ISO 27000:2026 Information Security Management Systems (ISMS)

1. ISMS Concepts and Principles : Introduces the purpose of an Information Security Management System and the fundamental concepts and principles presented in ISO/IEC 27000:2026.

2. Information Security and Changing Risks : Explores the need for information security, the value of information, changing risks and the importance of maintaining appropriate information security practices.

3. ISMS Scope and Process Approach : Develops understanding of ISMS scope, organisational context, process-based management and the integration of information security activities within an organisation.

4. Information Security Requirements and Risk Treatment : Covers the identification of information security requirements, assessment of information security risks, risk treatment planning and selection of appropriate responses.

5. ISMS Controls and Business Integration : Examines the role of information security controls and how an ISMS can be integrated with organisational processes and wider business activities.

6. ISMS Monitoring and Continual Improvement : Develops awareness of monitoring, maintaining and improving ISMS effectiveness through evaluation, corrective action and continual improvement.

7. ISO/IEC 27000 Family and Related Standards : Explains the relationship between ISO/IEC 27000, ISO/IEC 27001 and related standards, including standards addressing controls, risk management and other specialised ISMS guidance.

8. ISMS Application and Organisational Awareness : Applies the concepts of ISO/IEC 27000:2026 to organisational situations, helping learners recognise information security responsibilities and the practical value of an ISMS.

• Provides focused knowledge of the 2026 edition of ISO/IEC 27000.

• Develops understanding of ISMS concepts and principles.

• Explains the relationship between ISO/IEC 27000 and ISO/IEC 27001.

• Builds awareness of information security risks and risk treatment.

• Introduces ISMS scope and the process approach.

• Develops understanding of controls and business integration.

• Introduces ISMS monitoring and continual improvement.

• Supports further study in information security management and cybersecurity.

• Helps learners understand the wider ISO/IEC 27000 standards family.

This qualification is suitable for:

• IT and information security personnel.

• Junior cybersecurity professionals.

• Information security and compliance assistants.

• Risk and governance personnel.

• IT managers developing ISMS awareness.

• Internal audit and quality support personnel.

• Data and information governance professionals.

• Professionals preparing for further ISO/IEC 27001 or ISMS training.

• Learners seeking structured knowledge of the 2026 ISO/IEC 27000 framework.

Assessment Format: Written multiple-choice assessment supported by applied ISMS scenarios.

Total Questions: 40 Questions

Passing Score: 60%

Duration: 60 Minutes

Certification: Learners who successfully meet the assessment and qualification requirements receive the HiQual UK Level 3 Award in ISO 27000:2026 Information Security Management Systems (ISMS).

To deliver this Qualification, HiQual UK Approved ATPs must demonstrate the capability to deliver, assess, and internally quality assure qualifications in line with recognised regulatory principles and the expectations of the Regulated Qualifications Framework (RQF).

Approved centres must operate effective systems to ensure the validity, reliability, fairness, consistency, and security of assessment.

1. Centre Recognition and Legal Compliance

Centres must be formally recognised by HiQual UK prior to the delivery or assessment of any qualification. To maintain recognition, centres must: Be a legally constituted organisation operating in compliance with applicable legislation and regulatory requirements. Demonstrate effective governance, management oversight, and clear lines of accountability. Comply with all HiQual UK policies, procedures, and conditions of centre recognition. Notify HiQual UK promptly of any material changes that may affect delivery, assessment, or internal quality assurance arrangements.

2. Resources, Facilities, and Learning Environment

Centres must ensure that sufficient and appropriate resources are in place to support learning and assessment. This includes: Learning environments appropriate to the mode of delivery, including classrooms and, where applicable, specialist or practical facilities. Access to learning and assessment resources that enable learners to meet qualification outcomes. Secure systems for managing learner data, assessment records, and certification claims. Arrangements that support equality of access and reasonable adjustments for learners where required.

3. Staff Competence and Occupational Expertise

Centres must ensure that all staff involved in delivery, assessment, and internal quality assurance are competent and suitably qualified. Centres must: Appoint tutors with appropriate subject knowledge, teaching competence, and relevant occupational or professional experience. Ensure assessors are trained and competent in applying HiQual UK assessment requirements and standards. Appoint a qualified Internal Quality Assurer (IQA) responsible for monitoring assessment practice and decisions. Maintain records of staff qualifications, experience, training, and continuing professional development (CPD).

4. Assessment Practice and Internal Quality Assurance (IQA)

Centres must operate robust internal quality assurance systems to ensure assessment integrity. Centres must: Ensure assessment is valid, fit for purpose, and conducted in line with HiQual UK requirements. Implement effective IQA procedures to monitor assessor performance and confirm the consistency of assessment decisions. Maintain accurate, complete, and auditable records of learner registration, assessment evidence, and outcomes. Carry out regular internal reviews and standardisation activities to support continuous improvement.

5. Integrity, Risk Management, and Malpractice

Centres must take appropriate measures to protect the integrity of assessment. Centres must: Maintain policies and procedures for the prevention, identification, and management of malpractice and maladministration. Ensure secure handling, storage, and retention of assessment materials and learner evidence. Report any suspected or confirmed malpractice to HiQual UK in accordance with published procedures.

6. Health, Safety, Safeguarding, and Learner Protection

Centres must provide a safe, inclusive, and supportive learning environment. Centres must: Comply with applicable health and safety and safeguarding legislation. Conduct risk assessments for learning activities, particularly where practical or technical work is involved. Maintain procedures to safeguard learner welfare and wellbeing.

7. Learner Information, Support, and Fair Treatment

Centres must ensure learners are informed, supported, and treated fairly. Centres must: Provide clear and accurate information on programme requirements, assessment methods, and certification. Ensure learners receive timely and constructive feedback on assessment outcomes. Operate transparent complaints and appeals procedures aligned with HiQual UK requirements. Manage learner information securely in compliance with data protection legislation.

Successful learners may progress to:

• Further study in ISO/IEC 27001 Information Security Management Systems.

• Specialist training in information security risk management and controls.

• Information security internal auditing and compliance training.

• Further qualifications in cybersecurity, IT governance, risk management and information assurance.

• Career development toward information security support, ISMS coordination, compliance, governance and junior cybersecurity roles.