After this course you know what the role demands and how to carry it out day to day. You steer the security process, coordinate the policy and concepts, check that measures are implemented and report to management in a way that supports decisions. You also work out where the role should sit in the organisation and how to avoid conflicts with IT and data protection. The course suits you if you are new to the role or share responsibility for it as a CISO in a smaller organisation.
What you’ll take away.
- Clearly define the role's tasks, position and reporting lines
- Coordinate the security policy, concepts and guidelines
- Plan measures, check their implementation and report clearly to management
- Investigate incidents and initiate awareness and training
Your training in detail
- Who is it for?
- New and aspiring information security officers, CISOs in smaller organisations and IT professionals who are due to take on this role.
- Prerequisites
- You should have basic IT knowledge and understand your business processes. Some grounding in information security or ISO/IEC 27001 helps.
- Format & planning
- Standard length: 5 training days. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
The role, its independence and how it differs from IT and data protection
ISMS under ISO/IEC 27001: structure and management responsibility
Policy, security concepts and risk treatment
Implementation plans and checking delivery
Management reporting and metrics
Security incidents, awareness and training
For a fictional mid-sized company you create a role profile, an annual plan and a one-page security report for senior management.
Exams, licences & credentials
This is a vendor-independent NextNowa course. It does not lead to a certificate from a vendor or certification body and does not prepare you for a specific exam.
Vendor references & review date
Sources checked on 2026-11-04. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
Are an ISB and a CISO the same thing?
The terms are often used in similar ways. The exact remit depends on your organisation, so the course works through tasks and reporting lines in concrete terms.
Do I need to come from IT?
Not necessarily. For this role, however, the BSI expects experience and knowledge in information security and IT, plus an understanding of business processes. The course does not replace that experience.
Does Information Security Officer and CISO: the role in an ISMS include a certificate?
This is a vendor-independent NextNowa course. It does not lead to a certificate from a vendor or certification body and does not prepare you for a specific exam.