ISO 27001:2005 Certification

Courtesy: ISO 27001:2005 Certification

ISO/IEC 27001 is is the world’s best-known standard for information security management systems (ISMS) and their requirements. Additional best practice in data protection and cyber resilience are covered by more than a dozen standards in the ISO/IEC 27000 family. Together, they enable organizations of all sectors and sizes to manage the security of assets such as financial information, intellectual property, employee data and information entrusted by third parties.

The ISO/IEC 27001 Lead Auditor certification consists of a professional certification for auditors specializing in information security management systems (ISMS) based on the ISO/IEC 27001 standard and ISO/IEC 19011.

The training of lead auditors normally includes a classroom/online training and exam portion and a requirement to have performed a number of ISO/IEC 27001 audits and a number of years of information security experience. The training course is provided by any organisation wishing to deliver the training. Some ISO27001 Lead Auditor training courses are formally accredited by training accreditation bodies such as IRCA and PECB. Attending the course and passing the exam is not sufficient for an individual to use the credentials of Lead Auditor as professional and audit experience is required. The specific requirements to obtain a certificate stating the qualification of “ISO27001 Lead Auditor” vary depending on the organisation issuing the certificate.

The course usually consists of around forty hours (four days) of training and a final exam on the fifth day. This certification is different from the ISO/IEC 27001 Lead Implementer certification which is targeted for information security professionals who want to implement the ISO/IEC 27001 standard rather than audit it. Most of the five-day ISO27001 Lead Auditor courses require some prerequisite knowledge of ISO27001 but the content of the courses vary considerably.

If an individual wants to issue an ISO/IEC 27001 certificate of compliance then the audit must be done by a Lead Auditor working for an accredited certification body and done using all the rules of that certification body, which will need to adhere to ISO17021 and ISO27006.

The main benefit from achieving the ISO/IEC 27001 Lead Auditor certification is the recognition that the individual has some skills in the topic.

The main ISO/IEC 27001 auditor certifications normally follow these designations:

• Provisional ISMS Auditor
• ISMS Auditor/Internal Auditor
• Lead ISMS Auditor