From the ISMS clauses to the Annex A control themes, this presentation gives your staff a clear grounding in ISO 27001 for an information security awareness session.

Effective Training Presentations

This presentation is supplied in fully editable MS PowerPoint format, so slides can be added, removed or edited to suit your organisation and your audience.

alphaZ documents - tried and tested training material. No junk, jargon or unnecessary content. Simple and usable training material developed over 25 years through practical use in the real world.

Further Reading

Further guidance on ISO 27001 and information security awareness:

• ISO 27001 Clause 7.3 - Awareness
• ISO 27001 Annex A Controls
• ISO 27001 Clause 6.1.3 - Information Security Risk Treatment
• ISO 27001 knowledge base

Logo Update Service *

Download this presentation with your company name and logo already added!
Document Preparation available with all document toolkits.

How to Download

To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This presentation is also included in the ISO 27001 Toolkit and the integrated toolkits that include it, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like hands-on help with your ISO 27001 information security management system, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

ISO 27001:2022 Awareness Training Course

The ISO 27001:2022 Awareness Training Course is a PowerPoint presentation for introducing staff to the ISO 27001 information security management system (ISMS) standard. It opens with what ISO 27001 is and how it grew out of BS 7799, sets out the harmonised structure, then works through clauses 4 to 10 with the main requirements of each clause explained in plain terms and referenced to the clause number. It closes with the Annex A controls and their themes.

The course supports ISO 27001 clause 7.3 Awareness, which requires personnel to be aware of the information security policy, their contribution to the ISMS, the benefits of improved performance and the implications of not conforming. It also gives managers a clause by clause overview of the standard before implementation or an internal audit.

What the Presentation Covers

• What is ISO 27001 - the standard for the requirements of an information security management system, its history from BS 7799 Part 2 to the 2022 edition and its Annex A changes, and the 2024 climate change amendment
• Harmonized Structure - the clause headings of the standard and the sub-clauses under each, from understanding the organisation and its context through to nonconformity and corrective action
• Clauses 1, 2 and 3 - scope, normative references and terms and definitions, which contain no auditable requirements, so conformity is demonstrated against clauses 4 to 10
• Clause 4 Context of the Organisation - external and internal issues including whether climate change is relevant, interested parties and their requirements, the scope of the ISMS, and establishing, implementing, maintaining and improving the ISMS (4.4)
• Clause 5 Leadership - top management leadership and commitment, what the information security policy must include and how it is communicated, and assigning roles, responsibilities and authorities for information security
• Clause 6 Planning - actions to address risks and opportunities, the information security risk assessment and risk treatment processes (6.1.2 and 6.1.3), the Statement of Applicability, information security objectives and planning of changes (6.3)
• Clause 7 Support - resources, competence and the evidence to keep, awareness of the information security policy, internal and external communication, and control of documented information, including identification, protection and changes
• Clause 8 Operation - operational planning and control, including planned changes and externally provided processes, information security risk assessments at planned intervals or when significant changes occur, and implementing the risk treatment plan
• Clause 9 Performance Evaluation - monitoring and measuring information security performance and the effectiveness of the ISMS, the internal audit programme and auditor impartiality, and management review inputs and outputs
• Clause 10 Improvement - continual improvement of the ISMS, reacting to a nonconformity and dealing with the consequences, and evaluating the need for action to eliminate the causes
• Annex A - how the controls are considered in risk treatment and recorded in the Statement of Applicability, with examples of organisational, people, physical and technological controls (A.5 to A.8)

Who Needs an ISO 27001 Awareness Course?

Any organisation implementing or maintaining an ISO 27001 information security management system needs its people to understand what the standard asks of them. The course suits small and medium sized businesses that want to run their own awareness sessions for new starters, existing staff and managers without bringing in an outside trainer. It also works as a refresher before an internal or external audit, or as a starting point for the person leading the ISMS.

Included in the ISO 27001 Toolkit

This presentation is part of the ISO 27001 Toolkit and the integrated toolkits that include it.

Delivering the Course

Run the presentation as a group session or a one to one briefing, adding examples from your own business against each clause. Record who attended on the F-Q7 Training Talk Attendance Record and issue the ISO 27001:2022 Training Certificate Template to each person who completes the session.

Annex A Controls by Theme

The closing slides move from the clauses to Annex A. They explain that its 93 controls are considered as part of risk treatment, with the Statement of Applicability recording which are included and why, then give everyday examples under each theme, such as screening and remote working for people controls, clear desk and clear screen for physical controls, and malware protection and secure coding for technological controls.

Pairs with Other Training

For a wider introduction, the Introduction to the Integrated Management System explains how the integrated management system works and Introduction to ISO Audits and Certification covers the audit and certification process. Staff who go on to carry out internal audits can follow up with the Internal Audit Training Presentation.