ISO 27001 Training & Awareness

Train your key people about ISO 27001 requirements and provide cybersecurity awareness training to all of your employees.

ISO 27001 Training & Awareness - Advisera

The quickest route to company-wide training

A set of 100 videos that explain all aspects of ISO 27001, and cover all key topics for cybersecurity hygiene — configure the whole training & awareness program in a couple of minutes, and enable each employee to watch videos on their devices.

On the left-hand side, you can see one of the videos from the ISO 27001 Training & Awareness available in Advisera’s Company Training Account.

ISO 27001 lessons library

  • What is ISO 27001? (1:02)
    Learn about the basics of the leading cybersecurity standard
    Whole ISO 27001
  • The structure of ISO 27001 (2:01)
    ISO 27001 main clauses and their purpose
    Whole ISO 27001
  • Information security principles used in ISO 27001 (2:07)
    An example of confidentiality, integrity, and availability in practice
    Whole ISO 27001
  • ISO 27001: Introduction to the ISMS (2:22)
    The purpose of an Information Security Management System
    Whole ISO 27001
  • Key roles in ISO 27001 implementation (1:07)
    Roles of the project manager, security officer, and senior management
    Whole ISO 27001
  • Documenting ISO 27001 requirements (2:55)
    Mandatory and non-mandatory documents
    Whole ISO 27001
  • Implementing ISO 27001 requirements (2:13)
    Using the PDCA cycle as guidance for implementation
    Whole ISO 27001
  • ISO 27001 Benefits (2:02)
    4 key benefits: compliance, marketing, costs, and better organization
    Whole ISO 27001
  • ISO 27001: Understanding your organization and its context (2:03)
    Analyzing internal and external issues
    ISO 27001 clause 4.1
  • ISO 27001: Understanding the needs and expectations of interested parties (1:35)
    Who are interested parties, and what are their requirements?
    ISO 27001 clause 4.2
  • ISO 27001: Determining the scope of the ISMS (1:50)
    What is the ISMS scope, and why is it important?
    ISO 27001 clause 4.3
  • ISO 27001: Leadership and commitment (1:45)
    Key senior management activities that represent commitment
    ISO 27001 clause 5.1
  • ISO 27001: Information Security Policy (1:13)
    Mandatory elements of this top-level policy
    ISO 27001 clause 5.2
  • ISO 27001: Organizational roles, responsibilities, and authorities (2:14)
    Which roles are mandatory according to ISO 27001?
    ISO 27001 clause 5.3
  • ISO 27001: Information security objectives (2:14)
    Why are objectives important, and how to define them?
    ISO 27001 clause 6.2
  • ISO 27001: Resources (1:40)
    Example of resources and how to document them
    ISO 27001 clause 7.1
  • ISO 27001: Competence (1:22)
    The options to acquire required skills and knowledge
    ISO 27001 clause 7.2
  • ISO 27001: Awareness (1:23)
    How to organize security awareness in a company
    ISO 27001 clause 7.3
  • ISO 27001: Communication (1:24)
    What kind of communication is required, and why is it important?
    ISO 27001 clause 7.4
  • ISO 27001: Documented information (3:12)
    Creating, updating, and controlling policies, procedures, and records
    ISO 27001 clause 7.5
  • ISO 27001: Addressing risks and opportunities (1:46)
    The basics of risk management
    ISO 27001 clause 6.1.1
  • ISO 27001: Risk management process (2:15)
    Five key steps to assess and treat risks
    ISO 27001 clause 6.1.2, ISO 27001 clause 6.1.3
  • ISO 27001: Information security risk assessment – Risk identification (3:03)
    Risk identification, risk analysis, and risk evaluation
    ISO 27001 clause 6.1.2
  • ISO 27001: Information security risk assessment – Risk analysis and evaluation (2:40)
    Using scales to assess impact and likelihood
    SO 27001 clause 6.1.2
  • ISO 27001: Information security risk treatment (0:00)
    Four most common options for treating risks
    ISO 27001 clause 6.1.3
  • ISO 27001: Statement of Applicability (1:59)
    The purpose and structure of the SoA
    ISO 27001 clause 6.1.3
  • ISO 27001: Formulating the risk treatment plan (1:49)
    The purpose and mandatory elements of the RTP
    ISO 27001 clause 6.1.3
  • ISO 27001: Implementing the risk treatment plan (1:15)
    Key elements of implementation and how to document results
    ISO 27001 clause 8.3
  • ISO 27001: Operational planning and control (2:18)
    Key elements of the Do phase in the PDCA cycle
    ISO 27001 clause 8.1
  • ISO 27001: Operating the ISMS (1:18)
    What does operating the ISMS mean?
    ISO 27001 clause 8
  • ISO 27001: Managing outsourcing of operations (1:57)
