Skip to content
EDWartens UK

Free course · Cybersecurity

ISO 27001:2022 Implementation: Build an ISMS

Build an information security management system to ISO/IEC 27001:2022, step by step: context, interested parties and scope, leadership and policy, risk assessment and risk treatment, the Statement of Applicability, the 93 Annex A controls in four themes, documented information and evidence, supplier, cloud, incident and continuity controls, internal audit and management review, corrective action, the stage 1 and stage 2 certification audits, and how the ISMS maps to GDPR, NIS2, SOC 2 and NIST CSF 2.0.

See the modules

Free to learn. Verifiable certificate £19 when you pass the final exam (optional, VAT included).

Level
Intermediate
Modules
14
Video
19 hours
Price
Free

Outcome

What you will be able to do

Plan an ISO 27001 implementation as a project with a gap analysis; set the ISMS scope from the context, interested parties and interfaces, including the 2024 climate amendment; write an information security policy and assign roles; define risk criteria, run a risk assessment and calculate risk levels; choose treatment options and write the risk treatment plan; build a Statement of Applicability with a justification for every Annex A control; apply organisational, people, physical and technological controls; control documented information and keep the evidence an auditor samples; run an internal audit and a management review; write corrective actions from root causes; prepare for the stage 1 and stage 2 certification audits; and map the ISMS to GDPR, NIS2, SOC 2 and NIST CSF 2.0.

  • Plan an ISO 27001:2022 implementation with a gap analysis and a phased roadmap
  • Write the context, interested parties and a credible ISMS scope, including the 2024 climate amendment
  • Set risk criteria, run a risk assessment and calculate risk levels against an acceptance threshold
  • Choose risk treatments and build a Statement of Applicability that justifies every Annex A control
  • Apply the 93 Annex A controls across organisational, people, physical and technological themes
  • Control documented information and keep the records an auditor samples
  • Run an internal audit and a management review, and write corrective actions from root causes
  • Prepare for stage 1 and stage 2 certification audits and map the ISMS to GDPR, NIS2, SOC 2 and NIST CSF 2.0

Software

A spreadsheet (LibreOffice Calc or Google Sheets is free) for the risk register and the Statement of Applicability, and a document editor for policies and procedures. You do not need to buy the standard to follow the course, but anyone implementing it for real should hold a licensed copy of ISO/IEC 27001:2022 and its 2024 amendment.

Hardware

None.

Syllabus

14 modules

Each module has video lessons, notes and a short quiz. The final exam closes the course.

  1. 1ISO 27001 and the ISMS: what the standard asks for3 lessons
  2. 2The implementation roadmap: project, gap analysis and the 2022 changes3 lessons
  3. 3Clause 4: context, interested parties and the ISMS scope3 lessons
  4. 4Clause 5: leadership, the security policy and roles3 lessons
  5. 5Clause 6.1.2: risk criteria and the information security risk assessment3 lessons
  6. 6Clause 6.1.3 to 6.3: risk treatment, the SoA, objectives and planning changes3 lessons
  7. 7Annex A and ISO/IEC 27002:2022: 93 controls in four themes3 lessons
  8. 8Organisational controls: suppliers, cloud, incidents and continuity4 lessons
  9. 9People, physical and technological controls in practice3 lessons
  10. 10Clauses 7 and 8: support, documented information and operation3 lessons
  11. 11Clause 9: monitoring, internal audit and management review3 lessons
  12. 12Clause 10 and certification: corrective action and the stage 1 and stage 2 audits3 lessons
  13. 13Mapping the ISMS to GDPR, NIS2, SOC 2 and NIST CSF 2.02 lessons
  14. 14Final Assessment1 lesson

How it works

How this course works

  1. Watch the video lessonsOne module at a time, at your own pace.
  2. Take the module quizA short quiz at the end of each module shows what stuck.
  3. Keep your notesWrite in My notes beside each module and ask the trainer if you are stuck.
  4. Sit the final examPass it once you have been through the modules.
  5. Certificate, if you want oneOptionalPaid, and only after you pass. Anyone can check it online.

Certificate

An optional certificate when you pass

Learning is free. Pass the final exam and you can have a certificate for £19, including VAT, with a number employers can check online. It records that you completed a free online course; it is not a regulated qualification or a CPD certificate.

