ISMS Learning Path Template (ISO/IEC 27001 Manager and Auditor)

ISMS Learning Path: [Organization name]

A structured learning path that takes a person from no prior knowledge of information security management systems (ISMS) to working as an ISMS manager or an internal auditor against ISO/IEC 27001:2022 + Amd 1:2024. It sets out twelve modules with learning outcomes, the library templates to study in each module and in which order, time estimates, a self-check per module and role-based tracks. It supports competence planning under clause 7.2 (competence) and clause 7.3 (awareness) of ISO/IEC 27001:2022. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. How the path is built
3. Learning levels and outcomes
4. Role-based tracks
5. Module overview
6. Modules in detail
7. Study methods and practical outputs
8. Size tiers: how the path changes
9. Assessment and sign-off
10. Maintaining the path
11. Learner log
12. Records and evidence
13. References

1. Purpose and scope

This learning path serves three purposes:

1. Self-study. A person who wants to understand ISO/IEC 27001 can work through the modules in order, using the templates in this library as course material and their own organisation as the case study.
2. Onboarding. A new ISMS manager, control owner or internal auditor gets a defined set of modules with outcomes, so their manager knows what "ready" means.
3. Competence evidence. Completed modules, self-check results and reviewed work products feed the competence and training matrix (isms/isms-competence-training-matrix, DOC-ISMS-026), which is the record clause 7.2 expects.

The path covers the requirements standard ISO/IEC 27001:2022 + Amd 1:2024 (clauses 4 to 10 and Annex A), the guidance that supports it (ISO/IEC 27002:2022, ISO/IEC 27005:2022, ISO/IEC 27003:2017) and the audit and certification context (ISO 19011:2026, ISO/IEC 17021-1:2015, ISO/IEC 27006-1:2024). It does not replace an accredited personnel certification course, and it does not reproduce any ISO text: learners need licensed copies of the standards listed in section 13.

Out of scope: deep technical training (secure coding, forensics, cloud engineering), privacy management under ISO/IEC 27701:2025 beyond an introduction, and sector extensions. Those are covered by the templates named in module 5 and by isms/iso-27000-family-map.

2. How the path is built

The path follows the life of an ISMS: learn the language, decide and start, frame the system, assess and treat risk, implement controls, run the system, check it, audit it and certify it. Each module has the same parts:

Entry rule: a learner who already holds relevant experience takes the self-check of a module first. Three correct answers without notes, plus a mentor's look at an existing work product of the same kind, lets the learner skip the module. Record the skip and its basis in the learner log (section 11).

3. Learning levels and outcomes

The path uses four working levels. They are the library's levels, not an official scheme. ISO/IEC 27021:2017 + Amd 1:2021 describes competence requirements for ISMS professionals in more depth and is worth reading for anyone designing a formal competence framework.

Overall outcomes for a learner who completes the ISMS manager track (T3):

1. Explain each clause of ISO/IEC 27001:2022 in plain language and name the records it requires.
2. Define scope, context and interested parties for a real organisation.
3. Run a risk assessment with the 5 x 5 scale used in this library and produce a risk treatment plan and a Statement of Applicability.
4. Select and justify Annex A controls and link each to evidence.
5. Plan and run measurement, an internal audit and a management review.
6. Prepare the organisation for a two-stage certification audit and the three-year cycle that follows.

4. Role-based tracks

How the totals are built (Example): T1 is 2 + 4 + 5 = 11 hours; T2 is 2 + 4 + 12 + 6 = 24 hours; T3 is the sum of all twelve modules, 77 hours; T4 is 2 + 4 + 6 + 10 + 12 + 5 + 10 + 8 = 57 hours; T5 is 2 + 4 + 10 = 16 hours.

Internal auditors need an extra condition that study cannot meet: they must not audit their own work (under clause 9.2.2 an auditor checking their own work is not independent). When you assign T4, record which areas each auditor may not audit.

5. Module overview

6. Modules in detail

6.1 M0 Orientation (2 hours)

Outcomes. Name the requirements standard and the main guidance standards. Explain what certification is and who grants it. Describe what an ISMS is in two sentences.