    Examples of security controls for outsourcing activities
    ISO 27001 clause 8.1
  • ISO 27001: Controlling changes (1:58)
    An example of a change management procedure
    ISO 27001 clause 8.1
  • ISO 27001: Risk assessment review (1:46)
    Why is risk review important, and how often to perform it?
    ISO 27001 clause 8.2
  • ISO 27001: Monitoring, measurement, analysis, and evaluation (3:13)
    Key elements for evaluating the performance of the ISMS
    ISO 27001 clause 9.1
  • ISO 27001: Internal audit (2:35)
    Key elements of an internal audit
    ISO 27001 clause 9.2
  • ISO 27001: Management review (2:30)
    Inputs and outputs for the management review meeting
    ISO 27001 clause 9.3
  • ISO 27001: Nonconformities and corrective actions (3:22)
    Required actions when a nonconformity occurs
    ISO 27001 clause 10.2
  • ISO 27001: Continual improvement (2:19)
    Examples of improvement initiatives
    ISO 27001 clause 10.2
  • ISO 27001: Introduction to Annex A (5:18)
    The purpose and structure of Annex A
    ISO 27001 Annex A
  • ISO 27001: People controls (2:05)
    Overview of Annex A.6 – Controls before, during, and after employment
    ISO 27001 Annex A section A.6
  • ISO 27001: Physical controls (3:37)
    Overview of Annex A.7 – Securing physical areas and equipment
    ISO 27001 Annex A section A.7
  • ISO 27001: Technological controls – overview and new controls (4:13)
    Overview of Annex A section A.8 – Technological controls
    ISO 27001 Annex A section A.8
  • ISO 27001: Technological controls – software development (2:51)
    Controls that cover architecture, lifecycle, testing, and coding principles
    ISO 27001 Annex A section A.8
  • ISO 27001: Organizational controls – operational security (2:43)
    Controls for access control, information transfer, operating procedures, etc.
    ISO 27001 Annex A section A.5
  • ISO 27001: Organizational controls – policies and responsibilities (3:22)
    Controls for roles, segregation of duties, contact with external parties, etc.
    ISO 27001 Annex A section A.5
  • ISO 27001: Organizational controls – information and asset management (1:52)
    Controls for asset inventory, acceptable use, classification, etc.
    ISO 27001 Annex A section A.5
  • ISO 27001: Technological controls – operational security (4:48)
    Controls that cover security in day-to-day IT activities
    ISO 27001 Annex A section A.8
  • ISO 27001: Organizational controls – supplier security (3:14)
    Controls for assessing risks, contractual requirements, monitoring, etc.
    ISO 27001 Annex A section A.5
  • ISO 27001: Organizational controls – incidents and business continuity (4:52)
    Controls to deal with threats, events, incidents, and larger disruptions
    ISO 27001 Annex A section A.5
  • ISO 27001: Organizational controls - compliance, privacy, and legal aspects of security (2:49)
    Controls that ensure security is compliant with legal requirements
    ISO 27001 Annex A section A.5
  • Remote Work (4:37)
    Risks when working outside of office premises
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 controls A.5.10, A.6.7, A.7.8, A.7.9
  • The Mind of a Hacker (5:42)
    3 types of hackers and how to protect yourself
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 control A.6.3
  • Security in Acquisition, Development, and Maintenance (12:15)
    Cybersecurity in the IT system lifecycle
    NIS 2 article 21 paragraph 2 point (e), ISO 27001 controls A.8.25, A.8.26, A.8.27, A.8.28, A.8.29, A.8.30, A.8.31, A.8.33
  • Secure Communications (13:32)
    Securing voice, video, and text communication channels
    NIS 2 article 21 paragraph 2 point (j), ISO 27001 controls A.8.20, A.8.21
  • Privacy (4:36)
    8 privacy principles everyone should know
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 controls A.5.33, A.5.34
  • Passwords (5:30)
    Creating and keeping passwords secure
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 control A.5.17
  • Social Media (5:24)
    Main cyber risks when using Facebook, X, LinkedIn, and others
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 controls A.5.10, A.5.14
  • Protecting Paperwork (6:35)
    Vulnerabilities of paper media, and methods of protecting it
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 controls A.5.10, A.5.33, A.7.5, A.7.7
  • Basic Cyber Hygiene Practices (4:47)
    Essential cybersecurity measures for every user
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 controls A.5.10, A.8.1
  • Handling Cybersecurity Incidents (6:16)
    How to spot and react promptly to cybersecurity concerns
    NIS 2 article 21 paragraph 2 point (b), ISO 27001 controls A.5.24, A.5.25, A.5.26
