ISO 27001 Lead Auditor information security management 

The "Plan-Do-Check-Act" methodology advocated within the ISO 27001 standard requires auditing. The CIS ISO 27001 Lead Auditor certification validates your ability to properly audit the ISO 27001 ISMS recommended by the ISO auditing standards 27007, 27008, and 19011.

Building upon the core understanding of the ISO 31000 and 27005 risk management frameworks, as well as the ISO 27001 framework validated by the Certified Internal Controls Architect credential, ISO 27001 Lead Auditor certification further certifies your ability to audit the formal structure, governance, and policy of an ISO 27001 conforming Information Security Mgmt. System (ISMS).

Become recognized as an expert in these international information security standards with ISO 27001 CICA and Lead Auditor certifications.

Becoming ISO 27001 Lead Auditor certified requires you to first master the subject matter of risk-based ISO 27001 information security management system governance, and then establishing certified competence in performing and leading audits of the ISO 27001 ISMS.

This professional credential is applicable to those needing to conduct internal or external audits of a risk management system supporting an ISMS, or how to manage an ISO ISMS audit program. This is the only ISO 27001 Lead Auditor training and professional examination program to incorporate ISO's 27007 standard as core content within its program.

Upon completion of this training and certificate program, participants will:

• be equipped with knowledge and skills required to perform audits of Information Security Mgmt. Systems (ISMS) against the ISMS standards;
• be able to expand participants' auditing competency;
• be able to increase participants' credibility through gaining international recognition; and
• be able to improve participants' résumé/CV and help to increase participants' earning potential.

Getting certified is easy, and can be accomplished completely online. The Certified ISO 27001 Lead Auditor™ certification is available to qualified candidates who:

1. Are a member of CIS in good standing. 
   If you are not already an Associate member of the CIS certification student body, you must first become a member to pursue the ISO 27001 Lead Auditor credential.
   
   
2. Attend the required courses, live or online. Prerequisite training for ISO 27001 Lead Auditor certification eligibility includes:
   
   • Policy Workshop: ISO 31000 Enterprise Risk Management
   • Policy workshop: ISO 27001 Information Security Management
   • ISO 27001 Lead Auditor training
     
     
3. Pass the ISO 27001 Lead Auditor Exams. For ISO 27001 LA certification, candidates must pass exams #RM101, #ISMS101, #ISMS102, and #ISMS103. Exams are administered on-line and can be taken at your convenience at your home or work through the CIS eLearning Center, where your progress and score are monitored and recorded centrally. Your exam results are provided automatically upon completion of your exam.
   
   
4. Complete and submit your ISO 27001 LA certification application to the Certification Department at certification@certifiedinfosec.com. Certification applications are available for download at www.certifiedinfosec.com/services/certification-programs/cis-professional-certification-program/certification-kit-brochures-and-applications.

Your digital credentials

You will officially become certified (certificated) once your exam results and required documentation are validated and approved by the certification committee.

Your digital credential certificates and badges will be processed and emailed to you within 10 business days following the receipt of the required documentation. Learn more about CIS' digital certificates and badges.

Certification maintenance and renewal requirements can be viewed at www.certifiedinfosec.com/services/certification-programs.

Certified Information Security is authorized to provide all required training and exams for Certified ISO 27001 Lead Auditor certification. Certification candidates must successfully complete:

• Policy Workshop: ISO 31000 Enterprise Risk Management
   
• Policy Workshop: ISO 27001 Information Security Management
  
  
• ISO 27001 Lead Auditor 
  
  

ISO 27001 Lead Auditor certification requires successful completion of four exams:

• RM101
  
  
• ISMS101
  
  
• ISMS102
  
  
• ISMS103

Required Exam: RM101

Exam #RM101 maps to ISO/IEC 31000, 31010, and 27005 risk management content areas taught in "Policy Workshop: ISO 31000 Enterprise Risk Management."

• Required  for CICRA, 27001 Lead Implementer, CICA, ISO 27001 Lead Auditor, CBCS, CBCA, and CBCM certifications.
• Number of questions: 65
• Passing score: 75%
• Time limit: 70 minutes

RM101 Content Areas

1. Context establishment
2. Risk assessment
3. Risk treatment
4. Risk acceptance
5. Risk communication
6. Risk monitoring and review

Required Exam: ISMS101

Exam #ISMS101 maps to ISO/IEC 27000 content areas associated with ISMS planning and strategy, as taught in "Policy Workshop: ISO 27001 Information Security Mgmt."

• Required for ISO 27001 Lead Implementer, CICA and ISO 27001 Lead Auditor certification
• Number of questions: 65
• Passing score: 75%
• Time limit: 70 minutes 

Content Areas

1. Developing an ISMS program
2. Project managing a successful internal controls implementation
3. Establishing the ISMS organization
4. Core ISO best practices relating to:
   • Information security policy and scope
   • Risk assessment and Statement of Applicability
   • Understanding the organization

Required Exam: ISMS102

 Exam #ISMS102 maps to content areas associated with ISMS deployment, monitoring, exercising, and maintenance, as covered in CIS' course, "Policy Workshop: ISO 27001 Information Security Mgmt."