Study order.

1. isms/iso-27000-family-map: which standards exist, which are certifiable.
2. This learning path, sections 1 to 5.
3. isms/isms-glossary, section 3 (core terms only).

Standard reading. ISO/IEC 27000:2026 overview sections; the introduction and clause 1 of ISO/IEC 27001:2022.

Practical output. A personal reading list: which standards your organisation owns, which you need to buy, and where licensed copies are kept.

Self-check.

1. Which standard in the family contains the requirements an organisation is certified against?
2. Who makes the certification decision?
3. What did Amendment 1:2024 add to ISO/IEC 27001?

6.2 M1 Vocabulary and structure (4 hours)

Outcomes. Use the core ISMS terms correctly. Describe the seven requirement clauses (4 to 10) and the four Annex A themes with their control counts. Explain the difference between a requirement and a control.

Study order.

1. isms/isms-glossary, all sections.
2. isms/iso-27001-clauses-explained, sections 1 to 3 (overview and the structure).
3. compliance/iso-map: how 27001 sits next to other management system standards.

Standard reading. ISO/IEC 27001:2022 clauses 0 to 3 and the Annex A headings.

Practical output. A glossary of 20 terms written in your organisation's words, for example what "asset owner" or "risk owner" means in your structure.

Self-check.

1. How many controls does Annex A contain, and in which four themes?
2. Name the clause that deals with planning of changes, new in 2022.
3. Is Annex A a list of mandatory controls? Explain in one sentence.

6.3 M2 Deciding and starting (4 hours)

Outcomes. Write a business case for an ISMS. Set up the project with a sponsor, a team and a roadmap. Run a gap assessment against the clauses.

Study order.

1. isms/isms-business-case (DOC-ISMS-029).
2. isms/isms-project-charter (DOC-ISMS-009).
3. compliance/iso-27001-gap-assessment (DOC-ISMS-098).
4. isms/isms-implementation-roadmap (DOC-ISMS-030).
5. isms/isms-budget-resource-plan (DOC-ISMS-031).

Standard reading. ISO/IEC 27003:2017 (general guidance on implementation; a revision is in progress, check for a newer edition).

Practical output. A one-page gap summary: clauses met, partly met and not met, with the three largest gaps and an owner for each.

Self-check.

1. What three things must a business case make clear to top management?
2. Why run a gap assessment before writing policies?
3. Which clause makes top management accountable for the ISMS?

6.4 M3 Context, scope and leadership (6 hours)

Outcomes. Identify external and internal issues, including whether climate change is relevant. List interested parties, their requirements and which of them the ISMS will address. Write a scope statement with interfaces and dependencies. Draft the information security policy and the role assignments.

Study order.

1. isms/iso-27001-clauses-explained, sections on clauses 4 and 5.
2. isms/isms-context-interested-parties (DOC-ISMS-003).
3. compliance/ms-scope (DOC-ISMS-002).
4. isms/isms-process-map (DOC-ISMS-004).
5. compliance/information-security-policy (DOC-ISMS-001).
6. isms/isms-policy-framework (DOC-ISMS-005).
7. isms/isms-roles-raci (DOC-ISMS-006).
8. isms/isms-steering-committee-charter (DOC-ISMS-007).

Standard reading. ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 and 5.

Practical output. A draft scope statement and a list of interested parties with their requirements, reviewed by the mentor.

Self-check.

1. What must a scope statement consider besides the organisational units inside it?
2. Name two places where Amendment 1:2024 touches clause 4.
3. Under clause 5.3, which two responsibilities must top management assign explicitly, besides assigning and communicating ISMS roles?

6.5 M4 Risk assessment and treatment (10 hours)

Outcomes. Define risk criteria and acceptance rules. Identify, analyse and evaluate risks with the 5 x 5 scale (likelihood 1 to 5 times impact 1 to 5, bands Low 1-4, Medium 5-9, High 10-16, Critical 17 to 25, which in practice means 20 and 25). Choose treatment options, compare controls against Annex A and produce a Statement of Applicability. Record acceptance of residual risk by risk owners.

Study order.

