1. Regular Trainings

1.1 Essential Services Manager / Auditor

Duration: 3 days
Training format: Online Training, French/English
Ideal attendee profile: CISO, Security Auditor, CIO, Security Specialist, Security Manager

Course objectives:

• The training allows you to understand:
• Essential services, goals and risks;
• Compliance, ISMS and BCMS requirements;
• goals, implementation challenges and operation of ISMS, BCMS and Incident Response Team in an organization;
• IT risk governance framework and risk management process;
• roles of high management, operational management as well of internal audit department;
• common issues related to the design and operation of business continuity plan, incident Response Team and information security controls are presented and discussed;
• certification process.

This course covers issues through Togolese regulations and the ISO / IEC 27000 and 22301 family of standards.

Target Audience:

The training is addressed to persons:

• accountable for essential services, information processing, information security, continuity, Incident Management, compliance as well as for the management system in organization;
• responsible for information technology, information security, business continuity and incident response;
• delivering professional assurance by IT audit, IT risk management or Information security processes.

Course content for 3 days:

• Essential services;
• ISO Management Systems;
• Information Security and continuity – vocabulary;
• ISO Management System – architecture;
• Goals of compliance, ISO management systems, continuity and of information security;
• Risk management and risk management in essential services;
• Notification;
• Requirements;
• Implementation;
• Maintenance;
• Monitoring, Auditing, reporting.

Other Information:

Training method: on-line presentation, questions and answers – Webex Training Platform.
Training materials: each participant receives a set of electronic training materials.
Certification: participants receive an electronic diploma from Asseco Academy.

1.2 Implementing information security policy in organization

Duration: 5 days
Training format: Online / Onsite training, English/French
Ideal attendee profile: CISO, Security Auditor, CIO, Security Manager, Information Security Officers

Day I – Base of information security

1. Preview – How to implement Information Security (IS) main technics:
   • Security audit/ Gap Analysis;
   • Penetration tests;
   • Risk Management;
   • Technical controls implementing (needs versus costs), types of controls;
   • Information Security Policy (ISP) creation and modification;
   • Incident response process;
   • Permanent management of IS – continuity of above-mentioned technics and improvement;
   • Relation to other ICT management processes (IT service management, Business Continuity Management).
2. Compliance requirement:
   • Example of law existing in Togo and EU (GDPR, National cybersecurity system Act, business information protection);
   • Example of industry recommendations/requirements (PCI DSS).
3. Review of most popular IS standards:
   • ISO/IEC 27001 – Information technology — Security techniques — Information security management systems — Requirements;
   • ISO/IEC 27002 – Information technology — Security techniques — Code of practice for information security controls;
   • ISO/IEC 27005 – Information technology – Security techniques – Information security risk management;
   • ISO/IEC 29134 Information technology – Security techniques – Guidelines for privacy impact assessment;
   • ENISA Guidelines on assessing DSP and OES compliance to the NISD security requirements;
   • OWASP Top 10.

Day II – Security Audit and Risk Management – 2 sides of the same coin

1. ISO 19011 and ISO 17021 – base of auditing:
   • Main audit rules, technics, risks and traps;
   • How to create audit plan base on ISO/IEC 27001 using ISO/IEC 27006 recommendation.
2. Risk Management approach recommended in ISO/IEC 27005 (assets, threats, vulnerabilities, strength of controls, impacts, probability of incidents).
3. Risk Management approach recommended in ISO/IEC 29134.
4. Review of risk assessment procedure (based on ISO/IEC 27005).
5. Review of risk treatment procedure (based on ISO/IEC 27005).
6. Review of Excel spreadsheet used to risk assessment and risk treatment.
7. Review of risk management tools.

Day III – Practice of audit and risk management

1. Organization definition for following exercises – type of activity, stakeholders, law, relation with customers and suppliers, organization structure.
2. Exercise 1 – creation of audit plan and audit checklist.
3. Evaluation and discussion.
4. Exercise 2 – performing of risk assessment base of proposed Excel spreadsheet:
   • Risk analysis;
   • Risk evaluation.
5. Evaluation and discussion.
6. Exercise 3 – performing risk treatment.
7. Evaluation and discussion.

Day IV – Information Security Policy

1. Hierarchy of ISP document – policies, standards, guidelines, procedures, instructions. How to fit ISP to current customer.
2. Examples of ISP Declaration.
3. Example of ICT Security Policy.
4. Example of User Security Policy.
5. Process approach:
   • Access management;
   • Monitoring process;
   • Security incident management;
   • Change management;
   • Configuration management;
   • Business continuity management;
   • Compliance management;
   • Security Audit & Penetration Testing;
   • Asset identification and classification;
   • Human resources management;
   • ISP documentation management.
6. Examples of procedures/standards e.g.:
   • User access management procedure;
   • SIEM monitoring procedure;
   • Security events reporting procedure;
   • Security incidents & breach response procedure;
   • Change management procedure (several type of changes);
   • Configuration documentation procedure;
   • Backup procedure with technical instructions;
   • Security audit planning and documentation procedure;
   • Classification standard;
   • ISP change management procedure.

Day V – Practice of ISP creation

1. Organization definition for exercise – type of activity, stakeholders, law, relation with customers, organization structure.
2. Exercise – Creation ISP documents by students:
   • ISP document;
   • Procedures.
3. Evaluation and discussion.