# ISMS Learning Path: [Organization name]

> A structured learning path that takes a person from no prior knowledge of
> information security management systems (ISMS) to working as an ISMS
> manager or an internal auditor against ISO/IEC 27001:2022 + Amd 1:2024.
> It sets out twelve modules with learning outcomes, the library templates
> to study in each module and in which order, time estimates, a self-check
> per module and role-based tracks. It supports competence planning under
> clause 7.2 (competence) and clause 7.3 (awareness) of ISO/IEC 27001:2022.
> Replace every `[bracketed]` value and every row marked *Example*.

<!--
Guidance: How to use this template
- Use it when a new ISMS manager, ISMS project member, control owner or
  internal auditor joins, when you plan the competence part of an ISMS
  project, or when you want a self-study plan for yourself.
- Fill the Document control table first, then section 4 (choose the tracks
  your people need) and section 11 (the learner log). Sections 5 and 6 can
  be used as they are; adjust the hours to your own pace.
- Main pitfall: reading the templates without doing anything with them.
  Every module ends with a practical output on your own organisation.
  Someone who has only read about risk assessment cannot run one.
- Second pitfall: treating course attendance as competence. Clause 7.2 is
  about proof that a person can do the job, backed by records, and
  sitting through a course does not prove that on its own. A completed module plus a
  passed self-check and a reviewed work product is better evidence than an
  attendance list alone.
- Related templates: `isms/isms-glossary`, `isms/iso-27001-clauses-explained`,
  `isms/isms-self-test`, `isms/iso-27000-family-map`,
  `isms/isms-competence-training-matrix`, `isms/isms-worked-walkthrough`.
-->

## Document control

<!-- Guidance: Keep the learning path under document control if you use it as part of your competence process (clause 7.2). An auditor may ask how the ISMS manager or internal auditors became competent, and this plan plus the learner log answers that question. -->

| Field | Value |
|---|---|
| Document ID | LRN-ISMS-01 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@hr-learning-lead] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024, clauses 7.2 and 7.3 |
| Audience | [ISMS team, control owners, internal auditors, top management] |
| Tracks in use | [T1 top management / T2 control owner / T3 ISMS manager / T4 internal auditor / T5 risk owner] |
| Linked competence record | DOC-ISMS-026 (competence and training matrix) |
| Next scheduled review | YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| CISO or security lead | [@ciso] | [Approved / Approved with changes] | YYYY-MM-DD |
| HR or learning lead | [@hr-learning-lead] | [Reviewed] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | 2026-11-01 | [@isms-manager] | First learning path, twelve modules and five tracks |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Hours adjusted after the first cohort; module 9 extended with a practice audit |

## Contents

<!-- Guidance: Sections 1 to 3 explain the path. Sections 4 to 6 are the core: tracks, module overview and module detail. Sections 7 to 11 turn the path into a plan with records. -->

1. Purpose and scope
2. How the path is built
3. Learning levels and outcomes
4. Role-based tracks
5. Module overview
6. Modules in detail
7. Study methods and practical outputs
8. Size tiers: how the path changes
9. Assessment and sign-off
10. Maintaining the path
11. Learner log
12. Records and evidence
13. References

## 1. Purpose and scope

<!-- Guidance: State who the path is for and what it is not. Questions to answer: which roles must complete which track, by when, and who signs off? An auditor checks that the competence needed for ISMS roles has been determined and that there is evidence people meet it. -->

This learning path serves three purposes:

1. **Self-study.** A person who wants to understand ISO/IEC 27001 can work
   through the modules in order, using the templates in this library as
   course material and their own organisation as the case study.
2. **Onboarding.** A new ISMS manager, control owner or internal auditor
   gets a defined set of modules with outcomes, so their manager knows what
   "ready" means.
3. **Competence evidence.** Completed modules, self-check results and
   reviewed work products feed the competence and training matrix
   (`isms/isms-competence-training-matrix`, DOC-ISMS-026), which is the
   record clause 7.2 expects.

The path covers the requirements standard ISO/IEC 27001:2022 + Amd 1:2024
(clauses 4 to 10 and Annex A), the guidance that supports it (ISO/IEC
27002:2022, ISO/IEC 27005:2022, ISO/IEC 27003:2017) and the audit and
certification context (ISO 19011:2026, ISO/IEC 17021-1:2015, ISO/IEC
27006-1:2024). It does not replace an accredited personnel certification
course, and it does not reproduce any ISO text: learners need licensed
copies of the standards listed in section 13.

Out of scope: deep technical training (secure coding, forensics, cloud
engineering), privacy management under ISO/IEC 27701:2025 beyond an
introduction, and sector extensions. Those are covered by the templates
named in module 5 and by `isms/iso-27000-family-map`.