  • Backup Basics (4:36)
    Recovery from data loss
    NIS 2 article 21 paragraph 2 point (c), ISO 27001 control A.8.13
  • Business Continuity (9:40)
    Resilience and recovery arrangements
    NIS 2 article 21 paragraph 2 point (c), ISO 27001 controls A.5.29, A.5.30, A.8.13, A.8.14
  • Basics of Authentication (6:05)
    Preventing unauthorized access to digital assets
    NIS 2 article 21 paragraph 2 point (j), ISO 27001 control A.8.5
  • Disaster Recovery (8:38)
    How to recover information systems and data
    NIS 2 article 21 paragraph 2 point (c), ISO 27001 control A.5.30, A.8.14
  • Cryptography (10:39)
    Cryptographic concepts and their application
    NIS 2 article 21 paragraph 2 point (h), ISO 27001 control A.8.24
  • Access Control (6:07)
    Permitting appropriate access and preventing inappropriate access
    NIS 2 article 21 paragraph 2 point (i), ISO 27001 controls A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, A.8.3, A.8.4, A.8.5
  • Basics of Network Security (6:43)
    Securing digital networks and data communications
    NIS 2 article 21 paragraph 2, ISO 27001 control A.8.20
  • Cyber Asset Management (7:22)
    Identifying, classifying, securing, and exploiting digital assets
    NIS 2 article 21 paragraph 2 point (i), ISO 27001 controls A.5.9
  • Emergency Communications (6:30)
    Setting up alternative communication methods
    NIS 2 article 21 paragraph 2 point (j), ISO 27001 clause 7.4 and controls A.5.14, A.8.14
  • Cybersecurity Training and Awareness (11:33)
    Creating a program for continuous training and awareness
    NIS 2 article 20 paragraph 2, article 21 paragraph 2 point (i), ISO 27001 clauses 7.2, 7.3; control A.6.3
  • Information Risk Management (8:29)
    Risk assessment and treatment as a foundation of cybersecurity
    NIS 2 article 20 paragraph 1, article 21 paragraph 1, paragraph 2 point (a), ISO 27001 clauses 6.1, 8.2, 8.3
  • Assessing Supplier Security (12:46)
    Supplier vulnerabilities, quality, and secure development
    NIS 2 article 21 paragraph 2 point (d), paragraph 3, ISO 27001 controls A.5.19, A.5.20, A.5.21, A.5.22
  • Human Resources Security (12:57)
    Activities before, during, and after employment
    NIS 2 article 21 paragraph 2 point (i), ISO 27001 clauses 7.2, 7.3; controls A.6.1, A.6.2, A.6.3, A.6.4, A.6.5
  • Measuring Cybersecurity (7:59)
    Assessing the effectiveness of risk management
    NIS 2 Article 20 paragraph 1, Article 21 paragraph 2 point (f), ISO 27001 clause 9.1
  • Corrective Actions (8:02)
    How to eliminate the cause of nonconformities
    NIS 2 article 21 paragraph 4, ISO 27001 clause 10.2
  • Management’s Role in Cybersecurity (7:34)
    Tasks for senior and mid-level management
    NIS 2 article 20 paragraph 1, ISO 27001 clause 5.1
  • Insider Threats (6:30)
    Managing insiders with access to sensitive information
    NIS 2 article 21 paragraph 2 point (i), ISO 27001 controls A.5.15, A.5.33, A.5.35, A.6.1, A.8.2, A.8.16
  • Cloud Security Basics (5:38)
    Securing data when using cloud services
    NIS 2 article 21 paragraph 2 point (d), ISO 27001 controls A.5.23
  • Computer Malware (4:58)
    Phishing, ransomware, and spyware
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 control A.8.7
  • Email Security (4:08)
    Risks related to the usage of email
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 control A.5.14
  • Human Error (4:33)
    Reducing mistakes with sensitive information
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 control A.6.3
  • Identity Theft (4:58)
    How do cybercriminals steal your identity?
    NIS 2 article 21 paragraph 2 points (i) and (j), ISO 27001 controls A.5.16, A.5.17, A.8.5
  • Device Physical Security (5:52)
    Physically securing information and devices
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 controls A.7.5, A.7.8, A.7.9, A.7.10, A.8.1
  • Intellectual Property (5:36)
    Technical, legal, and organizational methods of protecting IPR
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 control A.5.32
  • Security of Mobile Devices (5:30)
    Protecting laptops, tablets, smartphones, and other devices
    NIS 2 article 21 paragraph 2 points (g) and (j), ISO 27001 controls A.5.10, A.5.17, A.6.7, A.7.8, A.7.9, A.7.10, A.8.1, A.8.5, A.8.7
  • Social Engineering (6:02)
    The most common methods criminals are using to access your account
    NIS 2 article 21 paragraph 2 point (g), ISO 27001 control A.5.10
  • Managing Supplier Security (6:32)
    Risks related to vendors and contractors, and how to handle them
    NIS 2 article 21 paragraph 2 point (d), ISO 27001 controls A.5.19, A.5.20, A.5.21, A.5.22, A.5.23

