Certified instructor and I just wanted to tell you a little bit about my background. So as you might be able to pick up from the accent, I'm based in the UK specifically I live near a city called York in the northeast of England. A little bit of background about myself from a career point of view. So I've been in and around technology and specifically information security since around around about the year 2000. I started life in the technical side of IT, doing IT support, so desktop and server support. Later on I moved into networking, spent a few years in that space where I got a real interest in security through implementing things like intrusion detection systems. Systems, firewalls, etc. Then she moved into more of the management side of security and worked for a number of years for the National Health Service in the UK, implementing standards like What at the time was BS7799, so the forerunner to ISO 2701. Since then I've worked for a couple of very large IT outsources and providing services to customers, doing things like ISO implementations, PCI DSS, developing security architectures and policies. And since then basically I now essentially work as a consultant, so I have clients that I'm still helping. implement security standards and frameworks. I also spend a bit of time as an auditor conducting audits against a number of ISO standards and of course as a trainer with a doing a lot of work with PCB like these courses Um so I hope to bring some useful knowledge and experience in the uh courses I'm delivering. Welcome to this ISO 270001 Lead Auditor course I just wanted to tell you a little bit about the training and its aims. So the aim of the lead auditor course is to give you a good introduction to the ISO 27001 standard, to give you an overview of how that works and the overview of a an information security management system but with a focus on actually auditing an existing management system. So throughout the course we'll look at key things like audit principles, procedures and processes And then basically we'll take you through the steps of initiating an audit, right through to making audit conclusions, and also we'll take you through what happens after the audit. We'll look at this from an external perspective, so we'll also uh uh examine how certification bodies operate and your role as a lead auditor within that. Okay, so in this section we're going to examine the certification process for ISO standards. So specifically we'll look at the process itself. We look at something called the certification scheme and then we're going to look at the role of two very important organisations in this process which are accreditation bodies And certification bodies, and we'll have a look at the difference with each and the purpose and the role that they play. So the first thing to take a look at here is this diagram that outlines the certification process. As I'll explain in a moment, this is the certification process that would be followed by what we call accredited certification bodies. So let's just have a look at this. So let's imagine we have an organization that wants to be certified To ISO 2701. First of all, of course, before any audit, they're going to implement their ISMS But not only implement it, the organization will need to check that its own ISMS is working effectively by implementing and conducting internal audits. and having the management review conducted as well. So let's imagine an organization has implemented its ISMS, it's had its internal audit and management review. At that point the organization will need to choose an organization called a certification body. We'll have a discussion on those in just a moment. Let's imagine the organization selected its certification body. We then have, for the very first time, an organization is going for certification, something called the initial audit So the organization of course will prepare for this initial audit. There is an option, but it is completely optional, to have what's known as a pre-audit. a situation where a cert body can do an initial review to see if the organisation is ready for the actual audit, so to speak. That's an entirely optional thing. But the first part of an actual initial audit is what we call the stage one audit. What I tell people in a stage one audit it's typically about 30%. of the overall audit time is spent at stage one. And the purpose of stage one is to allow the certification body and the audit team to get familiar with the organisation and to validate that the basics of the management system are in place. such as the key documentation, some of the key processes that are required. So let's for now just assume that everything goes well at stage one and we then move to stage two and there's usually a gap between stage one and two Which typically is about two to four weeks, although that can differ, but the idea of that gap is to allow for preparation for stage two And stage two is what I call the detailed audit. This is where the auditors are looking beyond the basics of the management system, but looking for real evidence that the controls, for example, that are implemented are really working. And during this course we will get into both stage one and two and the kind of activities as auditors we need to be performing. Now it says in the diagram here on-site audit. That might vary depending on the nature of the organization, but typically it is certainly an in-depth audit. Now, after the stage two is done, depending on the recommendation made by the lead auditor, a couple of things could happen. One of those is if the audit uncovers what we call non-conformities, it might, not always, because it depends on circumstances, but it might be be required to conduct something called a follow-up audit And a follow-up audit is where an organization is given the opportunity, for example, to address a non-conformity, and the auditor will essentially come back at some point in time and validate that that non-conformity has being addressed. Again, we'll get into the details of the process and when a follow-up is necessary and when it isn't, but that could happen in some cases. In some cases that won't be necessary at all. But let's imagine that the organisation has implemented its management system, has had a successful stage one and two audit It's at that point where, of course, the auditor could make a recommendation for certification and the certification body if they're satisfied that the audit has been conducted correctly. After a quality review of the audit report, it is the certification body who will ultimately issue the certificate to the organisation and certify their management system. And as we'll explain in more depth as we progress through the course, when an organization gets certified, they get certified for a period of three years, and every year in between there'll be what we call a surveillance audit. The certification body will validate that the organization