## 2. How the path is built

<!-- Guidance: Explain the design so a learner can skip what they already know. Pitfall: a linear path that forces experienced people to repeat basics. Allow entry by self-check: if a learner passes a module self-check first time, record it and move on. -->

The path follows the life of an ISMS: learn the language, decide and start,
frame the system, assess and treat risk, implement controls, run the
system, check it, audit it and certify it. Each module has the same parts:

| Part | What it contains |
|---|---|
| Outcomes | Three to five things the learner can do at the end, written as actions |
| Study order | Templates in this library, read in the order given |
| Standard reading | The clauses or sections of the official standards to read alongside |
| Practical output | A work product on the learner's own organisation, reviewed by a mentor |
| Self-check | Three questions answered without notes, plus the matching section of `isms/isms-self-test` |
| Time estimate | Hours for an average learner, *Example* values to adjust |

```mermaid
flowchart TD
    M0["M0 Orientation"] --> M1["M1 Vocabulary and structure"]
    M1 --> M2["M2 Deciding and starting"]
    M2 --> M3["M3 Context, scope and leadership"]
    M3 --> M4["M4 Risk assessment and treatment"]
    M4 --> M5["M5 Annex A controls"]
    M5 --> M6["M6 Support processes"]
    M6 --> M7["M7 Operation and evidence"]
    M7 --> M8["M8 Measurement and management review"]
    M8 --> M9["M9 Internal audit"]
    M9 --> M10["M10 Certification"]
    M10 --> M11["M11 Capstone and self-test"]
```

Entry rule: a learner who already holds relevant experience takes the
self-check of a module first. Three correct answers without notes, plus a
mentor's look at an existing work product of the same kind, lets the
learner skip the module. Record the skip and its basis in the learner log
(section 11).

## 3. Learning levels and outcomes

<!-- Guidance: Levels help managers set expectations. Map each role to a level, not each person. Pitfall: expecting "expert" level from someone after one week. Experience matters as much as study. -->

The path uses four working levels. They are the library's levels, not an
official scheme. ISO/IEC 27021:2017 + Amd 1:2021 describes competence
requirements for ISMS professionals in more depth and is worth reading for
anyone designing a formal competence framework.

| Level | Description | Typical roles | Modules |
|---|---|---|---|
| L1 Aware | Understands why the ISMS exists, the main terms and their own duties | All staff, top management (short form) | M0, M1 |
| L2 Contributor | Can fill and maintain the documents for their area and produce evidence | Control owners, risk owners, site coordinators | M0 to M1 plus the modules of their track |
| L3 Practitioner | Can run an ISMS process end to end (risk assessment, internal audit, measurement) | ISMS manager, security team, internal auditors | Full track for the role |
| L4 Lead | Can design and lead an ISMS, defend it at a certification audit and coach others | ISMS manager after one full cycle, CISO | All modules plus one completed certification or surveillance cycle |

Overall outcomes for a learner who completes the ISMS manager track (T3):

1. Explain each clause of ISO/IEC 27001:2022 in plain language and name the
   records it requires.
2. Define scope, context and interested parties for a real organisation.
3. Run a risk assessment with the 5 x 5 scale used in this library and
   produce a risk treatment plan and a Statement of Applicability.
4. Select and justify Annex A controls and link each to evidence.
5. Plan and run measurement, an internal audit and a management review.
6. Prepare the organisation for a two-stage certification audit and the
   three-year cycle that follows.

## 4. Role-based tracks

<!-- Guidance: Choose the tracks you need and assign people to them in the learner log. Hours are Example values from section 5 and add up to the module totals. Pitfall: sending top management through the full ISMS manager track; give them the short track and a briefing instead. -->

| Track | For | Modules | Hours *(Example)* | Target level |
|---|---|---|---|---|
| T1 Top management | Directors, executive sponsor, steering committee members | M0, M2, M8 | 11 | L1 plus decision skills |
| T2 Control owner | Owners of Annex A controls, IT and facilities leads | M0, M1, M5, M7 | 24 | L2 |
| T3 ISMS manager | ISMS manager, deputy, security team members | M0 to M11 (all) | 77 | L3, then L4 after a cycle |
| T4 Internal auditor | Staff who will audit the ISMS | M0, M1, M3, M4, M5, M8, M9, M11 | 57 | L3 for audit |
| T5 Risk owner | Managers who own risks and accept residual risk | M0, M1, M4 | 16 | L2 |

How the totals are built (*Example*): T1 is 2 + 4 + 5 = 11 hours; T2 is
2 + 4 + 12 + 6 = 24 hours; T3 is the sum of all twelve modules, 77 hours;
T4 is 2 + 4 + 6 + 10 + 12 + 5 + 10 + 8 = 57 hours; T5 is 2 + 4 + 10 = 16
hours.