1. compliance/risk-methodology (DOC-ISMS-010).
2. isms/isms-risk-appetite-criteria (DOC-ISMS-015).
3. compliance/asset-inventory (DOC-ISMS-012).
4. isms/isms-threat-vulnerability-catalogue (DOC-ISMS-018).
5. compliance/risk-register (DOC-ISMS-016).
6. isms/isms-risk-assessment-report (DOC-ISMS-017).
7. compliance/risk-treatment-plan (DOC-ISMS-013).
8. isms/isms-risk-acceptance-record (DOC-ISMS-019).
9. compliance/statement-of-applicability (DOC-ISMS-011).

Standard reading. ISO/IEC 27001:2022 clauses 6.1, 8.2 and 8.3; ISO/IEC 27005:2022 (event-based and asset-based approaches); ISO 31000:2018 for general risk principles.

Practical output. Five risks on your own organisation, each with likelihood, impact, score, band, owner, treatment option and the Annex A controls compared.

Self-check.

1. A risk has likelihood 4 and impact 4. What is the score and the band, and who may accept it under the library's default rules?
2. Which four elements must the Statement of Applicability contain for each control?
3. Why must risk assessments be repeatable and produce comparable results?

6.6 M5 Annex A controls (12 hours)

Outcomes. Explain the purpose of each of the four Annex A themes and of the 11 controls that are new in 2022. Use the ISO/IEC 27002:2022 attributes to group controls. Judge whether a control is applicable and justify an exclusion.

Study order.

1. isms/annex-a-organizational-controls-guide (A.5, 37 controls).
2. isms/annex-a-people-physical-controls-guide (A.6, 8 controls, and A.7, 14 controls).
3. isms/annex-a-technological-controls-guide (A.8, 34 controls).
4. Sample policies, one per theme: isms/access-control-policy (DOC-ISMS-041), isms/remote-working-policy (DOC-ISMS-054), isms/physical-security-policy (DOC-ISMS-055), isms/secure-configuration-baseline (DOC-ISMS-060).
5. isms/control-framework-crosswalk (DOC-ISMS-106) if you also work with SOC 2, NIST CSF or sector frameworks.

Standard reading. ISO/IEC 27001:2022 Annex A; ISO/IEC 27002:2022 for the guidance and attributes.

Practical output. A draft Statement of Applicability for one theme, with applicability, justification and current status for every control in that theme.

Self-check.

1. Name four of the 11 controls new in 2022.
2. What is wrong with "Not applicable: we do not have this problem" as a justification?
3. What are the five attributes in ISO/IEC 27002:2022, and which values does the cybersecurity concepts attribute use?

6.7 M6 Support processes (5 hours)

Outcomes. Determine competence needs and keep evidence. Plan awareness and communication. Control documented information: identify, format, review, approve, distribute, protect, retain and dispose.

Study order.

1. isms/iso-27001-clauses-explained, clause 7 section.
2. isms/isms-competence-training-matrix (DOC-ISMS-026).
3. security/security-awareness-program.
4. isms/isms-communication-plan (DOC-ISMS-027).
5. isms/isms-documented-information-register (DOC-ISMS-028).
6. compliance/controlled-document.

Standard reading. ISO/IEC 27001:2022 clause 7.

Practical output. Competence matrix rows for three ISMS roles and one communication plan entry covering the message, its timing, its audience and its channel (the clause 7.4 points), plus who communicates, which is good practice rather than a 2022 requirement).

Self-check.

1. What must the organisation keep as evidence for competence?
2. Name three things every person under the organisation's control must be aware of.
3. What is the difference between documented information the standard requires and documented information the organisation decides it needs?

6.8 M7 Operation and evidence (6 hours)

Outcomes. Plan and control ISMS operation, including externally provided processes. Link every applicable control to the record that proves it operates. Run the recurring registers that auditors sample.

Study order.

