ISO 27001 Implementor Bootcamp
Become an ISO 27001 Implementor.
A hands-on bootcamp that takes you through building an ISMS end to end (scope, risk treatment, Statement of Applicability, policies and ISO 27002 controls), ready for certification and a real implementation role.
Choose how you learn
One bootcamp. Three ways to take it.
3Same role-based outcome. Pick the format that fits your life. Read it at your own pace with graded feedback, watch the video track, or join the live quarterly cohort.
Instructor-led
Watch the instructor teach on video: a guided track with self-checks, per-module interview prep and a hands-on lab.
In development
Self-paced
Read the full course in the portal at your own pace: lessons, graded quizzes and assignments your instructor reviews.
Available now in the Fourth Tech Hub
Live cohort
Real-time sessions with the practitioner on a quarterly schedule: accountable, interactive, and capped for attention. We open these as cohorts are scheduled.
Next cohort · To be announced
Roles this prepares you for
- ISO 27001 Implementor
- ISMS Coordinator
- GRC Analyst
- Compliance Analyst
- Security Governance Analyst
Standards & references
You'll build a portfolio of
- ISO scope statement
- Risk assessment workbook
- Statement of Applicability
- Sample policy
- Certification readiness pack
The curriculum
The 8 modules
8Introduction to ISO 27001 & ISMS
What ISO 27001 and an ISMS are, the business value of certification, and how it differs from NIST and SOC.
Context, Scope & Leadership
Clause 4–5: organizational context, interested parties, ISMS scope, leadership and policy.
Risk Assessment & Treatment
Clause 6: ISO risk methodology, criteria, risk register and treatment planning.
Statement of Applicability
Link risk to controls, inclusion/exclusion logic, and draft a defensible SoA.
Policies & Documented Information
Clause 7: policy hierarchy, core ISMS policies, records and version control.
Implementing ISO 27002 Controls
Organizational, people, physical and technological controls in practice.
ISMS Operation & Performance
Clause 8–10: running the ISMS, KPIs, management review and improvement.
Certification Readiness
Stage 1 & 2 audits, common gaps, working with auditors and maintaining certification.
The challenge
You can name the Annex A controls. Could you stand one up?
ISO 27001 is taught as a standard to be read. It is bought as a certificate to be won, and the gap between those two things is about forty documents nobody shows you how to write.
The standard is not the work
Clauses 4 to 10 are a page each. The work is deciding scope, arguing risk treatment with people who do not want it, and producing something an auditor accepts.
The Statement of Applicability is where it goes wrong
Most SoAs are a spreadsheet with 93 rows of 'applicable' and no reasoning. That is the document an auditor opens first, and it is the one that fails.
Policies nobody wrote
An ISMS runs on documents: policy, procedure, record. Writing them is a learnable skill and almost no course treats it as one.
The transformation
From reading the standard to running the management system
Foundations, then leading an implementation, then the writing the whole thing rests on.
Annex A is a list of 93 controls
You select, justify and document the ones that apply, and say why the rest do not
Scope is whatever the sales deck said
You draw a defensible boundary and can explain what it excludes
Risk assessment is a workshop you attended
You run it, own the register and take treatment decisions to the people who must sign them
A policy is a template you downloaded
You write policy, procedure and record so they agree with each other and with reality
Certification is something consultants do
You can take an organisation into a Stage 1 and know what will be asked
Describes the capabilities this programme is designed to develop. Results vary with experience and effort. Completing a programme does not guarantee employment, promotion or acceptance by any employer.
The programme in numbers
What you actually receive
41
Hours of instruction
16
Modules
61
Lessons
16
Graded quizzes
8
Marked assignments
3
Courses included
Counted from the courses this enrolment grants, not written by hand, so they cannot drift from what you receive.