Internal auditors need an extra condition that study cannot meet: they must
not audit their own work (under clause 9.2.2 an auditor checking their
own work is not independent). When you assign T4, record which areas each auditor may not
audit.

## 5. Module overview

<!-- Guidance: This table is the plan at a glance. Keep hours honest: revisit them after the first cohort. The total must equal the T3 track total in section 4. -->

| Module | Title | Clauses and areas | Hours *(Example)* | Practical output |
|---|---|---|---|---|
| M0 | Orientation | Family of standards, how certification works in outline | 2 | Personal reading list |
| M1 | Vocabulary and structure | Harmonized structure, clauses 4 to 10, Annex A themes | 4 | Glossary of 20 terms in your organisation's words |
| M2 | Deciding and starting | Business case, project set-up, gap assessment | 4 | One-page gap summary |
| M3 | Context, scope and leadership | Clauses 4 and 5 | 6 | Draft scope statement and interested parties list |
| M4 | Risk assessment and treatment | Clauses 6.1, 8.2, 8.3 | 10 | Five assessed risks with treatment and owners |
| M5 | Annex A controls | Annex A, ISO/IEC 27002:2022 | 12 | Draft Statement of Applicability for one theme |
| M6 | Support processes | Clause 7 | 5 | Competence matrix rows and a communication plan entry |
| M7 | Operation and evidence | Clause 8.1, evidence, operational registers | 6 | Evidence matrix rows for ten controls |
| M8 | Measurement and management review | Clauses 9.1 and 9.3 | 5 | Three measures with targets and a review agenda |
| M9 | Internal audit | Clause 9.2, clause 10, ISO 19011:2026 | 10 | Audit checklist and report for one process |
| M10 | Certification | ISO/IEC 17021-1:2015, ISO/IEC 27006-1:2024 | 5 | Stage 1 readiness self-assessment |
| M11 | Capstone and self-test | All | 8 | Walkthrough completed and self-test scored |
| | **Total** | | **77** | |

## 6. Modules in detail

<!-- Guidance: Each module lists templates in study order. Read the template, read the clauses named, then produce the output on your own organisation. Self-check questions are answered without notes; record the result in the learner log. -->

### 6.1 M0 Orientation (2 hours)

**Outcomes.** Name the requirements standard and the main guidance
standards. Explain what certification is and who grants it. Describe what
an ISMS is in two sentences.

**Study order.**

1. `isms/iso-27000-family-map`: which standards exist, which are certifiable.
2. This learning path, sections 1 to 5.
3. `isms/isms-glossary`, section 3 (core terms only).

**Standard reading.** ISO/IEC 27000:2026 overview sections; the
introduction and clause 1 of ISO/IEC 27001:2022.

**Practical output.** A personal reading list: which standards your
organisation owns, which you need to buy, and where licensed copies are
kept.

**Self-check.**

1. Which standard in the family contains the requirements an organisation
   is certified against?
2. Who makes the certification decision?
3. What did Amendment 1:2024 add to ISO/IEC 27001?

### 6.2 M1 Vocabulary and structure (4 hours)

**Outcomes.** Use the core ISMS terms correctly. Describe the seven
requirement clauses (4 to 10) and the four Annex A themes with their
control counts. Explain the difference between a requirement and a control.

**Study order.**

1. `isms/isms-glossary`, all sections.
2. `isms/iso-27001-clauses-explained`, sections 1 to 3 (overview and the
   structure).
3. `compliance/iso-map`: how 27001 sits next to other management system
   standards.

**Standard reading.** ISO/IEC 27001:2022 clauses 0 to 3 and the Annex A
headings.

**Practical output.** A glossary of 20 terms written in your organisation's
words, for example what "asset owner" or "risk owner" means in your
structure.

**Self-check.**

1. How many controls does Annex A contain, and in which four themes?
2. Name the clause that deals with planning of changes, new in 2022.
3. Is Annex A a list of mandatory controls? Explain in one sentence.

### 6.3 M2 Deciding and starting (4 hours)

**Outcomes.** Write a business case for an ISMS. Set up the project with a
sponsor, a team and a roadmap. Run a gap assessment against the clauses.

**Study order.**

1. `isms/isms-business-case` (DOC-ISMS-029).
2. `isms/isms-project-charter` (DOC-ISMS-009).
3. `compliance/iso-27001-gap-assessment` (DOC-ISMS-098).
4. `isms/isms-implementation-roadmap` (DOC-ISMS-030).
5. `isms/isms-budget-resource-plan` (DOC-ISMS-031).