• Required  for CICA and ISO 27001 Lead Auditor certification
• Number of questions: 65
• Passing score: 75%
• Time limit: 70 minutes

Content Areas

Core ISO 27000 best practices relating to:

• External party controls
• Asset management
• Human Resources security
• Physical and environmental security
• Equipment security
• Communications and operations management
• Malicious software controls
• Network security management and media handling
• Business continuity management
• Compliance
• Exchange of information
• Electronic commerce, e-mail and internet security
• General, network, operating system, and application access control
• Systems acquisition, development and maintenance
• Cryptographic controls
• Development and support process security
• Monitoring of information security and incident management
• Preparing for an ISO 27001 audit

Required Exam: ISMS103

Exam #ISMS103 maps to ISO/IEC content areas associated with ISMS deployment, monitoring, exercising, and maintenance, as covered in "ISO 27001 Lead Auditor."

• Required  for ISO 27001 Lead Auditor certification
• Number of questions: 65
• Passing score: 75%
• Time limit: 70 minutes

Content Areas

• Auditing the Audit Function & Program
• Principles of auditing
• Managing an audit program
  • Establishing the audit program objectives
  • Establishing the audit program
  • Role and responsibilities of the person managing the audit program
  • Competence of the person managing the audit program
  • Determining the extent of the audit program
  • Identifying and evaluating audit program risks
  • Establishing procedures for the audit program
  • Identifying audit program resources
  • Implementing the audit program
  • Monitoring the audit program
  • Reviewing and improving the audit program
• Performing an audit
  • Initiating the audit
  • Preparing audit activities
  • Conducting the audit activities
  • Preparing and distributing the audit report
  • Completing the audit
  • Conducting audit follow-up
• Auditing the ISMS Scope, Policy, Risk Assessment Approach, and ISMS Implementation
  • ISO ISMS Audit Criteria
  • ISO Risk Management Best Practices
  • ISO Evidence Collection Recommendations
• Auditing the ISMS Monitoring and Review
  • ISO Audit Criteria
  • ISO 27007 Evidence Collection Recommendations
• Audit the ISMS Documentation Fulfillment
  • ISO Audit Criteria
• Audit the ISMS Organization and Management Commitment
  • ISO Audit Criteria
  • ISO Best Practices
  • ISO 27007 Evidence Collection Recommendations
• Auditing ISMS Internal Audit against ISO 27001 Requirements
  • ISO Audit Criteria
  • ISO 27007 Evidence Collection Recommendations
  • Auditing Management Review
• An overview of using ISO TR 27008 to audit internal controls

Qualified experience for Certified ISO 27001 Lead Auditor™ certification

Certified ISO 27001 Lead Auditor is an expert-level certification for information security professionals with at least two years of qualified experience. This certification maps to and fulfills all ISO/IEC 27001 competence requirements. General characterization for eligible experience:

• Developing an ISMS program
• Project managing a successful internal controls implementation
• Core ISO best practices relating to:
  • Information security policy and scope
  • Risk assessment and Statement of Applicability
  • External party controls
  • Asset management
  • Human Resources security
  • Physical and environmental security
  • Equipment security
  • Communications and operations management
  • Malicious software controls
  • Network security management and media handling
  • Monitoring of information security and incident management
  • Business continuity management
  • Compliance Exchange of information
  • Electronic commerce, e-mail and internet security
  • General, network, operating system, and application access control
  • Systems acquisition, development and maintenance
  • Cryptographic controls
  • Development and support process security
  • Monitoring of information security and incident management
  • Business continuity management
  • Compliance
  • Operations audit

Our simple guarantee to you.

Preparing for Certified Information Security's professional certification exams #RM101, #ISMS101, #ISMS102, and #ISMS103 is serious business.

This is where we can help you. If you first successfully complete:

• All prerequisite ISO 27001 certification training; and
• All RM101, ISMS101, ISMS102, and ISMS103 online practice exams

Certified Information Security guarantees your success in passing certification exams #RM101, #ISMS101, #ISMS102, and #ISMS103.

If you do not pass exams #RM101, #ISMS101, #ISMS102, and #ISMS103 on your first attempt after completion of your required course and practice exams, Certified Information Security will allow you to re-test at no additional charge until you successfully pass your certification exams.

It’s convenient!

Certified Information Security provides the training and credentialing you need to become recognized as an authority in information security governance and risk management.  You choose the method of delivery: online through our secure website, or in-person at a publicly available course or privately at your facility.  We take care of the rest – from administration, to record keeping, to providing certificates of completion and certification.

Online students have the additional convenience of taking courses whenever they want without the need to travel or disrupt their busy schedules. Our program allows users to start and stop without losing their place or data.  Learning and certifying expertise has never been so easy!

How to get started - two alternatives 

1. If your employer is paying for your training and certification, we recommend purchasing a complete ISO 27001 Lead Auditor certification package voucher that includes all required resources, including membership in the CIS Body of Certified Professionals, all required training programs, all recommended practice exams, and the required certification exam. This allows your employer to purchase and pay all of your necessary resources at once, while still giving you flexibility of when to use your training, practice exams, and certification exams later.
   
   

2. "Pay-as-you-go" by purchasing your membership in the CIS Body of Certified Professionals, training, recommended practice exams, and the certification exams as you need them. Start by purchasing training, and then purchase practice exams when you are ready. After you complete your practice exams, you then purchase your certification exam.

A breakdown of the costs are as follows: 

1. Required CIS Membership Application Fee & Membership Dues: $100.00 Learn more

2. Required Training 

3. Optional Online Practice Exams for all exams (RM101, ISMS101, ISMS102, and ISMS103): $375.00 Learn more

4. Required Online Certification Exams (RM101, ISMS101, ISMS102, and ISMS103): $400.00 Learn more