ISO 27001 Internal Auditor Training in USA
ISO/IEC 27001:2022 Information Security Management System Internal Auditor Course — Practical ISMS Auditing, Risk Assessment and Cybersecurity Control Evaluation
Develop the practical skills to plan, conduct, report and follow up internal audits of an Information Security Management System. Learn to evaluate information security risk management, the Statement of Applicability, Annex A controls, technical and organizational evidence, internal audit findings and corrective actions.
Recognition: EAS-certified internal auditor course, as listed by IAS. Not CQI-IRCA certified; that applies to the separate Lead Auditor course.
Current standard
Learn the current ISO/IEC 27001 information security standard
ISO/IEC 27001:2022 with Amendment 1:2024 is current; no 2026 edition exists. The amendment asks organizations to consider whether climate change is relevant to their context and interested parties; it does not require a standalone climate cybersecurity plan. Audits follow ISO 19011:2026 guidance. Companion standards are guidance, not certification requirements.
| Standard | What it covers | Status for ISO 27001 certification |
|---|---|---|
| ISO/IEC 27002:2022 | Information security controls guidance | Guidance; not a certification requirement |
| ISO/IEC 27005:2022 | Information security risk management guidance | Guidance |
| ISO/IEC 27007:2020 | Guidelines for ISMS auditing | Guidance used with ISO 19011 |
| ISO/IEC 27017:2015 | Cloud security controls guidance | Guidance; relevant where cloud services are in scope |
| ISO/IEC 27018:2025 | Protection of PII in public clouds | Guidance for PII processors |
| ISO/IEC 27701:2025 | Privacy information management system | Standalone since 2025; separate from ISO 27001 certification |
ISO: ISO/IEC 27001 (opens in a new tab) · ISO: Amendment 1:2024 (opens in a new tab) · ISO: ISO 19011 (opens in a new tab)
Course recognition
Understanding ISO 27001 internal auditor training recognition
IAS lists this course as EAS certified. The ISO 27001 Lead Auditor course is separately CQI-IRCA certified; its current reference in EAS’s list is PR373, while the IAS accreditation page still shows PR320 (the 2013 course). Neither applies here. Course achievement, internal auditor competence and professional registration are different things. The certificate descriptions currently conflict, and are shown so they can be resolved.
| Format | As described by IAS (live page) | As described by EAS | Status |
|---|---|---|---|
| Classroom | Written exam; IAS Professional Certificate on passing | Not described for classroom | Confirm issuer and wording |
| Live virtual | Not described | Continuous assessment and online exam; internal auditor training certificate on completing the course and assessment | Confirm issuer and wording |
| Self-paced | Online exam; IAS Participation Certificate for all attendees | Online exam; training certificate on completing the assessment | Conflicting; resolve before publishing |
The course
Develop practical information security auditing skills
An ISMS internal audit is not a penetration test, a vulnerability scan, a SOC 2 examination, an incident investigation, a regulatory examination or a code security review. Those may provide evidence, but they have different objectives and qualifications.
- ISMS fundamentals and objectives
- Risk-based management
- Audit principles and programs
- Scope and criteria
- ISMS and technical evidence
- Interviews
- Findings and reporting
- Corrective action and follow-up
Who should attend
Who should attend?
One course does not qualify anyone to audit every specialized technical control.
Prerequisites
Is ISO 27001 internal auditor training suitable for you?
Prior audit experience is not required, and EAS says basic ISO 27001 knowledge is helpful but not mandatory. Useful: information security basics, the CIA triad, ISO 27001 fundamentals, risk assessment, your organization’s processes and PDCA. No email is needed for a suggestion.
Two-day syllabus
Explore the two-day, 16-hour ISO 27001 internal auditor course
A proposed sequence based on the live IAS course topics, to be reconciled with EAS’s six-module course. Self-paced study does not include the live role-plays. No pass mark is stated here.
EAS’s current course modules
- Introduction to Information Security Management System
- Auditing information security risk management
- Structure and overview of ISO 27001:2022 requirements
- Audit concepts
- Planning and conducting an internal audit
- Reporting and following up an internal ISMS audit
Requirements explorer
Learn to audit every major ISMS requirement
Clauses 4–10 in our own words, with ISO/IEC 27001:2022 numbering. Not the standard’s text.
