NOA Labs
📋 Governance & Compliance · Corporate training

ISO 27001 & Security Compliance

Implement and maintain an ISO/IEC 27001:2022 ISMS — risk assessment, Annex A controls, Statement of Applicability, internal audit — mapped to SBP and PCI DSS.

Register your company → See the full outline ↓
$59 per employee · complete course
🗓️
2 weekends
Sat & Sun
⏱️
16 hours
4 live sessions
🎯
Intermediate → Advanced
Level
🧪
4 labs
Hands-on

Default hours 10:00 AM–2:00 PM (Asia/Karachi). Company pays — employees never pay individually.

About this training

A practical implementation programme for teams building or maintaining an information security management system. Participants work through scoping, risk assessment and treatment, selecting Annex A controls, writing the Statement of Applicability and policies, running internal audits and management reviews, and mapping ISO controls to the regulatory requirements banks and fintechs already face.

Who it's for: Information security officers, compliance and risk teams, IT managers and internal auditors.

What your team will be able to do

  • ✔Scope an ISMS and define its context
  • ✔Run a risk assessment and treatment plan
  • ✔Select and justify Annex A controls in a Statement of Applicability
  • ✔Plan and conduct an internal ISMS audit
  • ✔Map ISO 27001 controls to SBP and PCI DSS requirements

Advanced course outline

🔒 Session notes & lab guides unlock for enrolled employees
Weekend 1
Weekend 1 · Saturday

ISMS foundations & scoping

Clauses 4–7: context, leadership, planning and support.

  • ▸ISO/IEC 27001:2022 structure
  • ▸Context of the organisation and interested parties
  • ▸Defining a defensible scope
  • ▸Leadership commitment and policy
  • ▸Documented information requirements
🧪 Lab: Define the ISMS scope for a fintech 🔒 Session notes 🔒 Lab guide
Weekend 1 · Sunday

Risk assessment & treatment

Clause 6.1 and 8 in practice.

  • ▸Asset- and scenario-based risk assessment
  • ▸Likelihood, impact and risk criteria
  • ▸Treatment options: modify, retain, avoid, share
  • ▸Risk owners and acceptance
  • ▸Risk treatment plan
🧪 Lab: Build a risk register 🔒 Session notes 🔒 Lab guide
Weekend 2
Weekend 2 · Saturday

Annex A controls & Statement of Applicability

The 93 controls and how to choose them.

  • ▸Annex A themes: organisational, people, physical, technological
  • ▸New 2022 controls: threat intelligence, cloud services, secure coding…
  • ▸Writing the Statement of Applicability
  • ▸Policies and procedures that auditors expect
  • ▸Mapping to SBP ETGRMF and PCI DSS
🧪 Lab: Write a Statement of Applicability 🔒 Session notes 🔒 Lab guide
Weekend 2 · Sunday

Internal audit, review & certification

Clauses 9–10 and the road to certification.

  • ▸Planning an internal audit programme
  • ▸Audit evidence and sampling
  • ▸Nonconformities and corrective action
  • ▸Management review
  • ▸Stage 1 and stage 2 certification audits
🧪 Lab: Conduct a mock internal audit 🔒 Session notes 🔒 Lab guide
📝
Final assessment & certificate
Multiple-choice assessment plus attendance requirement → verifiable QR certificate.

Related governance & compliance courses

🔐 Data Protection & Privacy
2 weekends · $49

Enrol your team in ISO 27001 & Security Compliance

One invoice for the whole team, volume discounts applied automatically.

Register your company → All corporate courses