Training adjustable for different audiences

Instead of showing the same videos to everyone, you can configure the system so that senior management will see only the videos appropriate for them, IT employees will see different videos, the rest of the employees something else, etc.

Advisera’s Company Training Account will suggest the most appropriate videos for different audiences, but you’re in control — you define who gets to see what.

ISO 27001 Training & Awareness - Advisera
ISO 27001 Training & Awareness - Advisera

Automate training delivery and tracking

You don’t have to torture yourself with organizing a live training that lasts longer than anyone wants to attend. Instead, use Advisera’s Company Training Account to define how often employees need to watch videos, automatically send email invitations to watch them, track who watched each video, send reminders, and create attendance reports for audit purposes.

Made for easy learning

Let’s face it — people don’t have time to learn about cybersecurity, and most have a hard time understanding techy or lawyer language.

This is why our videos are between 2 and 10 minutes long, and our ISO 27001 experts explain the topics using easy-to-understand language.

ISO 27001 Training & Awareness - Advisera

Several languages available

We’re translating the videos into all major languages of the European Union, so that any employee in your company can easily understand them.

Country-specific videos

Each EU country must publish its own cybersecurity laws and regulations — we will create videos for those specific requirements so that your employees learn what is required in your country.

ISO 27001 Training & Awareness - Advisera

Custom-made videos

Do you have specific cybersecurity policies or procedures that you’d like to present in a video? No problem! As part of selected plans, we can create custom videos exclusively for your company — personalization has never been easier.

You can also upload the videos you created to complement Advisera’s training videos.

Select the number of users for which you want to set up training
Monthly plan

10 users included

$15 / month

Unlimited access to all videos

Access to any training and awareness video about cybersecurity or NIS 2, in any language, for any of your employees.

Country-specific videos

When a particular EU country publishes its own laws and regulations based on, e.g., NIS 2, we will create videos that address those additional requirements.

Adapt training for audiences

Create separate training programs for senior management, mid-level management, IT employees, all other employees, etc. so that each group watches only the videos relevant to them.

Set training schedule

Choose daily, weekly, monthly, or other frequencies of watching training videos.

Automatic notifications

Configure automatic email notifications sent to employees about upcoming and overdue training videos.

Track employees’ progress

See exactly who has attended which training video, who is late, and testing results; download reports in PDF.

Quizzes and tests

Decide for each training program how you want to test the attendees.

Upload your own materials

Upload your own videos and documents, and add them to existing training programs.
(coming soon)

Custom-made videos

Based on your script, we will produce training videos (up to 10 minutes per video) that you can use within the Company Training Account.
(available in yearly plans with 100 or more users)

In-house live online training

Customized interactive webinar delivered by our expert for your company – up to 1 hour, up to 500 attendees.
(available in yearly plans with 500 or more users)
Yearly plan

10 users included

€154 / year

Unlimited access to all videos

Access to any training and awareness video about cybersecurity or NIS 2, in any language, for any of your employees.

