Curriculum traceability
ISO/IEC 27001:2022
This matrix shows how each curriculum area maps to ISO/IEC 27001:2022requirements — the clause or control it supports, how it's taught, and the evidence the learner and organisation receive. It's a sample, illustrative mapping; your live records (completions, assessment scores, version history) form the per-organisation evidence pack.
What this supports — and what it doesn't
These programs support preparation for ISO/IEC 27001:2022 certification: they deliver the awareness and competence training the standard requires (notably Clause 7.2 Competence, 7.3 Awareness, and Annex A 6.3) and produce the documented completion and assessment records auditors look for. They do notby themselves certify your organisation or any individual, and they don't guarantee certification — your organisation still implements the management system and is audited by an accredited certification body. Training is the supporting evidence, not the certificate.
Manufacturing Security Program
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| OT vs IT Security | A.5.9Clause 7.3A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Shop-Floor Physical Access | A.7.1A.7.2A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Removable Media & USB Controls | A.7.10A.8.7A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Operational Incident Response | A.6.8A.5.24A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
Executive Security Program
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| Executive Threat Profile | A.5.7A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Travel Security | A.7.9A.6.7A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Communication Security | A.5.14A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Approval & Wire Transfer Protections | A.5.24Clause 7.2A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
OT/ICS Cybersecurity
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| Industrial Protocols & the Attack Surface | A.5.9A.5.7Clause 6.1 | Lessons + knowledge check | Per-learner completion (version-stamped) + assessment score |
| Network Segmentation, Zones & Conduits | A.8.20A.8.22 | Lessons + knowledge check | Per-learner completion (version-stamped) + assessment score |
| Secure Remote Access & Vendor Management | A.5.15A.8.5A.5.19 | Lessons + knowledge check | Per-learner completion (version-stamped) + assessment score |
| OT Incident Response & Recovery | A.5.24A.8.16A.8.13 | Lessons + knowledge check | Per-learner completion (version-stamped) + assessment score |
AI & Automation Implementation
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| Whole program — AI/automation delivery competence | Clause 7.2A.6.3A.5.14 | Lessons + module quizzes + capstone | Per-learner completion (version-stamped) + assessment score |
AI & Automation Foundations
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| Whole program — AI/automation competence (foundations) | Clause 7.2A.6.3 | Lessons + module quizzes + capstone | Per-learner completion (version-stamped) + assessment score |
AI Literacy for Everyone
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| Whole program — all-staff AI awareness | A.6.3Clause 7.3 | Lessons + knowledge checks + capstone | Per-learner completion (version-stamped) + quiz score |
AI & Automation Governance & Risk
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| The AI Risk Picture | Clause 6.1A.5.1A.6.3 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Data & Access Controls | A.5.12A.5.15A.5.17A.5.34A.8.12 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Human Oversight & Accountability | A.8.15A.5.24A.5.25Clause 9.1 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Vendors, Policy & Compliance | A.5.19A.5.20A.5.23A.6.3 | Lesson + knowledge-check | Per-learner completion + quiz score |
Vendor Scam & Fraud Awareness Program
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| Vendor Impersonation Tactics | A.5.24A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Invoice & Bank-Detail Verification | A.5.24Clause 7.2A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Supplier Onboarding Controls | A.5.19A.5.20A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
Secure Collaboration Program
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| Real-Time Collaboration Practices | A.5.14A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Document Permissions & Versioning | A.5.15A.8.3A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Cross-Team Communication | A.5.14A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| External Partner Workflows | A.5.14A.5.19A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
Remote Work Security Program
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| Home Network Setup | A.6.7A.8.1A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Device Hygiene for Remote Endpoints | A.8.1A.8.7A.8.8A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Public Wi-Fi & VPN | A.6.7A.8.20A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Work/Personal Boundaries | A.6.7A.5.10A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
Physical Security Program
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| Badging & Tailgating | A.7.2A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Visitor Management | A.7.2A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Clean Desk & Workspace Hygiene | A.7.7A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Reporting Suspicious Activity | A.6.8A.5.24A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
AI Tool Safety Program
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| When to Use AI Tools | A.5.10A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Prompt Hygiene & Confidential Data | A.5.12A.5.34A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Verifying AI Output | Clause 7.2A.5.10A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Approved Tools & Sanctioned Use | A.5.23A.8.19A.6.3 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
General Cyber Security & Phishing Awareness Training
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| Your Role in Security | Clause 7.3A.6.3Clause 5.1 | Lesson + knowledge-check | Per-learner completion (version-stamped) + quiz score |
| Phishing & Email Threats | A.6.3A.5.24A.8.7 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Beyond Email: Smishing, Vishing, Quishing & Deepfakes | A.6.3A.5.24 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Social Engineering & Pretexting | A.6.3A.5.24 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Passwords, Passphrases & Passkeys | A.5.17Clause 7.2A.6.3 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Multifactor Authentication Done Right | A.5.17A.8.5A.6.3 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Devices, Updates & Safe Software | A.8.7A.8.8A.8.19A.6.3 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Remote & Mobile Work | A.6.7A.8.1A.7.9A.6.3 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Data Handling, Classification & Privacy | A.5.12A.5.13A.5.10A.5.34A.6.3 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Ransomware, Malware & Insider Risk | A.8.7A.5.7A.6.3 | Lesson + knowledge-check | Per-learner completion + quiz score |
| Spot It, Report It: Incident Response | A.6.8A.5.24A.5.26Clause 10.1A.6.3 | Lesson + knowledge-check | Per-learner completion + quiz score |
Information Security Risk & Incident Management (ISO 27005 + 27035)
| Curriculum area | ISO/IEC clauses / controls | Method | Evidence produced |
|---|---|---|---|
| Annex A incident-management controls (overlay) | A.5.24-A.5.30 | Lesson + KC | Completion + score |
Hover a clause code for its title. Clause references follow ISO/IEC 27001:2022. For a per-organisation, audit-ready evidence pack, get in touch.