Annex A
Explore the 93 information security controls
Four themes: organizational (37), people (8), physical (14) and technological (34). Not every control applies to every organization, and an applicable control is not automatically effective. Plain-English purposes only; see ISO/IEC 27002:2022 for guidance.
2013 vs 2022
Understand the changes that affect ISMS audits
ISO/IEC 27001:2013 is no longer current. Most 2013 controls were merged or restructured rather than simply removed, and earlier training certificates do not become invalid.
| ISO/IEC 27001:2013 | ISO/IEC 27001:2022 | |
|---|---|---|
| Number of controls | 114 controls | 93 controls |
| Structure | 14 domains (A.5–A.18) | 4 themes: organizational (37), people (8), physical (14), technological (34) |
| Consolidation | Many separate controls | Several controls merged; few were simply removed |
| New controls | — | 11 new, including threat intelligence, cloud services, ICT readiness, data masking and secure coding |
| Attributes | None | Control attributes in ISO/IEC 27002:2022 help filtering |
| SoA | Mapped to 114 controls | Compare necessary controls with the 93; justify inclusions and exclusions |
| Transition | Accredited 2013 certificates expired by October 31, 2025 under the IAF transition | All accredited certifications are now to ISO/IEC 27001:2022 |
| Training | Earlier internal auditor certificates remain valid records of training | Update knowledge on the 2022 structure; a full retake is not automatically required |
Risk workshop
How internal auditors review information security risk management
A fictional US SaaS provider handling customer business information. No scoring matrix is prescribed, no residual risk is decided for a real organization, and nothing here is an approved risk assessment.
Statement of Applicability
Learn to audit the Statement of Applicability
The SoA lists necessary controls, justifies inclusions and exclusions, and shows implementation status. Not all Annex A controls must be implemented, and an SoA entry does not prove a control works. A fictional SoA extract: judge each entry.
| Control | Applicability | Justification | Status | Evidence seen | Your view |
|---|---|---|---|---|---|
| 5.23 Cloud services | Applicable | Platform runs on public cloud | Implemented | Cloud policy; shared responsibility map | |
| 7.4 Physical security monitoring | Not applicable | “We are fully remote” | — | None | |
| 8.13 Information backup | Applicable | Risk R-12 accidental deletion | Implemented | Backup policy only; no restore test records | |
| 8.28 Secure coding | Applicable | Risk R-07 vulnerable code | Implemented | Code review records for sampled releases; scanning results | |
| 5.7 Threat intelligence | Applicable | Required by risk treatment plan | Planned | Not yet started | |
| 6.1 Screening | Applicable | HR policy | Implemented | Screening policy; three of five sampled hires have no screening record |
Audit program builder
Plan an effective ISO 27001 internal audit program
Audits happen at planned intervals considering importance, changes and previous results. There is no universal rule to audit every Annex A control every six or twelve months. A fictional sample program, not a conformity decision.
Impartiality and competence
Who can conduct ISO 27001 internal audits?
Auditors need ISMS and audit knowledge, enough technical understanding, and objectivity. Internal audits do not have to be done by external consultants, no minimum number of auditors is set, and course achievement does not prove competence in every technical control. A small technology company has an IT manager, an information security coordinator, a compliance officer and an operations manager.
| Assignment | Your view |
|---|---|
| The IT manager audits the access reviews they perform | |
| The compliance officer audits backup and recovery in IT operations | |
| The information security coordinator audits the risk register they maintain | |
| The operations manager audits HR security processes | |
| The information security coordinator audits supplier security managed by procurement | |
| An external contract auditor audits the whole ISMS once a year |
Checklist builder
Develop practical ISO 27001 internal audit questions
Educational output; generic questions do not cover every ISMS scope, and no certification conclusion is produced.
Access control lab
Practice evaluating identity and access management evidence
Fictional SaaS records. No real passwords, credentials or production logs are used or requested.
| Population | What the records show | Your view |
|---|---|---|
| New employees | Access request form for a new support engineer; manager approval dated after access was granted. | |
| Role changes | Developer moved to sales in July; still has production read access in October. | |
| Departing staff | Termination checklist shows accounts disabled the same day for 9 of 10 sampled leavers. | |
| Privileged administrators | Quarterly privileged access review signed for Q1–Q3 with removals recorded. | |
| Third-party support users | Vendor accounts have no expiry date and no review record. |
Cloud and suppliers
Auditing cloud services and third-party information security
A fictional software provider’s key suppliers. Not every cloud provider must hold ISO 27001, and a supplier’s certificate does not cover the customer’s own responsibilities.
