and objectives compatible with the strategic direction, the policy and its commitments, and roles, responsibilities and authorities
• Clause 6 Planning - actions to address risks and opportunities, the information security risk assessment and risk treatment processes, the Statement of Applicability, and SMART information security objectives
• Clause 7 Support - resources, competence, awareness of the information security policy, internal and external communication, and control of documented information
• Clause 8 Operation - operational planning and control, control of planned changes, information security risk assessments at planned intervals or when significant changes occur, and implementing the risk treatment plan
• Clause 9 Performance Evaluation - evaluating information security performance and the effectiveness of the ISMS, monitoring and measurement, the internal audit programme and management review
• Clause 10 Improvement - reacting to a nonconformity with action to control and correct it and a review of its effectiveness, and continual improvement of the suitability, adequacy and effectiveness of the ISMS
• Annex A - the control groups from A.5 Information security policies and A.9 Access control through to A.16 incident management, A.17 business continuity and A.18 Compliance, each with a short explanation

Who Needs an ISO 27001:2013 Awareness Course?

This course suits organisations whose information security management system documents and records still follow the 2013 edition, its clause numbers and its Annex A control groups, and who want awareness sessions that match. It works for small and medium sized businesses running their own sessions for staff and managers without bringing in an outside trainer.

Delivering the Course

Run the presentation as a group session or a one to one briefing, adding examples from your own business against each clause. Record who attended on the F-Q7 Training Talk Attendance Record and issue the ISO 27001:2013 Training Certificate Template to each person who completes the session.

Annex A Control Groups Explained

After clause 10 the slides turn to Annex A of the 2013 edition, listing the control groups A.5 to A.18 and giving each a short plain explanation, such as access control and management of user access, cryptographic controls and key management, protection from malware and backup, network security, secure development, supplier relationships and information security incident management.

Pairs with Other Training

For the current edition of the standard, the ISO 27001:2022 Awareness Training Course covers ISO 27001:2022 and its Annex A controls. For a wider introduction, the Introduction to the Integrated Management System explains how the integrated management system works and Introduction to ISO Audits and Certification covers the audit and certification process. Staff who go on to carry out internal audits can follow up with the Internal Audit Training Presentation.