Information Security Officer (DEKRA)

In the training to become an Information Security Officer, you learn how to build an information security management system according to ISO 27001. The course runs over three days live-online. The scope is 24 learning units of 45 minutes each. At the end, there is the certification exam to become an Information Security Officer (DEKRA).

Content-wise, you start with the basics of information security. Standards and norms such as ISO/IEC 27001, BSI Grundschutz, and NIS-2 come up early. Terms, principles, and objectives of an ISMS are clarified. Threats and attack methods are also part of it.

After that, it's about legal and regulatory requirements. The provider covers the interfaces of data protection and GDPR with information security. According to the course page, there is a complete separate chapter on the NIS-2 directive. Other IT security laws are addressed.

The practical part revolves around planning and building an ISMS according to ISO 27001. You assess risks according to ISO 27005 and define security objectives and policies. Technical and organizational measures, internal audit, and emergency management are added. Dealing with security incidents and cyber attacks is also covered.

The methodology mixes trainer input, exercises, discussion, and experience exchange. You receive work aids, checklists, and templates. For exam preparation, there is a free e-learning for learning assessment. Reflection and feedback take place in small groups and in plenary.

The training is aimed at IT managers, data protection officers, managers, and executives. Beginners in information security are explicitly addressed. You don't need any special prior knowledge. Technical understanding from IT or data protection helps, but is not mandatory.

After passing the exam, you can use the DEKRA seal for free. It works as a digital certificate of participation on business cards, in signatures, and on LinkedIn. If you are still undecided, you can reserve a seminar seat for two weeks free of charge. I find that practical when the cost coverage is still being clarified internally.

• Basics of information security
• Introduction to standards and norms, especially ISO/IEC 27001, BSI Grundschutz, NIS-2
• Terms, principles and objectives of an Information Security Management System (ISMS)
• Threats and attack methodologies
• Importance of IT security
• Legal and regulatory requirements
• Data protection and GDPR: interfaces with information security
• Requirements of BSI Grundschutz and other standards
• NIS-2 directive and other IT security laws
• Planning and building an Information Security Management System (ISMS) according to ISO 27001
• Introduction to the ISO 27000 family
• Structure, benefits, implementation of ISO 27001, ISO 27002
• The role of the Information Security Officer (ISB) in the company
• Organization of information security
• Identification and assessment of risks: risk analysis according to ISO 27005
• Definition of security objectives and policies
• Implementation and monitoring of security measures
• Technical and organizational measures (TOMs)
• Internal audit and certification preparation according to ISO 27001
• Emergency management and Business Continuity Management (BCM)