Incident management
How internal auditors evaluate security incident processes
A hypothetical account compromise. Nothing here gives exploit guidance or decides legal reportability under SEC, HIPAA or state law.
Technical evidence
How to review technical control evidence without performing a penetration test
Fictional records. An internal audit is not a vulnerability assessment, and no system is declared secure.
ICT continuity
Auditing ICT readiness and continuity-related security controls
A fictional cloud outage. An ISMS audit is not a full ISO 22301 audit, and nothing here approves a disaster recovery arrangement.
Interview simulator
Practice interviewing information security personnel
Choose a fictional interviewee and the questions you would ask. No confidential records are used.
Mock ISMS audit
Practice conducting an ISMS internal audit
A fictional US cloud software company with fifteen audit areas. Not an EAS examination; no certificate or certification decision.
Findings laboratory
Write clear and defensible ISMS internal audit findings
A good finding connects a specific requirement with verified evidence. Never invent evidence; grade only under your organization’s method.
Corrective action
How to evaluate ISMS corrective actions
Auditors evaluate actions; they should not implement controls they will later audit.
Fictional examples
Correction, corrective action or effectiveness check?
| Action | Your view |
|---|---|
| Removing the stale account found in the audit | |
| Adding a risk review step to change management | |
| Checking the next two access reviews were on time | |
| Resetting the compromised password | |
| Extending MFA to all users after the incident | |
| Reviewing incident trends after the MFA rollout |
Audit evidence
What does good internal audit evidence look like?
Fictional comparisons. Weak evidence means look further; it is not automatically a nonconformity.
| Area | Strong evidence | Weak evidence |
|---|---|---|
| Risk assessment | Current, approved records consistent with the defined methodology. | An outdated register with no evidence of required review. |
| Access control | Approved access decisions, reviews and removal records. | An administrator’s unverified statement that access is reviewed. |
| Supplier security | Supplier evaluation and monitoring evidence. | A supplier list with no security assessment. |
| Security awareness | Awareness and competence evidence for the role. | Attendance records alone where more is needed. |
| Corrective action | Investigation, implementation and effectiveness verification. | Findings closed with no follow-up. |
US landscape
Understand the US information security compliance landscape
ISO 27001 certification does not automatically satisfy HIPAA or PCI DSS, internal auditor training does not qualify anyone to issue SOC 2 reports, and NIST CSF has no certification scheme.
| ISO/IEC 27001 | SOC 2 | NIST CSF | HIPAA Security Rule | PCI DSS | |
|---|---|---|---|---|---|
| What it is | ISMS requirements | Attestation report on controls | Cybersecurity risk guidance | Legal security requirements for ePHI | Payment card security requirements |
| Governing body | ISO and IEC | AICPA | NIST | HHS (OCR) | PCI Security Standards Council |
| Applies to | Any organization choosing it | Service organizations whose clients request it | Any organization choosing it | Covered entities and business associates | Entities handling payment card data |
| Status | Voluntary or contractual | Voluntary or contractual | Voluntary | Law | Contractual through card brands |
| Assessment | Accredited certification audit | Examination by a licensed CPA firm | Self-assessment; no certification scheme | Regulatory compliance and enforcement | QSA or self-assessment |
| Report | Certificate | SOC 2 report | Profiles and self-assessments | Compliance records | Report on compliance or SAQ |
| Relationship to ISO 27001 | — | Complementary; not equivalent | Can be mapped; not equivalent | Certification does not establish compliance | Certification does not establish compliance |
| Does this course qualify you? | Supports internal ISMS auditing | No; SOC 2 reports are issued by CPA firms | No certification to qualify for | No | No |
NIST: Cybersecurity Framework (opens in a new tab) · AICPA (opens in a new tab) · HHS: HIPAA (opens in a new tab) · PCI Security Standards Council (opens in a new tab)
Audit types
Understanding different information security audit types
Internal auditor training does not authorize third-party certification audits.
| First-party (internal) | Second-party (customer or supplier) | Third-party (certification) | |
|---|---|---|---|
| Purpose | Check the organization’s own ISMS | Check a supplier against customer requirements | Independent certification |
| Independence | Auditors independent of the area audited | Customer’s auditors or their representatives | Accredited certification body |
| Standards | ISO 19011, ISO 27001 clause 9.2 | ISO 19011, contract | ISO/IEC 17021-1, ISO/IEC 27006-1 |
| Scope | Set by the audit program | Set by the contract | Set by the certification agreement |
| Evidence | Internal records and interviews | Supplier records | Records, interviews, observation |
| Report | Internal audit report | Supplier audit report | Certification audit report |
| Certification decision | None | None | Made by the certification body |
Choosing a course
Which ISO 27001 auditor course should you choose?
