ISO 27001 awareness training online for every employee (ISO/IEC 27001:2022)

Course details mirror the Sterling Academy course page. Maintained by Sterling International Consulting’s Philippine delivery team.

ISO/IEC 27001:2022 clause 7.3 requires every person working under your control to be aware of the information security policy, of their contribution to the effectiveness of the ISMS and of the implications of not conforming; Annex A control 6.3 requires awareness, education and training. Certification auditors do not test this by reading your policy. They walk the floor, pick people at random and ask what the policy means for their job. The ISO/IEC 27001:2022 Awareness course on Sterling Academy exists so that every employee can answer, and so that you hold a per-person record when the auditor asks how you know.

The course is built from the awareness sessions Sterling’s lead auditors have delivered in person to Philippine BPOs, IT companies, banks and shared-service centres, cut into thirteen short modules that a busy employee can complete in a lunch break or two, with practice checkpoints between the parts and a final assessment at the end.

Contact usSee the course on Sterling AcademyWatch the sample video →

At a glance

Who it is for	Employees across your organisation
Format	Self-paced online video with practice checkpoints
Structure	13 modules · about 105 minutes of video · 4 practice checkpoints · final assessment
Access	12 months
On completion	Sterling Academy Certificate of Completion, numbered, verifiable online
List price	From US$19 per learner (51–200 learners), excluding taxes

Inside the course

Thirteen modules in three parts, four practice checkpoints and a final assessment. Video runtimes are approximate; allow additional time for the questions.

Part 1 — Information and why it matters (about 27 min)

1. Why information security matters (7 min)
2. Information: its forms and its life cycle (4 min)
3. Confidentiality, integrity and availability (6 min)
4. Practice checkpoint 1 (5 questions)
5. Information assets and how to protect them (10 min)

Part 2 — The standard, risk and controls (about 51 min)

5. ISO, ISO/IEC 27001 and the structure of the standard (6 min)
6. Context, interested parties and scope (6 min)
7. Practice checkpoint 2 (5 questions)
8. Policy and objectives (6 min)
9. The risk management cycle (12 min)
10. Annex A controls and the Statement of Applicability (14 min)
11. People, suppliers and documented information (7 min)
12. Practice checkpoint 3 (5 questions)

Part 3 — Incidents, review and improvement (about 25 min)

11. Events, incidents and nonconformity (9 min)
12. Internal audit and management review (8 min)
13. What happens next and your part in it (8 min)
14. Practice checkpoint 4 (5 questions), then the final assessment

What learners can do afterwards

• Explain confidentiality, integrity and availability in their own words.
• Recognise information assets and the common risks to them.
• Describe the role of policies, controls and their own responsibilities.
• Recognise an information security event and know why and how to report it.
• Explain how internal audit and continual improvement support the management system.

Where the course fits in your ISMS

The course is the awareness layer of an ISMS: it gives every person the understanding clause 7.3 asks for and produces the record clause 7.2 asks you to retain as evidence of competence. It does not replace role-based training for the people who run the system. Control owners take the 93 Annex A Controls course; everyone who handles business information takes Information Security Essentials for the day-to-day habits; risk owners take Risk Management; and your internal auditors are trained and certificated live by a Sterling lead auditor. Assigned together in an engagement, the four cover the people side of an ISO 27001 audit from the reception desk to the risk register.

Related courses

Contact usSee the course on Sterling AcademyWatch the sample video →

This records course completion. It does not confer ISO certification or a professional auditor qualification.

Frequently asked questions

1. Does this course make an employee ISO 27001 certified?
No. It records course completion with a numbered Certificate of Completion that anyone can verify online. Certification applies to an organisation’s management system and is issued by a certification body; auditor qualifications come from Sterling’s live internal auditor and lead auditor courses.

2. How long does it take?
About 105 minutes of video plus the checkpoint questions and the final assessment. Most learners spread it over two or three sittings; access runs for 12 months.

3. Is it enough for clause 7.3?
It gives every person the awareness clause 7.3 describes and the per-person record clause 7.2 asks for. Your organisation still determines the competence each role needs and evaluates effectiveness, which your Sterling consultant helps you document.

4. How do we roll it out to 500 people?
Your client administrator adds learners by CSV file, by pasting a list from Excel or on screen, assigns the course and follows completion from the training status report. Learners receive an e-mail invitation and work through the modules individually.

5. What does it cost?
List price from US$19 per learner for 51–200 learners, with higher per-learner rates for smaller groups, excluding taxes. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary ISO 27001 awareness training as part of the engagement.

Read next

• ISO 27001 certification in the Philippines
• 93 Annex A Controls: practitioner training online
• Information Security Essentials for every employee
• Sterling Academy: all courses