- ISO 27001:2022 Lead Implementer & Auditor Bootcamp — 6 modules, 29 hours
- ISO 27001 Lead Implementer Exam Prep — 6 modules, 7 hours
- Security Policy & Documentation Writing — 4 modules, 5 hours
Curriculum
What you will study, module by module
Phase 1: The ISMS, end to end
- 1.ISO 27001 & the ISMS: Clauses 4 to 104 hours
- 2.Context, Leadership & Planning (Clauses 4-6)5 hours
- 3.Annex A & the Statement of Applicability5 hours
- 4.Operation & Implementing the Controls5 hours
- 5.Performance Evaluation & the Internal Audit5 hours
- 6.Certification, Nonconformities, CAPA & Capstone5 hours
Phase 2: Leading an implementation
- 7.ISMS Fundamentals & ISO 27001 Clauses1 hour
- 8.Context, Scope, Leadership & Planning1 hour
- 9.Risk Assessment & Treatment1 hour
- 10.Annex A Controls & the Statement of Applicability1 hour
- 11.Operation, Monitoring & Continual Improvement1 hour
- 12.Exam Readiness & Practice Exam2 hours
Phase 3: Writing the documents it runs on
- 13.The Document Hierarchy1h 15m
- 14.The Anatomy of a Good Policy1h 15m
- 15.Writing for the Audience and Getting Buy-In1h 15m
- 16.Lifecycle, Exceptions, and Framework Mapping1h 15m
Calendar
A plan that fits around work
Week 1
9 hours
- 1.ISO 27001 & the ISMS: Clauses 4 to 10
- 2.Context, Leadership & Planning (Clauses 4-6)
Week 2
5 hours
- 3.Annex A & the Statement of Applicability
Week 3
5 hours
- 4.Operation & Implementing the Controls
Week 4
10 hours
- 5.Performance Evaluation & the Internal Audit
- 6.Certification, Nonconformities, CAPA & Capstone
Week 5
5 hours
- 7.ISMS Fundamentals & ISO 27001 Clauses
- 8.Context, Scope, Leadership & Planning
- 9.Risk Assessment & Treatment
- 10.Annex A Controls & the Statement of Applicability
- 11.Operation, Monitoring & Continual Improvement
Week 6
7 hours
- 12.Exam Readiness & Practice Exam
- 13.The Document Hierarchy
- 14.The Anatomy of a Good Policy
- 15.Writing for the Audience and Getting Buy-In
- 16.Lifecycle, Exceptions, and Framework Mapping
Total 41 hours across 16 modules. Hours are the time the material is built to take, not a cap: nothing stops you going slower or faster.
Fit
Is this programme for you?
This is for you if
- You are the person who has been handed ISO 27001 and told to make it happen.
- You work in IT, security or compliance and want the implementer side rather than the audit side.
- You have read the standard and cannot yet produce the documents it calls for.
- You will do the writing. The documents are the point, and they are marked.
This is not for you if
- You want a certificate for a CV line without doing the written work.
- You need an accredited or regulator-recognised qualification. This is a Fourth Tech certificate, not an accredited award, and we say so rather than implying otherwise.
- You want the auditor's seat rather than the implementer's. That is the ISO 27001 Auditor programme, and the two are deliberately separate.
- You are looking for a Lead Implementer exam sat with an accredited body. This develops the capability; the exam is somebody else's and is bought separately.
Outcomes
What you will be able to do
- Define an ISMS scope you can defend, including what it leaves out and why
- Run an information security risk assessment and own the register that comes out of it
- Select and justify Annex A controls, and write a Statement of Applicability that survives review
- Write policy, procedure and record so the three agree with each other
- Plan and run an internal audit, and drive corrective action to closure
- Take an organisation into a certification audit knowing what will be asked
What you need
- No prior experience in the field. The programme starts from the vocabulary.
- A computer with a modern browser. The labs run in the browser, so no virtual machine and no particular operating system.
- Time for the written assignments. They are marked against a rubric, and skipping them removes the only thing that distinguishes you afterwards.
- No access to a certified organisation. Every exercise is built from public references, so nothing here depends on an employer letting you practise on their ISMS.
Your path to the certificate
- 01
Enrol
Pay once and the programme opens in your portal immediately.
- 02
Work the phases
Each phase is a complete course in its own right, sequenced so the work compounds.
- 03
Submit the assignments
Each module has a quiz marked on our server and an assignment marked against a rubric.
- 04
Build the capstone
A single piece of work across the whole programme, which becomes your portfolio centrepiece.
- 05
Earn the certificate
Issued with a unique ID and a public verification page anyone can check.
Hands-on labs
You don't watch. You do.
7Next cohort · To be announced
Secure your seat for $2,000.
You're in as soon as you pay: the full program opens in your portal right away, to work through at your own pace. When a live cohort is scheduled you'll get its day-by-day plan and sessions as well, and cohorts are capped at 20 seats.