**Standard reading.** ISO/IEC 27003:2017 (general guidance on
implementation; a revision is in progress, check for a newer edition).

**Practical output.** A one-page gap summary: clauses met, partly met and
not met, with the three largest gaps and an owner for each.

**Self-check.**

1. What three things must a business case make clear to top management?
2. Why run a gap assessment before writing policies?
3. Which clause makes top management accountable for the ISMS?

### 6.4 M3 Context, scope and leadership (6 hours)

**Outcomes.** Identify external and internal issues, including whether
climate change is relevant. List interested parties, their requirements and
which of them the ISMS will address. Write a scope statement with
interfaces and dependencies. Draft the information security policy and the
role assignments.

**Study order.**

1. `isms/iso-27001-clauses-explained`, sections on clauses 4 and 5.
2. `isms/isms-context-interested-parties` (DOC-ISMS-003).
3. `compliance/ms-scope` (DOC-ISMS-002).
4. `isms/isms-process-map` (DOC-ISMS-004).
5. `compliance/information-security-policy` (DOC-ISMS-001).
6. `isms/isms-policy-framework` (DOC-ISMS-005).
7. `isms/isms-roles-raci` (DOC-ISMS-006).
8. `isms/isms-steering-committee-charter` (DOC-ISMS-007).

**Standard reading.** ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 and 5.

**Practical output.** A draft scope statement and a list of interested
parties with their requirements, reviewed by the mentor.

**Self-check.**

1. What must a scope statement consider besides the organisational units
   inside it?
2. Name two places where Amendment 1:2024 touches clause 4.
3. Under clause 5.3, which two responsibilities must top management
   assign explicitly, besides assigning and communicating ISMS roles?

### 6.5 M4 Risk assessment and treatment (10 hours)

**Outcomes.** Define risk criteria and acceptance rules. Identify,
analyse and evaluate risks with the 5 x 5 scale (likelihood 1 to 5 times
impact 1 to 5, bands Low 1-4, Medium 5-9, High 10-16, Critical 17 to 25,
which in practice means 20 and 25).
Choose treatment options, compare controls against Annex A and produce a
Statement of Applicability. Record acceptance of residual risk by risk
owners.

**Study order.**

1. `compliance/risk-methodology` (DOC-ISMS-010).
2. `isms/isms-risk-appetite-criteria` (DOC-ISMS-015).
3. `compliance/asset-inventory` (DOC-ISMS-012).
4. `isms/isms-threat-vulnerability-catalogue` (DOC-ISMS-018).
5. `compliance/risk-register` (DOC-ISMS-016).
6. `isms/isms-risk-assessment-report` (DOC-ISMS-017).
7. `compliance/risk-treatment-plan` (DOC-ISMS-013).
8. `isms/isms-risk-acceptance-record` (DOC-ISMS-019).
9. `compliance/statement-of-applicability` (DOC-ISMS-011).

**Standard reading.** ISO/IEC 27001:2022 clauses 6.1, 8.2 and 8.3;
ISO/IEC 27005:2022 (event-based and asset-based approaches); ISO 31000:2018
for general risk principles.

**Practical output.** Five risks on your own organisation, each with
likelihood, impact, score, band, owner, treatment option and the Annex A
controls compared.

**Self-check.**

1. A risk has likelihood 4 and impact 4. What is the score and the band,
   and who may accept it under the library's default rules?
2. Which four elements must the Statement of Applicability contain for each
   control?
3. Why must risk assessments be repeatable and produce comparable results?

### 6.6 M5 Annex A controls (12 hours)

**Outcomes.** Explain the purpose of each of the four Annex A themes and
of the 11 controls that are new in 2022. Use the ISO/IEC 27002:2022
attributes to group controls. Judge whether a control is applicable and
justify an exclusion.

**Study order.**

1. `isms/annex-a-organizational-controls-guide` (A.5, 37 controls).
2. `isms/annex-a-people-physical-controls-guide` (A.6, 8 controls, and
   A.7, 14 controls).
3. `isms/annex-a-technological-controls-guide` (A.8, 34 controls).
4. Sample policies, one per theme: `isms/access-control-policy`
   (DOC-ISMS-041), `isms/remote-working-policy` (DOC-ISMS-054),
   `isms/physical-security-policy` (DOC-ISMS-055),
   `isms/secure-configuration-baseline` (DOC-ISMS-060).
5. `isms/control-framework-crosswalk` (DOC-ISMS-106) if you also work with
   SOC 2, NIST CSF or sector frameworks.

