Global

ISO/IEC 27001 and the information security management system: What every employee must know

A ready-made course you customise for your organisation, with a live session deck and two surveys. You only add the 10 details that are specific to your organisation.

See the live deckSee the full outline
Try the coursePreview the survey
Length
40 min
Lessons
6 lessons
Frequency
At onboarding
Last reviewed
21 Oct 2026
Your role and the rules
What would you do?

You want to use a free online tool to convert a file with client data

Try it: this is one of 19 interactive activities in the course.

What's included

Three pieces that work together

Copy once, get everything. Learners prepare on their own, you answer questions live, and the surveys tell you what stuck.

Self-paced course

Short lessons with real workplace scenarios, not walls of text.

  • 6 lessons, about 40 minutes
  • Scenario, process, accordion, tabs and quizzes

Live session deck

An AhaSlides presentation to run after the course, in person or online.

  • 10 slides
  • Quiz, poll, scale, word cloud slides
  • A closing slide for your contacts

Two surveys

Find out what landed, and whether people use it on the job.

  • Post-course feedback, about 2 minutes
  • 30-day check-in
  • Anonymous by default
  • Results feed your next refresher

Learning objectives

At the end of this course, learners can

Each objective and the lesson that covers it.

IDObjectiveSourceWhere it's covered
TO 199.0Achieve ≥ 80% on the final assessment-Whole course
SO 199.1Explain what an information security management system is and why the organisation has oneISO/IEC 27001 (see verification list)Whole course
SO 199.2Describe your role under the organisation's security policy + your infoOrganisation's information security policyWhole course
SO 199.3Follow the acceptable use rules and classification labels + your infoOrganisation's policiesWhole course
SO 199.4Report incidents, weaknesses and policy exceptions + your infoOrganisation's incident routeWhole course
SO 199.5Prepare for an audit conversation: what you can say and showBest practiceWhole course

Your part: what a template can't do for you

  • Your workplace details: fill in the 10 highlighted fields so the course describes your own policies, contacts and locations.
  • Records: record completion in your own LMS or record system.

Course outline

6 lessons, about 40 minutes

Minutes per lesson are an estimate, shared out by page count.

ContentInteractiveVideoYou customise
1

Why we have an ISMS

3 pages

7 min
Before you beginNoteList
The surprise audit questionTextImage
What would help?ChecklistKey factQuiz
2

What an ISMS is

3 pages

7 min
In plain wordsProcess
Policy to practiceAccordion
CheckFlashcardsMatching quiz
3

Your role and the rules

3 pages

7 min
Your partTabsYour infoYour infoYour infoYour info
Acceptable useSorting activity
Try itScenarioQuiz
4

Grey areas: exceptions, weaknesses and records

3 pages

7 min
ExceptionsAccordion
What would you do?Scenario
CheckSorting activityMulti-select quiz
5

Talking to an auditor

3 pages

7 min
PrinciplesTabs
PrepareChecklistYour infoNote
Try itScenarioQuiz
6

Your commitments and the final assessment

2 pages

5 min
Next stepsProcessYour info
PracticeQuizKey factNoteButtonYour info

Live deck and surveys

10 slides to run live, two surveys to close the loop

Pink slides are interactive. Both surveys are anonymous; pink questions are written for this course.

ContentTitle, agenda, "know your part in the ISMS
PollHave you read the security policy?
ContentThe ISMS cycle in six words
QuizAn ISMS is… A management approach with policies, risk decisions and checks ✔ · A product · IT only · An audit report
QuizAn auditor asks about a process you do not run. You… (Say so and point to the owner ✔)
ScaleHow sure are you of your role in the ISMS?
Word cloudA security rule you follow every day
Content · customiseWhere to find policy and report problems
Open-ended / Q&AA rule that is unclear to you
Content · customiseClosing {{SECURITY_CONTACT}}, {{SURVEY_1_URL}}, {{SURVEY_2_URL}}, {{COURSE_URL}}
Post-course feedback: 11 questions, about 2 min
  1. Overall rating 5 stars
  2. Relevant, realistic, right length, helpful activities agree/disagree grid
  3. What was most useful? multi-select
  4. Confidence before this course, and now 1-5 scale
  5. Which will you do first? multiple choice
  6. How confident are you talking to an auditor? 1-5 scale
  7. Which course should come next? ranking
  8. Security rules here are clear and workable. 1-5 scale
  9. One thing we should change or add open text
  10. Would you recommend this course? NPS
30-day check-in
  1. Have you used what you learned since the course? multiple choice
  2. How confident are you today? Compare with day 1 1-5 scale
  3. Do you know where to find the policy and the incident route? yes / no / not sure
  4. A moment where the training helped, or where you weren't sure open text
  5. Which topics should the next refresher focus on? ranking

Results show whether people use the training on the job, not just whether they finished it.

Make it yours

10 fields to fill in, and you're ready

Everything else is done. These are the details only your organisation knows; each one is highlighted inside the course.

  • Who staff ask about security questions{{SECURITY_CONTACT}}
  • Link to your information security policy{{SECURITY_POLICY_LINK}}
  • The route for reporting a security incident or suspected breach, and the time limit that applies{{INCIDENT_REPORT_ROUTE}}
  • Link to your data classification policy{{DATA_CLASSIFICATION_POLICY_LINK}}
  • Link to the list of approved tools and services{{APPROVED_TOOLS_LIST}}
  • Link to the next course in your security awareness path{{NEXT_COURSE_LINK}}
Show all 10 fields
  • Where course completions are recorded{{LMS_OR_RECORD_SYSTEM}}
  • Link to the self-paced course{{COURSE_URL}}
  • Link to the baseline survey{{SURVEY_1_URL}}
  • Link to the post-course and 30-day survey{{SURVEY_2_URL}}

FAQ

Common questions

Can I run ISO/IEC 27001 and the information security management system: What every employee must know training online?

The course itself is self-paced and online, and the live deck lets you add a live session. Whether online delivery meets your local rules depends on the law that applies to you, so check the rules that apply to you or ask your own counsel.

How often is this training needed?

At onboarding, before a certification or surveillance audit, and annually.

Who needs this training?

Staff in organisations that hold or pursue an ISMS certification; an internal-auditor variant is a note; run by L&D with the information security manager.

What records should I keep?

Record completion in your own LMS or record system, so you can show who finished the course and when. Check the retention period that applies to you in the rules that apply to you.

Can I edit the content?

Yes, everything. Change the wording, swap scenarios for ones from your workplace, add your logo, or remove parts that don't apply. Keep anything your own law requires you to cover.

Related templates

Often taught together

All Governance and risk templates →
Global

Cyber risk governance for managers and boards

Executives · Governance and risk

40 min
Global

Cyber incident response and breach reporting for non-specialists

All staff · Governance and risk

35 min
Last reviewed: 21 October 2026Templates are a starting point, not legal advice.

Ready to run it?

Open the live deck to see how the session runs alongside the course and both surveys.

See the live deck