maintained its management system. So during this course we'll look in depth at all these procedures, but for now I just want to give you that sort of high-level overview, if you like. So the question then becomes, well, who are the key players in a certification audit? You know, who is doing what? And actually this diagram here that lays out the certification scheme is a really useful one to understand the position. So what I want to start off by talking about is the role of what we call a conformity assessment body or certification body. Now there are multiple types of certification bodies that do different things. So for example, PCB are what we would call a personal certification body So they certify individuals. So when you take your PCB Lead Auditor exam, for example, and you pass that, it's PCB who will award you as an individual professional your certificate. But in this discussion, we're really focused on a different type of conformity assessment body called management system certification bodies. So a management system certification body is usually, not always, but usually a profit-making organization. There are some that are not. And their job basically is to go out and conduct audits of management systems to ultimately certify organizations against various management systems. System standards. And there are many conformity assessment or management system certification bodies operating. And so the question you might ask is: okay, well, if we've got a management system certification body issuing certificates, how do we know that the certificates that they're issuing are credible, that they'll be recognized by people And how do we know that the certification body is trustworthy and professional? And all these very important questions. So to answer that question, there is a standard that certification bodies can follow, and that's called ISO 17021 And this standard lays out various rules about how certification bodies operate to ensure that they're operating in a credible, trustworthy and professional manner. Those certification bodies can themselves be audited by a separate organisation. And that separate organisation I'm speaking about is something called an accreditation body. So around the world in most countries there is usually one and one only accreditation body which is usually appointed by government and their job is essentially to supervise the activity. of certification bodies. Now I say usually there's one and one only. That does differ for the US who have three or four essentially, but in most countries there's one. And so the idea is: let's imagine I went away tomorrow and decided to set up a management system certification body. If I wanted to issue certificates that were valid, recognized, and trustworthy I'd need to implement ISO 17021. If I want to issue ISO 27001 certificates, I'd also need to implement another standard called ISO 27006. which lays out how certification bodies who issue ISO 27001 certificates need to operate. And then what we'd need to do is we need to go and approach an accreditation body and ask them to audit us and accredit us. So the key thing here is certification bodies get accredited by accreditation bodies certification bodies certify organizations management systems. Now it's really important to note that if an organization chooses a certification body that is not accredited, then you could argue that the certification they're issuing is worth precisely zero. And we have to be careful with this because Whenever you're selecting a certification body, it's always important to ask them, are they accredited to issue ISO 27001 certificates? i. e. , are they accredited under ISO 17021 and ISO? or 27,006. Second question is who are they accredited by? Now this is the important point. So I said that around the world in most countries there's one and one only accreditation body So how do you know who that accreditation body is so that you can actually check that the certification body is properly accredited? Well there is an organization called the International Accreditation Forum And you can find their website, it's www. ieaf. nu. If you go to that website and look under members and signatories, you can search by country So you can find in each country who the national accreditation body is for that country. So if somebody tells you we are accredited by UCAS in the UK, Well I could tell you straight away that's genuine, but of course you could go to the IAF website and check that it is indeed UCAS and then you could go to the UCAS website and see whether that certification body is listed. One important point to make about this is it's not a requirement for the certification body to be accredited in every single country in which it operates. Let's imagine a large certification body that operates all over the world. It wouldn't make a lot of sense if they had to be audited in every single country they operated in. So the IAF does have this thing, the International Accreditation Forum Called multilateral recognition. So for example, a few years ago I used to work for a German certification body who operated in the UK and they were accredited in Germany by DAX, which is the German accreditation authority. But those certificates were recognized in the UK because DAX and UCAS, which is the UK equivalent, are both members of the IAF and both sign that multilateral recognition agreement. So that's also something to note. So the main important point that I'm trying to get across here is select a certification body that is accredited by a member of the International Accreditation Forum. Uh and my final sort of word on that is do be careful to check those things because unfortunately, as I've experienced, there are certification bodies operating who are not properly accredited and I've even seen cases where there are some certification bodies who claim to be accredited, but then they're accredited by organizations that are not members of the IAF. In any of those circumstances It's unfortunately a case that that certificate may not be recognized. So just make sure when you're investing you can you know work well with the certification body in question So in summary then, what we've confirmed is there's a formal certification process that exists A certification body that is accredited based on what we've discussed in this section will follow the process that we presented at the start of the section. That is to say, conducting a stage one and stage two audit, and they will certify an organization assuming they're successful for a period of three years. Certification bodies certify management systems and the standards they should be following are ISO 17021 and ISO 27006 and accreditation bodies are the organisations who supervise the activity. of certification bodies and we should always select an accredited certification body to have an assurance about the audit process and the credibility of the certificate that's going to be Be issued.