SC124: ISMS Implementation for Energy Utilities / CRITIS in accordance with ISO/IEC 27001:2022 and ISO/IEC 27019

Agenda:

• Part 1: Brief introduction: Understanding information security and threat landscape
  
  
• Part 2: The ISO/IEC 27001 standard family, as well as legal, regulatory requirements
  • Overview of the standards diversity
  • Structure of ISO/IEC 27001, 27002 and ISO/IEC 27019
  • IT security catalogs §11 (1a), (1b) EnWG (IT-SiK)
  • Conformity assessment program of BNetzA
  • BSI™ Act and BSI™-KRITIS ordinance, §8a requirements
  • Sector-Specific Security Standards (B3S)
    
    
• Part 3: The management system ISO/IEC 27001, Chapters 4 - 10
  • Chapter 4: Context of the organization
    • What is the internal and external context, interested parties?
    • How should the so-called scope be derived and how could a scope document be structured?
    • What influence do IT-SiK and §8a requirements have on the scope
  • Chapter 5: Leadership
    • Requirements and roles of management in the ISMS
    • Components of an information security policy
    • Roles and responsibilities in the ISMS
  • Chapter 6: Planning
    • ISMS Risk Management: Standard requirements and solution approaches for practice to fulfill the requirements from IT-SiK or §8a BSI™-G
    • Components of risk management according to ISO/IEC 27005
    • Structure of a Statement of Applicability (SoA)
    • How are company-specific controls appropriately implemented? "Everyone reads from the same standard, but what does this mean specifically for energy suppliers?"
    • Risk matrix, risk owner and risk treatment options/plans
  • Chapter 7: Support
    • Resources, competencies, awareness, documented information
  • Chapter 8: Operation
    • Requirements and challenges for maintaining a management system
  • Chapter 9: Performance evaluation
    • Measuring and evaluating with metrics and KPIs
    • Conducting internal audits, structure of audit plans and audit programs
    • Components of a management review
  • Chapter 10: Improvement
    • Requirements for corrective actions from audits and security incidents
    • Establishment of a continuous improvement process (CIP)
      
      
• Part 4: Presentation and discussion of selected technical-organizational controls from ISO/IEC 27001, Annex A
  
  • ISO/IEC 27001/27002: among others asset management, supplier management, incident management
  • ISO/IEC 27019: Content of the 14 new controls and use of the supplementary implementation guidance, among others physical security of control rooms and operational facilities.
  • Reporting obligations from §11 (1c) EnWG and §8b (3) BSI™-G. structure of a contact point for constant accessibility by the Federal Office for Information Security
    
    
• Part 5: Certification & audits
  • The certification cycle
  • The path to successful certification - what must be considered?
    
    

Objectives:

The goal of the course is to fundamentally understand a management system according to ISO/IEC 27001 and to be able to derive requirements for certifications and audits.

You will receive comprehensive knowledge for the planning, implementation, monitoring, improvement, and ongoing operation of an ISMS.

Furthermore, the course provides a solid foundation for further advanced courses, such as:

• SC185 Practical Implementation of ISO 27001/27002
• SC135 Internal Auditor
• SC150 ISMS Auditor/Lead Auditor (IRCA™ A17608)

An active exchange of information among participants is encouraged.

The course does not aim to present a set of templates and documentation but is directed at individuals who want to operate a standards-compliant management system. The course does not constitute legal advice on the application of legal and regulatory requirements.

At the end of the last training day, there is an opportunity to take an exam. Upon passing, a certificate will be issued. All exam content will be covered in the seminar.

The certificate title is: "ISMS Implementer for Energy Supply Companies/Critical Infrastructure according to ISO/IEC 27001 and 27019"

Target audience:

Prerequisites:

Description: