ISO/IEC 27002 Manager

Foundation provides orientation; Manager focuses more closely on selecting and managing controls. That application matters when you help develop access arrangements or supplier controls. Your current responsibilities are a useful basis for discussing the appropriate course level with us before you book.

Start with important business activities and plausible loss scenarios. Then consider which safeguards reduce those risks and can be operated reliably. A defensible priority list also identifies owners, effort and remaining issues; purchasing another security tool does not answer those questions by itself.

A policy describes an expectation but does not automatically prove implementation. Also consider actual transactions, responsibilities and exceptions. For an access control, approvals and periodic reviews may provide more meaningful evidence than the mere existence of a document carrying the expected title.

Choose a person or function able to make decisions and influence implementation in the relevant process. Information security can advise and coordinate without operating every control itself. Also agree who provides cover, which evidence is retained and how departures from the agreed process are handled.

Yes, when controls are adapted to its size and working methods. A straightforward approval with clear ownership can be more useful than a complicated process nobody follows. Small does not automatically mean low risk: critical information and services still need dependable safeguards in a small team.

Some operational work moves to a service provider, but internal decisions and coordination are still needed. Clarify who approves access, receives security notifications and reviews evidence. Describe handovers between organisations explicitly so that an important task does not fall between the parties involved.

Passing the examination and obtaining a particular credential are separate steps. PECB also considers professional and activity experience for the Manager credential; a different level may initially fit your circumstances. Establish which evidence you can actually provide before the course rather than starting to collect it afterwards.

Bring an anonymised process where ownership or effectiveness is unclear. Examples include access rights after a role change or oversight of external access. Describe a concrete objective and the current difficulty; this makes it easier to discuss how the course concepts apply to your work.