Country-specific videos

When a particular EU country publishes its own laws and regulations based on, e.g., NIS 2, we will create videos that address those additional requirements.

Adapt training for audiences

Create separate training programs for senior management, mid-level management, IT employees, all other employees, etc. so that each group watches only the videos relevant to them.

Set training schedule

Choose daily, weekly, monthly, or other frequencies of watching training videos.

Automatic notifications

Configure automatic email notifications sent to employees about upcoming and overdue training videos.

Track employees’ progress

See exactly who has attended which training video, who is late, and the testing results; download reports in PDF.

Quizzes and tests

Decide for each training program how you want to test the attendees.

Upload your own materials

Upload your own videos and documents, and add them to existing training programs.
(coming soon)

Custom-made videos

Based on your script, we will produce training videos (up to 10 minutes per video) that you can use within the Company Training Account.
(available in yearly plans with 100 or more users)

In-house live online training

Customized interactive webinar delivered by our expert for your company – up to 1 hour, up to 500 attendees.
(available in yearly plans with 500 or more users)

For all company sizes, all industries

All videos were created to be relevant for small, medium, and large companies, and also for all industries — no matter if your company is a small SaaS provider or a large water utility, your employees will find these videos very appropriate.

In other words, any company implementing and maintaining their ISO 27001 ISMS will find these videos to be the right fit.

Frequently Asked Questions

What is the Company Training Account?

The Company Training Account is a learning management system (LMS) that enables you to configure various training and awareness programs for your entire workforce for, e.g., NIS 2, ISO 27001, security awareness, etc.

How long does it take to set up training and awareness?

Opening your account takes less than a minute. The wizard will then guide you through the process of setting up your first training and awareness program, which usually takes 5-10 minutes.

How does the free trial work?

During the 14-day free trial, you will get access to all training & awareness videos, but you will be limited to 10 users. Some more advanced features will be accessible when you upgrade your account. No credit card required.

What forms of payment do you accept?

We accept payment via any major credit or debit card; for a larger number of users, you can pay via wire transfer.

How does the Company Training Account compare to Advisera’s courses?

Advisera’s courses are intended for individuals who want to get in-depth knowledge about a particular framework, while the Company Training Account is intended for companies that want to automate training and awareness for all of their employees, and track their progress.

Which standards and regulations are covered in the Company Training Account videos?

Currently, the videos cover NIS 2, ISO 2701, and generic cybersecurity awareness training.

We’re working on adding videos for other standards and regulations — soon we will publish videos for GDPR and DORA.

Are videos available in languages other than English?

We are working on adding more languages at the moment. Contact us to learn about available languages.

Is there a time limit for attending the training?

No, your users can spend as much time as they like attending the lessons, as long as your subscription is active.

What will the users need to access the lessons?

Your users can access the lessons using PC, Mac, or mobile devices, using any major browser (e.g., Chrome, Mozilla, Edge, Safari); a broadband Internet link will also be needed.

What is the format of the training, and how long does it take?

The lessons are a combination of video lectures, quizzes, and test questions. The average time needed per lesson is between 5 and 10 minutes. You can configure your training program to include only a couple of lessons, or several dozen lessons.

What prior knowledge is needed to attend the training?

None. The lessons are created in such a way that a beginner can easily understand them. They are very easy to follow for any type of employees — senior or mid-level management, non-IT employees, tech people, etc.

How can I upgrade my account if I need more users?

Simply click the purchase button for the required number of users in the pricing table, and, after the payment is processed, your Company Training Account will be upgraded automatically.

Please make sure you use the same email address that you use for your existing account, because it is the only way this process can be done automatically. If you decide to make the purchase with a different email address, make sure you contact our support at support@advisera.com so we can upgrade your account manually.

Is it necessary to purchase training and awareness certificates?

No — you can use a Company Training Account without purchasing certificates. Once your users complete a particular training program, they will be able to download training certificates automatically from their account, at no extra charge.

There are so many videos — how will I find what is the most appropriate for us?

The Company Training Account will suggest the most appropriate videos based on the framework you’re interested in (e.g., NIS 2), and based on your audience (e.g., senior management).

Further, you can filter all the videos in the Library per country, language, relevant clauses and articles of the framework, and other criteria.

Schedule a Demo

Want our expert to walk you through the product? Schedule a short call. We respond quickly.