**Standard reading.** ISO/IEC 27001:2022 Annex A; ISO/IEC 27002:2022 for
the guidance and attributes.

**Practical output.** A draft Statement of Applicability for one theme,
with applicability, justification and current status for every control in
that theme.

**Self-check.**

1. Name four of the 11 controls new in 2022.
2. What is wrong with "Not applicable: we do not have this problem" as a
   justification?
3. What are the five attributes in ISO/IEC 27002:2022, and which values
   does the cybersecurity concepts attribute use?

### 6.7 M6 Support processes (5 hours)

**Outcomes.** Determine competence needs and keep evidence. Plan awareness
and communication. Control documented information: identify, format,
review, approve, distribute, protect, retain and dispose.

**Study order.**

1. `isms/iso-27001-clauses-explained`, clause 7 section.
2. `isms/isms-competence-training-matrix` (DOC-ISMS-026).
3. `security/security-awareness-program`.
4. `isms/isms-communication-plan` (DOC-ISMS-027).
5. `isms/isms-documented-information-register` (DOC-ISMS-028).
6. `compliance/controlled-document`.

**Standard reading.** ISO/IEC 27001:2022 clause 7.

**Practical output.** Competence matrix rows for three ISMS roles and one
communication plan entry covering the message, its timing, its audience
and its channel (the clause 7.4 points), plus who communicates, which is
good practice rather than a 2022 requirement).

**Self-check.**

1. What must the organisation keep as evidence for competence?
2. Name three things every person under the organisation's control must be
   aware of.
3. What is the difference between documented information the standard
   requires and documented information the organisation decides it needs?

### 6.8 M7 Operation and evidence (6 hours)

**Outcomes.** Plan and control ISMS operation, including externally
provided processes. Link every applicable control to the record that
proves it operates. Run the recurring registers that auditors sample.

**Study order.**

1. `isms/control-evidence-matrix` (DOC-ISMS-033).
2. `isms/isms-annual-calendar` (DOC-ISMS-032).
3. `isms/isms-manual` (DOC-ISMS-008).
4. `isms/isms-change-plan` (DOC-ISMS-025).
5. `isms/security-event-reporting-procedure` (DOC-ISMS-023) and
   `compliance/incident-response-plan` (DOC-ISMS-020).
6. `isms/vulnerability-remediation-tracker` (DOC-ISMS-072).
7. `isms/backup-restore-test-log` (DOC-ISMS-071).
8. `compliance/supplier-security-assessment` (DOC-ISMS-067).

**Standard reading.** ISO/IEC 27001:2022 clauses 6.3 and 8.

**Practical output.** Ten rows of the control evidence matrix for your
organisation: control, owner, record, location, frequency, last sample.

**Self-check.**

1. What does clause 8.1 expect for processes provided by external parties?
2. When must the risk assessment be repeated, apart from planned intervals?
3. Why is "we do it but do not record it" a weak position at audit?

### 6.9 M8 Measurement and management review (5 hours)

**Outcomes.** Decide what to monitor and measure, how, when and by whom,
and who analyses the results. Write measures with targets. Prepare and
minute a management review that covers every required input.

**Study order.**

1. `isms/isms-measurement-programme` (DOC-ISMS-080).
2. `compliance/objectives-register` (DOC-ISMS-024).
3. `isms/isms-performance-report` (DOC-ISMS-081).
4. `compliance/management-review` (DOC-ISMS-085).

**Standard reading.** ISO/IEC 27001:2022 clauses 6.2, 9.1 and 9.3;
ISO/IEC 27004:2016 (under revision; check for a newer edition).

**Practical output.** Three measures linked to objectives, each with a
formula, source, frequency, target and owner, and a management review
agenda that maps to the required inputs.

**Self-check.**

1. Name four inputs a management review must consider.
2. What is the difference between monitoring and measurement?
3. Which outputs of a management review must be recorded?

### 6.10 M9 Internal audit (10 hours)

**Outcomes.** Plan an audit programme based on importance of processes and
previous results. Prepare a checklist, sample evidence, write findings
that state requirement, evidence and gap, and grade them. Follow
nonconformities through correction, root cause and corrective action.

**Study order.**

1. `compliance/internal-audit-program` (DOC-ISMS-082).
2. `isms/isms-internal-audit-checklist` (DOC-ISMS-083).
3. `isms/isms-internal-audit-report` (DOC-ISMS-084).
4. `isms/audit-findings-register` (DOC-ISMS-086).
5. `compliance/capa-nonconformity` (DOC-ISMS-087).
6. `isms/continual-improvement-register` (DOC-ISMS-088).

