KR eCampusCourses coming soon

KR ECAMPUS

Choose your country

Select your country to switch to the right eCampus site.

My eCampus

Back to courses

Advanced · Self-paced learning

ISMS Foundations for Managers

Inquiry This course is not yet bookable.

Plan the start of an information security management system (ISMS) for a defined area. Establish its scope, protection objectives and roles, and record initial risks and actions. You can take the resulting concept forward with the people responsible in your organisation.

Build the foundations of an ISMS for one area. Define its processes and sites, set protection objectives and record initial risks and related actions in a register. Identify who decides on risks and approvals and which details still need clarification.

In the course case, the hosting provider for customer service was initially excluded from the scope. You examine the dependency and address the provider and its interface in the project mandate. Work with authorised information from your organisation or the substitute case, and keep your starter pack for further work.

What you will work on

  • Define the ISMS scope for an area, including interfaces, exclusions and explicit assumptions.
  • Link protection objectives, material threat assumptions and initial risks in a traceable qualitative register.
  • Account for an initially excluded critical service provider.

Who it is for

  • Newly appointed information security officers
  • Members of ISMS or management-system teams
  • Managers and specialists with ISMS responsibility

Topics

  • ISMS as a management system: purpose, boundaries and link to business objectives
  • Scope and interfaces: sites, processes, service providers and exclusions
  • Protection objectives, threat assumptions and risk assessment without false precision
  • Roles, decision rights and approval responsibility
  • Initial risk register: entries, prioritisation, treatment link and residual risk
  • Start plan and next workplace steps

Your result

Your ISMS starter pack describes the area and its interfaces, records initial risks and actions, and identifies the next assignments for the responsible roles.

Prerequisites

A basic understanding of information security and organisational operations, plus access to an area with enough information on processes, roles and risks. If access is unavailable or data is confidential, a structured substitute case is planned.

Format and approach

The planned self-study course takes 14–16 hours and includes a continuous case, graduated guidance and self-checks to help you justify and revise your initial concept. You work individually; personal feedback or group work is not required to complete the course.

Planned learning time: 14–16 hours

Enquire about this course

Advanced · Self-paced learning

Managing an Information Security Programme

Plan the annual information security programme for your area: which objectives and risks come first, and what actions and resources are needed? A management review template helps you present the decisions and supporting evidence to leadership.

Read the description

Advanced · Self-paced learning

Enterprise Security Risk Management

A business unit wants to launch a new service despite a known failure dependency and assigns the risk to security. The security function controls neither service scope nor budget. Establish who owns the business risk and what protection security can provide, then develop a service catalogue for work with business leaders.

Read the description