ISO 27001 Training and Certification Guide
Your complete guide to ISO 27001: what the standard is, how personnel and business certification differ, the training levels, and the Exemplar Global Certified courses that take you from Foundation to Lead Auditor.
Information Security Management Systems (ISMS)
Information Security Management Systems (ISMS)
Information Security Management Systems (ISMS)
What is ISO 27001?
ISO 27001 is the international standard for Information Security Management Systems (ISMS). It sets out the requirements an organisation follows to protect the confidentiality, integrity and availability of its information by managing information security risks.
Built on the harmonised high level structure, ISO 27001 applies to information in any form, digital, paper or spoken, and to any organisation of any size or sector. Certification is awarded by an accredited certification body after a successful audit of the organisation's information security management system.
Who ISO 27001 training is for
- Information security and IT managers
- ISMS coordinators and anyone implementing or maintaining the system
- Internal auditors and anyone preparing for a certification audit
- Consultants advising clients on ISO 27001
- Professionals moving into a Lead Auditor role
The standard in brief
What ISO 27001 covers
ISO 27001 follows the Plan, Do, Check, Act cycle across clauses 4 to 10. Here is what each part covers.
Context of the organisation
Understand your organisation, interested parties and their requirements, and define and document the scope of the information security management system.
Leadership
Top management commitment, the information security policy, and clear information security roles and responsibilities.
Planning
Carry out the information security risk assessment and risk treatment, and produce the Statement of Applicability that selects the Annex A controls.
Support
Resources, competence, awareness, communication, and documented information for the ISMS.
Operation
Run the risk assessment and risk treatment in practice and operate the controls that protect your information.
Performance evaluation
Monitor, measure, audit internally, and review the information security management system at management level.
Improvement
Continually improve the ISMS, and handle nonconformities with corrective action.
Why it matters
Benefits of ISO 27001
What organisations and professionals gain from working to ISO 27001.
- Protect the confidentiality, integrity and availability of your information
- Reduce the risk and impact of data breaches and security incidents
- Meet client, legal, regulatory and contractual information security requirements
- Win tenders and contracts that require ISO 27001 certification
- Build customer and stakeholder trust in how you handle their data
- A culture of continual improvement in information security
Clearing up a common mix up
Personnel certification vs business certification
People often confuse the two. They are different things, earned by different parties, and only one is a person.
Personnel certification
Certifies the individual.
- Earned by a person, not a company
- Recognised by Exemplar Global
- Proves you can audit to the standard
- The path our courses prepare you for
Business certification
Certifies the organisation.
- Earned by a company, not a person
- Issued by a certification body such as Intertek or SAI Global
- Proves the management system conforms to ISO 27001
- Maintained through surveillance audits
Audit Workshop trains and certifies people. We do not certify organisations, we prepare the people who build and audit them.
Organisations are certified to ISO 27001 by accredited certification bodies such as Intertek, SAI Global, BSI, SGS, and DNV, working under accreditation bodies like JAS-ANZ. Audit Workshop trains the people; the certification body certifies the organisation.
Training levels
From Foundation to Lead Auditor
Three levels that build on each other. Start where your experience sits and climb from there.
Foundation
New to the standard
Understand ISO 27001 and how a compliant management system works. The starting point, no prior experience needed.
Internal Auditor
Audit your own organisation
Plan and conduct internal audits following the ISO 19011 auditing guidelines.
Lead Auditor
Lead certification style audits
Audit programme management, Stage 1 and Stage 2, findings, and the certification recommendation.
The auditor's role
What an auditor is responsible for
Auditing is a profession with its own principles. Our courses teach you to work to all of them, guided by ISO 19011.
Integrity
Audit with professionalism, honesty, and responsibility.
Fair presentation
Report findings truthfully, accurately, and clearly.
Due professional care
Apply diligence and sound judgement in every audit.
Confidentiality
Protect the information you access during an audit.
Independence
Stay impartial and objective, free of conflicts of interest.
Evidence based
Reach conclusions from verifiable audit evidence.
Good to know
Common confusions, cleared up
The questions people most often get wrong before they enrol, answered straight.
Are all 93 Annex A controls mandatory?
No. Annex A is a reference set, not a checklist you must adopt in full. The controls you need are driven by your risk treatment and recorded in the Statement of Applicability, with a justification for any Annex A control you exclude.
Does ISO 27001 certify me or my organisation?
The ISMS certifies the organisation, not the person. You complete training and earn a Certificate of Attainment as an individual; the certification body audits and certifies the organisation's information security management system.
Is ISO 27001 only about IT and technology?
No. ISO 27001 covers information in any form, including paper records and conversations, and its controls span organisational, people, physical and technological areas, not just IT systems.
Does my Certificate of Attainment expire?
No. Your certificate does not expire. If you later hold Exemplar Global Personnel Certification, that credential is maintained separately with Exemplar Global.
From the blog
Related articles
Guides and updates on ISO 27001 from our auditors.
How to Choose the Best ISO 27001 Lead Auditor Course
How to choose the best ISO 27001 Lead Auditor course in 2026, comparing recognition, cost, delivery and value, and why self paced online beats thousands in classroom fees.
ISO 27001 Auditor Training Prices in Canada (2026 Comparison)
What ISO 27001 auditor training really costs in Canada in 2026, compared level by level so infosec professionals can weigh value not just price.
What Does ISO 27001 Auditor Training Cost in the UK? (2026 Prices)
A 2026 breakdown of ISO 27001 auditor training costs in the UK, comparing self paced Exemplar Global courses against CQI and IRCA classroom prices level by level.
FAQ
Frequently asked questions
Common questions about ISO 27001 training and certification.
Ready to Get ISO Certified?
Join practitioners training with ISO auditors who've conducted 500+ external certification audits.
Quality Management Systems (QMS)
Occupational Health and Safety Management Systems (OHSMS)
Environmental Management Systems (EMS)