1. isms/control-evidence-matrix (DOC-ISMS-033).
2. isms/isms-annual-calendar (DOC-ISMS-032).
3. isms/isms-manual (DOC-ISMS-008).
4. isms/isms-change-plan (DOC-ISMS-025).
5. isms/security-event-reporting-procedure (DOC-ISMS-023) and compliance/incident-response-plan (DOC-ISMS-020).
6. isms/vulnerability-remediation-tracker (DOC-ISMS-072).
7. isms/backup-restore-test-log (DOC-ISMS-071).
8. compliance/supplier-security-assessment (DOC-ISMS-067).

Standard reading. ISO/IEC 27001:2022 clauses 6.3 and 8.

Practical output. Ten rows of the control evidence matrix for your organisation: control, owner, record, location, frequency, last sample.

Self-check.

1. What does clause 8.1 expect for processes provided by external parties?
2. When must the risk assessment be repeated, apart from planned intervals?
3. Why is "we do it but do not record it" a weak position at audit?

6.9 M8 Measurement and management review (5 hours)

Outcomes. Decide what to monitor and measure, how, when and by whom, and who analyses the results. Write measures with targets. Prepare and minute a management review that covers every required input.

Study order.

1. isms/isms-measurement-programme (DOC-ISMS-080).
2. compliance/objectives-register (DOC-ISMS-024).
3. isms/isms-performance-report (DOC-ISMS-081).
4. compliance/management-review (DOC-ISMS-085).

Standard reading. ISO/IEC 27001:2022 clauses 6.2, 9.1 and 9.3; ISO/IEC 27004:2016 (under revision; check for a newer edition).

Practical output. Three measures linked to objectives, each with a formula, source, frequency, target and owner, and a management review agenda that maps to the required inputs.

Self-check.

1. Name four inputs a management review must consider.
2. What is the difference between monitoring and measurement?
3. Which outputs of a management review must be recorded?

6.10 M9 Internal audit (10 hours)

Outcomes. Plan an audit programme based on importance of processes and previous results. Prepare a checklist, sample evidence, write findings that state requirement, evidence and gap, and grade them. Follow nonconformities through correction, root cause and corrective action.

Study order.

1. compliance/internal-audit-program (DOC-ISMS-082).
2. isms/isms-internal-audit-checklist (DOC-ISMS-083).
3. isms/isms-internal-audit-report (DOC-ISMS-084).
4. isms/audit-findings-register (DOC-ISMS-086).
5. compliance/capa-nonconformity (DOC-ISMS-087).
6. isms/continual-improvement-register (DOC-ISMS-088).

Standard reading. ISO/IEC 27001:2022 clauses 9.2 and 10; ISO 19011:2026 (principles of auditing and managing an audit programme); ISO/IEC 27007:2020 (ISMS auditing guidance, under revision).

Practical output. A checklist and a short report for one process, for example access rights review, with at least one finding written in the requirement, evidence, gap format. A mentor reviews it.

Self-check.

1. What makes an auditor objective and impartial in practice?
2. What is the difference between a correction and a corrective action?
3. Write a one-line finding for "no evidence that leavers' accounts were removed within the defined time".

6.11 M10 Certification (5 hours)

Outcomes. Explain Stage 1 and Stage 2, surveillance and recertification in the three-year cycle. Select an accredited certification body. Prepare a Stage 1 pack and a Stage 2 evidence index. Respond to nonconformities.

Study order.

1. isms/certification-audit-explained (LRN-ISMS-07).
2. isms/certification-body-selection (DOC-ISMS-090).
3. isms/stage-1-readiness-pack (DOC-ISMS-091).
4. isms/stage-2-audit-evidence-index (DOC-ISMS-092).
5. isms/certification-findings-action-plan (DOC-ISMS-093).
6. isms/certification-cycle-plan (DOC-ISMS-094).
7. isms/surveillance-readiness-health-check (DOC-ISMS-096).

Standard reading. ISO/IEC 17021-1:2015 audit stages; ISO/IEC 27006-1:2024 for how certification bodies set audit time and handle multi-site organisations.

Practical output. A Stage 1 readiness self-assessment for your organisation with open gaps and dates.

Self-check.

1. What does Stage 1 check that Stage 2 does not?
2. How often are surveillance audits held, and when is the first one due?
3. Who sets the audit time, and on what basis?