**Standard reading.** ISO/IEC 27001:2022 clauses 9.2 and 10; ISO 19011:2026
(principles of auditing and managing an audit programme); ISO/IEC
27007:2020 (ISMS auditing guidance, under revision).

**Practical output.** A checklist and a short report for one process, for
example access rights review, with at least one finding written in the
requirement, evidence, gap format. A mentor reviews it.

**Self-check.**

1. What makes an auditor objective and impartial in practice?
2. What is the difference between a correction and a corrective action?
3. Write a one-line finding for "no evidence that leavers' accounts were
   removed within the defined time".

### 6.11 M10 Certification (5 hours)

**Outcomes.** Explain Stage 1 and Stage 2, surveillance and recertification
in the three-year cycle. Select an accredited certification body. Prepare a
Stage 1 pack and a Stage 2 evidence index. Respond to nonconformities.

**Study order.**

1. `isms/certification-audit-explained` (LRN-ISMS-07).
2. `isms/certification-body-selection` (DOC-ISMS-090).
3. `isms/stage-1-readiness-pack` (DOC-ISMS-091).
4. `isms/stage-2-audit-evidence-index` (DOC-ISMS-092).
5. `isms/certification-findings-action-plan` (DOC-ISMS-093).
6. `isms/certification-cycle-plan` (DOC-ISMS-094).
7. `isms/surveillance-readiness-health-check` (DOC-ISMS-096).

**Standard reading.** ISO/IEC 17021-1:2015 audit stages; ISO/IEC
27006-1:2024 for how certification bodies set audit time and handle
multi-site organisations.

**Practical output.** A Stage 1 readiness self-assessment for your
organisation with open gaps and dates.

**Self-check.**

1. What does Stage 1 check that Stage 2 does not?
2. How often are surveillance audits held, and when is the first one due?
3. Who sets the audit time, and on what basis?

### 6.12 M11 Capstone and self-test (8 hours)

**Outcomes.** Apply the whole path to a case from start to certificate.
Score at least the pass mark set in section 9 on the self-test.

**Study order.**

1. `isms/isms-worked-walkthrough` (LRN-ISMS-09): a full ISMS built for one
   of the library's fictional organisations.
2. `isms/isms-self-test` (LRN-ISMS-08): all sections, without notes.
3. Review any question you got wrong in the matching module.

**Practical output.** The completed walkthrough exercises and a scored
self-test entered in the learner log.

**Self-check.** The self-test is the self-check for this module.

## 7. Study methods and practical outputs

<!-- Guidance: Describe how learning happens, not only what is read. Pitfall: no mentor. Every practical output needs a second person to review it, otherwise mistakes become habits. -->

Use these methods together:

- **Read, then do.** Read the template, read the clauses, then fill the
  template for your own organisation in a sandbox copy. Mark the copy
  "training" so it is not mistaken for a controlled document.
- **Mentor review.** Each practical output is reviewed by a mentor who
  holds the target level or higher (L3 for most modules). The mentor
  records "accepted" or "rework" with one line of feedback.
- **Shadowing.** Internal auditors in training shadow at least one audit
  before leading one. ISMS managers in training sit in on one management
  review and one risk workshop.
- **Peer explanation.** The learner explains one clause or control to a
  colleague in five minutes without notes. If they cannot, they repeat the
  reading.
- **Real records.** Where safe, practical outputs become real drafts:
  a good scope statement from M3 can become the first version of
  DOC-ISMS-002 after the normal review and approval.

Practical outputs by module, with the mentor role that reviews them:

| Module | Output | Reviewed by |
|---|---|---|
| M3 | Draft scope and interested parties | ISMS manager or CISO |
| M4 | Five assessed risks | Risk owner and ISMS manager |
| M5 | SoA draft for one theme | ISMS manager |
| M7 | Ten evidence matrix rows | Control owners named in the rows |
| M9 | Audit checklist and report | Audit programme manager |
| M10 | Stage 1 self-assessment | ISMS manager or CISO |

## 8. Size tiers: how the path changes

<!-- Guidance: Show how the same path fits a small, a medium and a large organisation. Use the library's fictional settings. Figures are Example values. Pitfall: copying the large-tier plan into a small company and losing a quarter to training. -->

The tiers are the library's working tiers (small under 50 people, medium 50
to 500, large or multi-site over 500 or several sites), not official
definitions.

