After this course you will steer information security as a programme rather than a collection of individual measures. You will look at security from the perspective of the business, customers and service providers, carry out risk analyses, choose organisational, technical and physical controls and justify how residual risk is handled. You will also evaluate how well the programme works and report on it clearly to management. The course suits information security managers, information security officers and managers with security responsibilities who already know the basics and are aiming for the EXIN ISMP exam.
What you’ll take away.
- Assess information security from the perspective of the business, customers and service providers
- Carry out risk analyses, select controls and justify how residual risk is handled
- Combine organisational, technical and physical controls to match the risk situation
- Implement a security programme, evaluate its effectiveness and report to management
Your training in detail
- Who is it for?
- Information security managers, information security officers and line, process or project managers who implement, evaluate or report on an information security programme.
- Prerequisites
- You have a basic grounding in information security, for example at the level of EXIN Information Security Foundation based on ISO/IEC 27001. EXIN does not set a formal prerequisite.
- Format & planning
- Standard length: 3 training days. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
Information security in the organisation and ISO/IEC 27001 as a framework
Perspectives: business, customers and service providers
Risk management: analysis, evaluation and selection of controls
Accepting, transferring or further reducing residual risk
Organisational, technical and physical controls
Steering, evaluating and reporting on the security programme
Practical assignments and exam preparation
For a fictitious mid-sized company with an outsourced data centre, you produce a risk analysis for a core business process, choose controls from the three control areas and explain to management which residual risk remains. The task follows the style of the practical assignments that EXIN requires for this certification.
Exams, licences & credentials
The course prepares you for the EXIN Information Security Management Professional based on ISO/IEC 27001 exam (30 multiple-choice questions, 90 minutes). EXIN only awards the certificate if you also complete training with an EXIN-accredited training provider and successfully finish two practical assignments there. Whether this course meets that requirement, and whether the exam and fees are included, is only certain if the offer explicitly confirms it. The certificate is issued by EXIN.
Vendor references & review date
Sources checked on 2026-11-10. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
Do I need EXIN Information Security Foundation first?
EXIN does not require it but recommends knowledge at that level. If you are confident with terms such as threat, vulnerability and control, you will keep up well.
What are the practical assignments?
EXIN requires two practical assignments, completed during a course with an accredited provider, before it awards the certificate. Without them the certificate is not issued, even if you pass the exam.
How does ISMP differ from a lead implementer course?
ISMP tests how you manage a security programme with a focus on risks and controls. A lead implementer course instead walks step by step through introducing an ISMS until it is ready for certification.
Does EXIN Information Security Management Professional based on ISO/IEC 27001 (ISMP): managing information security include a certificate?
The course prepares you for the EXIN Information Security Management Professional based on ISO/IEC 27001 exam (30 multiple-choice questions, 90 minutes). EXIN only awards the certificate if you also complete training with an EXIN-accredited training provider and successfully finish two practical assignments there. Whether this course meets that requirement, and whether the exam and fees are included, is only certain if the offer explicitly confirms it. The certificate is issued by EXIN.