6.12 M11 Capstone and self-test (8 hours)

Outcomes. Apply the whole path to a case from start to certificate. Score at least the pass mark set in section 9 on the self-test.

Study order.

1. isms/isms-worked-walkthrough (LRN-ISMS-09): a full ISMS built for one of the library's fictional organisations.
2. isms/isms-self-test (LRN-ISMS-08): all sections, without notes.
3. Review any question you got wrong in the matching module.

Practical output. The completed walkthrough exercises and a scored self-test entered in the learner log.

Self-check. The self-test is the self-check for this module.

7. Study methods and practical outputs

Use these methods together:

• Read, then do. Read the template, read the clauses, then fill the template for your own organisation in a sandbox copy. Mark the copy "training" so it is not mistaken for a controlled document.
• Mentor review. Each practical output is reviewed by a mentor who holds the target level or higher (L3 for most modules). The mentor records "accepted" or "rework" with one line of feedback.
• Shadowing. Internal auditors in training shadow at least one audit before leading one. ISMS managers in training sit in on one management review and one risk workshop.
• Peer explanation. The learner explains one clause or control to a colleague in five minutes without notes. If they cannot, they repeat the reading.
• Real records. Where safe, practical outputs become real drafts: a good scope statement from M3 can become the first version of DOC-ISMS-002 after the normal review and approval.

Practical outputs by module, with the mentor role that reviews them:

8. Size tiers: how the path changes

The tiers are the library's working tiers (small under 50 people, medium 50 to 500, large or multi-site over 500 or several sites), not official definitions.

Worked example of the small-tier study plan (Example dates in 2027):

The plan runs ten weeks: 1 + 1 + 2 + 2 + 1 + 1 + 1 + 1 = 10 weeks, from 2027-01-04 to 2027-03-14.

9. Assessment and sign-off

A module is complete when all three conditions are met:

1. The learner answered the module self-check correctly without notes, or corrected their answers after review and passed a second attempt.
2. The practical output was accepted by the mentor.
3. The learner log entry is filled and dated.

A track is complete when every module in it is complete and, for T3 and T4, the learner scored at least the pass mark on isms/isms-self-test.

Effectiveness check: three to six months after sign-off, the mentor looks at one real work product of the learner (a risk assessment, an audit report, an evidence record) and confirms it meets the standard expected. Record the result in the competence matrix.

10. Maintaining the path

Review the path:

• once a year, at the same time as the competence and training matrix;
• when a standard it relies on changes edition (watch ISO/IEC 27003, ISO/IEC 27004 and ISO/IEC 27007, which are under revision as of 2026-11-01);
• when the organisation's ISMS changes materially (new scope, new site, new certification standard such as ISO/IEC 27701:2025);
• after each cohort, using learner feedback and self-test results.

Keep a short change note in the revision history: what changed, why and which learners are affected. Learners who completed a module that changed substantially take the updated self-check.

11. Learner log

12. Records and evidence

Map these records in isms/control-evidence-matrix (DOC-ISMS-033) against clause 7.2, clause 7.3 and control A.6.3 (awareness, education and training).

13. References

Standards (editions checked 2026-11-01):

Related templates: isms/isms-glossary, isms/iso-27001-clauses-explained, isms/annex-a-organizational-controls-guide, isms/annex-a-people-physical-controls-guide, isms/annex-a-technological-controls-guide, isms/certification-audit-explained, isms/isms-self-test, isms/isms-worked-walkthrough, isms/iso-27000-family-map, isms/isms-competence-training-matrix, isms/control-evidence-matrix, security/security-awareness-program.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 7.2 and 7.3, and informed by the competence themes of ISO/IEC 27021:2017 + Amd 1:2021. The modules, tracks, levels, hours, self-checks and learner log are original text. No ISO or IEC text, clauses, controls or definitions are reproduced; you need the official standards to study and implement them. Editions change: check the current edition of each standard on iso.org before you rely on this path. Hours, pass marks and retention periods are Example values, not requirements. This is a learning plan, not a personnel certification scheme, and completing it does not certify a person or an organisation. Template licence: MIT.