| Aspect | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Setting | B2B SaaS analytics, 46 staff (38 employees, 8 contractors), part-time ISMS manager (0.5 FTE, Head of Engineering Operations), certification target 6 months | Clinical scheduling, 320 staff, full-time ISMS manager plus a 3-person security team, 27001 target 10 months, 27701 the year after | Manufacturing and services, 2,400 staff, 6 sites in 4 countries, CISO with a 14-person security office, ISO 9001 and ISO 22301 already certified, target 15 months phased by site |
| Who studies what *(Example)* | ISMS manager: T3; 4 control owners: T2; CEO and CTO: T1; internal audit outsourced, so no T4 | ISMS manager: T3; security team (3): T3; 12 control owners: T2; 2 internal auditors from quality: T4; executive team: T1 | Security office (14): T3 for 4 leads, T2 for 10; 6 site coordinators: T2; internal audit pool of 8: T4; board and site directors: T1 |
| Pace *(Example)* | 77 hours over 10 weeks, about 8 hours a week alongside the day job | ISMS manager 77 hours in 6 weeks, about 13 hours a week; others over 8 weeks | Cohorts per site wave; each cohort finishes before its site joins the scope |
| Mentor | External adviser or a peer from another certified company, because no internal L3 exists yet | ISMS manager mentors the team after finishing T3 | CISO office runs the path as a programme with named mentors per site |
| Special focus | M4 and M5 on cloud controls; M10 early, because the timeline is short | M5 on privacy and supplier controls; A.5.34 and processor duties | M3 on multi-site scope and integration with the existing management system; M10 on multi-site sampling |

Worked example of the small-tier study plan (*Example* dates in 2027):

```mermaid
gantt
    title Quillmere Analytics ISMS manager study plan, Example
    dateFormat YYYY-MM-DD
    section Foundations
    M0_M1_orientation_vocabulary :a1, 2027-01-04, 7d
    M2_M3_start_context :a2, after a1, 7d
    section Risk and controls
    M4_risk :a3, after a2, 14d
    M5_annex_a :a4, after a3, 14d
    section Running the ISMS
    M6_M7_support_operation :a5, after a4, 7d
    M8_measurement_review :a6, after a5, 7d
    section Audit and certification
    M9_internal_audit :a7, after a6, 7d
    M10_M11_certification_capstone :a8, after a7, 7d
```

The plan runs ten weeks: 1 + 1 + 2 + 2 + 1 + 1 + 1 + 1 = 10 weeks, from
2027-01-04 to 2027-03-14.

## 9. Assessment and sign-off

<!-- Guidance: Set pass marks and who signs off. An auditor checks that the organisation evaluates the effectiveness of actions taken to build competence (clause 7.2 c). A score and a reviewed work product do that. -->

A module is complete when all three conditions are met:

1. The learner answered the module self-check correctly without notes, or
   corrected their answers after review and passed a second attempt.
2. The practical output was accepted by the mentor.
3. The learner log entry is filled and dated.

A track is complete when every module in it is complete and, for T3 and
T4, the learner scored at least the pass mark on `isms/isms-self-test`.

| Track | Pass mark on the self-test *(Example)* | Signed off by |
|---|---|---|
| T1 | Not required; briefing attendance and one decision exercise | ISMS manager |
| T2 | 70% on sections relevant to their controls | ISMS manager |
| T3 | 80% overall | CISO or executive sponsor |
| T4 | 80% overall and one shadowed audit | Audit programme manager |
| T5 | 70% on the risk section | ISMS manager |

Effectiveness check: three to six months after sign-off, the mentor looks
at one real work product of the learner (a risk assessment, an audit
report, an evidence record) and confirms it meets the standard expected.
Record the result in the competence matrix.

## 10. Maintaining the path

<!-- Guidance: The path depends on editions and on the templates in this library. Review it when either changes. Pitfall: training people on a superseded edition. -->

Review the path:

- once a year, at the same time as the competence and training matrix;
- when a standard it relies on changes edition (watch ISO/IEC 27003,
  ISO/IEC 27004 and ISO/IEC 27007, which are under revision as of
  2026-11-01);
- when the organisation's ISMS changes materially (new scope, new site,
  new certification standard such as ISO/IEC 27701:2025);
- after each cohort, using learner feedback and self-test results.

Keep a short change note in the revision history: what changed, why and
which learners are affected. Learners who completed a module that changed
substantially take the updated self-check.