  • Your name, the course, its study time and your final exam score
  • A unique certificate number and a QR code to its verification page
  • Issued by Wartens Ltd; add it to your LinkedIn profile in one click
  • Pay now or after you pass: it is issued the moment you pass the final

How the certificate works

Sample certificate for ISO 27001:2022 Implementation: Build an ISMS

Credits

Who made the lessons

The video lessons belong to their creators. EDWartens wrote the study plan, notes, quizzes and the final exam.

  • Dejan Kosutic

    the Advisera lessons on what ISO 27001 is, the clauses, the seven implementation steps, setting the scope, risk assessment and treatment, writing the Statement of Applicability, implementing Annex A controls and internal audit essentials

  • Consultants Like Us

    the clause-by-clause explanations of clauses 4 to 9, the information security policy and mandatory policies, the Annex A lessons on supplier relationships, cloud services, incident management planning, ICT readiness and the secure development life cycle, and preparing for the stage 1 and stage 2 audits

  • Stuart Barker

    ISO 27001 and ISO 27002 compared, implementing clause 4, management review, continual improvement, and the Annex A lessons on remote working and user endpoint devices

  • Prabh Nair

    the end-to-end implementation case study, the project initiation document, building a Statement of Applicability from scratch and writing effective ISMS documents

  • URM Consulting

    the guide to ISO 27001 risk assessment and the summary of the ISO 27002:2022 update

  • CertiKit

    the detailed walk-through of an ISO 27001 risk assessment

  • NQA Certification

    the certification body's webinar on understanding the ISO 27001:2022 Annex A controls

  • risk3sixty

    getting ready for an ISO 27001 certification audit

  • SoftComply

    the webinar on implementing NIS2 alongside ISO 27001

  • GRC Made Simple

    the key differences between ISO 27001 and SOC 2

Questions

About this course

What is the ISO 27001 implementation course?
It is a free-to-learn course that shows you how to build an information security management system (ISMS) to ISO/IEC 27001:2022, step by step: context and scope, leadership and policy, risk assessment and treatment, the Statement of Applicability, the 93 Annex A controls, documented information, internal audit, management review, corrective action and the stage 1 and stage 2 certification audits.
Who is this ISO 27001 course for?
IT and security staff, compliance and quality officers, consultants and graduates who will implement or maintain an ISMS, and managers who have been asked to get their organisation certified. Basic IT and security vocabulary helps; no previous ISO management system experience is needed.
Which version of ISO 27001 does the course teach?
ISO/IEC 27001:2022 with Amendment 1:2024 (climate action changes), which was the current version when the course was checked on 11 October 2026; the transition from the 2013 edition ended on 31 October 2025. The course also uses ISO/IEC 27002:2022 for the controls and ISO/IEC 27005:2022 for risk, and paraphrases the standards rather than reproducing their text.
What is a Statement of Applicability in ISO 27001?
The Statement of Applicability (SoA) is the document that lists every Annex A control, says whether it applies, justifies including or excluding it, and records whether it is implemented. The course shows how to build it from the risk treatment decisions so that each row points to a risk, a contract or a legal requirement.
Is this an ISO 27001 lead implementer or lead auditor certification?
No. The course covers the knowledge used in implementation and internal audit work, but its certificate is a verifiable certificate of completion from EDWartens, not a lead implementer or lead auditor credential, and it does not certify any organisation. Organisations are certified by independent certification bodies.
How long does the course take, and is it free?
About 13 hours of video and around 19 hours in total with the notes, worked problems and practice tasks, at your own pace. Every module, the notes, the optional ISMS starter-pack project and the final assessment are free to learn.
What certificate do I get?
A verifiable certificate of completion, issued when you finish the modules and pass the 15-question final at 60 percent. It has a unique certificate number, a QR code and a public verification page that shows the course, the modules covered and your final score.
What jobs does ISO 27001 implementation knowledge lead to?
It is the core knowledge for roles such as ISMS coordinator, information security officer, GRC analyst, compliance analyst and internal auditor, and it supports consultants who help companies prepare for certification. Suppliers to banks, governments and large enterprises are often required to hold ISO/IEC 27001.

The Professional Module is five live days of Siemens PLC, HMI and SCADA with an instructor, then a resume session and a CPD certificate.

See the Professional Module