## 11. Learner log

<!-- Guidance: One row per learner per module. Keep it in the system where the competence matrix lives so evidence is in one place. Rows marked Example show the level of detail expected. -->

| Log ID | Learner | Track | Module | Started | Completed | Self-check | Output reviewed by | Result | Notes |
|---|---|---|---|---|---|---|---|---|---|
| LRN-LOG-001 *(Example)* | [@isms-manager] | T3 | M4 | 2027-01-18 | 2027-01-29 | 3 of 3 | [@ciso] | Accepted | Five risks on the analytics platform; one moved from Medium to High after review |
| LRN-LOG-002 *(Example)* | [@platform-lead] | T2 | M5 | 2027-02-01 | 2027-02-12 | 2 of 3, second attempt 3 of 3 | [@isms-manager] | Accepted | Rework on the A.8.9 justification |
| LRN-LOG-003 *(Example)* | [@quality-auditor] | T4 | M9 | 2027-03-01 | 2027-03-12 | 3 of 3 | [@audit-programme-manager] | Rework | Findings did not state the requirement; redo with the access review audit |
| [LRN-LOG-NNN] | [@learner] | [T1 to T5] | [M0 to M11] | YYYY-MM-DD | YYYY-MM-DD | [n of 3] | [@mentor] | [Accepted / Rework / Skipped with basis] | [notes] |

## 12. Records and evidence

<!-- Guidance: Name the records that prove the competence process works. An auditor samples a role (often the ISMS manager or an internal auditor) and asks for evidence of competence. Link the control evidence matrix so the record appears in one place. -->

| Record | Proves | Kept by | Where | Retention *(Example)* |
|---|---|---|---|---|
| Learner log (section 11) | Who completed which module and when | ISMS manager | [Learning system or ISMS workspace] | Employment plus 2 years |
| Self-check and self-test scores | Knowledge was checked, not only attended | ISMS manager | [Same as above] | Employment plus 2 years |
| Reviewed practical outputs | Learner can apply the knowledge | Mentor, filed by ISMS manager | [Training folder, marked training] | Until next competence review |
| Competence and training matrix (DOC-ISMS-026) | Required competence is determined and met per role (clause 7.2) | ISMS manager with HR | [HR system or ISMS workspace] | Current version plus previous 3 years |
| Effectiveness check notes | Actions to build competence were evaluated | Mentor | [Competence matrix comments] | As the matrix |
| External course certificates | Formal training where used | HR | [HR file] | Employment plus legal retention period |

Map these records in `isms/control-evidence-matrix` (DOC-ISMS-033) against
clause 7.2, clause 7.3 and control A.6.3 (awareness, education and
training).

## 13. References

<!-- Guidance: Use only current editions and check them before each review. Links are to the ISO catalogue pages; buy the standards from ISO or your national standards body. -->

Standards (editions checked 2026-11-01):

| Standard | Edition | Link |
|---|---|---|
| ISO/IEC 27000 | 2026 | https://www.iso.org/standard/84257.html |
| ISO/IEC 27001 | 2022 + Amd 1:2024 | https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html |
| ISO/IEC 27002 | 2022 | https://www.iso.org/standard/75652.html |
| ISO/IEC 27003 | 2017 (revision in progress) | https://www.iso.org/standard/63417.html |
| ISO/IEC 27004 | 2016 (revision in progress) | https://www.iso.org/standard/64120.html |
| ISO/IEC 27005 | 2022 | https://www.iso.org/standard/80585.html |
| ISO/IEC 27006-1 | 2024 | https://www.iso.org/standard/82908.html |
| ISO/IEC 27007 | 2020 (revision in progress) | https://www.iso.org/standard/77802.html |
| ISO/IEC 27021 | 2017 + Amd 1:2021 | https://www.iso.org/standard/61003.html |
| ISO 19011 | 2026 | https://www.iso.org/standard/88984.html |
| ISO/IEC 17021-1 | 2015 | https://www.iso.org/standard/61651.html |
| ISO 31000 | 2018 | https://www.iso.org/standard/65694.html |

Related templates: `isms/isms-glossary`, `isms/iso-27001-clauses-explained`,
`isms/annex-a-organizational-controls-guide`,
`isms/annex-a-people-physical-controls-guide`,
`isms/annex-a-technological-controls-guide`,
`isms/certification-audit-explained`, `isms/isms-self-test`,
`isms/isms-worked-walkthrough`, `isms/iso-27000-family-map`,
`isms/isms-competence-training-matrix`, `isms/control-evidence-matrix`,
`security/security-awareness-program`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 7.2 and 7.3,
and informed by the competence themes of ISO/IEC 27021:2017 + Amd 1:2021.
The modules, tracks, levels, hours, self-checks and learner log are
original text. No ISO or IEC text, clauses, controls or definitions are
reproduced; you need the official standards to study and implement them.
Editions change: check the current edition of each standard on iso.org
before you rely on this path. Hours, pass marks and retention periods are
*Example* values, not requirements. This is a learning plan, not a
personnel certification scheme, and completing it does not certify a
person or an organisation. Template licence: MIT.