Neither course alone authorizes third-party certification audits or gives professional registration.
| ISO 27001 Internal Auditor | ISO 27001 Lead Auditor | |
|---|---|---|
| Duration | Two days / 16 hours, as advertised for instructor-led delivery | Five days / 40 hours |
| Focus | Internal ISMS audits | Leading audits, including certification audit methodology |
| Planning | Audit plans and checklists | Audit programs, team planning, Stage 1 and Stage 2 |
| Assessment | Online examination and continuous assessment (EAS) | Continuous assessment and written examination |
| Recognition | EAS certified, as listed by IAS (no CQI-IRCA reference) | CQI-IRCA certified; current reference PR373 (IAS accreditation page still shows PR320) |
| Registration | Not an IRCA registration route | A training step toward IRCA registration, a separate application |
| Third-party auditing | Not authorized | Certification bodies set further requirements |
Integrated auditing
Develop integrated technology and risk management auditing knowledge
Completing one course does not qualify anyone to audit the other management systems.
| ISO/IEC 27001 | ISO 22301 | ISO/IEC 20000-1 | |
|---|---|---|---|
| Focus | Information security | Business continuity | IT service management |
| Core concept | Risk to confidentiality, integrity and availability | Impact of disruption over time | Service delivery to agreed requirements |
| Key evidence | Risk register, SoA, control records | BIA, continuity plans, exercises | Service catalogue, SLAs, incident and change records |
| Shared skills | Planning, interviews, evidence, findings, corrective action | Same | Same |
| Training pathway | ISO 27001 Internal Auditor | ISO 22301 Internal Auditor | ISO/IEC 20000-1 Internal Auditor |
Industries
Industry applications in the USA
The course does not meet every sector-specific audit qualification.
Delivery formats
Choose the ISO 27001 internal auditor training format that fits you
30-day portal access is not 30 days of instructor-led training, and self-paced study is not identical to the live 16-hour course. Certificate type per format is being confirmed.
Training dates
Upcoming ISO 27001 internal auditor training dates in USA
The IAS schedule lists two ISO/IEC 27001:2022 Internal Auditor virtual sessions, 9:00–18:00, with no time zone stated. They are confirmed before registration.
| Course | Edition | Provider | Start | End | Time zone | Format | Duration | Fee | Status | Enquire |
|---|
Assessment and certificate
How the ISO 27001 internal auditor course is assessed
EAS describes continuous assessment and an online examination for virtual delivery, and quizzes, exercises and an online examination for self-learning. No pass mark, duration or resit rule is published. ISO does not issue training certificates, and participants do not all receive the same recognition regardless of outcome. Issuer and type per format will be confirmed (see Recognition).
EAS: training certificate search (opens in a new tab)
- Course exercises
- Tutor-led formats.
- Examination
- Online (EAS); classroom written exam as advertised by IAS.
- Passing requirements
- Confirmed by EAS.
- Retakes
- Where EAS rules permit.
- Certificate
- Issuer and wording to confirm.
Fees and corporate groups
ISO 27001 internal auditor training fees in USA
Quoted in USD once approved. No fees or group discounts are published. Corporate programs suit information security, IT, GRC, internal audit and supplier assurance teams and multi-site companies.
- Classroom
- Request course fee
- Live virtual
- Request course fee
- Self-paced
- Request course fee
- Corporate in-house
- Request a group quotation
- Confirmed with your quotation
- Hours, materials, portal access, examination, certificate, taxes, cancellation and refund terms
Registration
Register for ISO 27001 internal auditor training
Send a registration or information request. A coordinator confirms dates, fees, certificate type and availability. You are registered only after written confirmation.
Enrollment journey
From enquiry to certificate
An enquiry does not reserve a seat.
- 1
Understand the current standard
- 2
Review course recognition
- 3
Explore the two-day syllabus
- 4
Learn about risk and Annex A
- 5
Practice the audit exercises
- 6
Choose a training format
- 7
Choose a verified date
- 8
Review course fees
- 9
Submit enrollment
- 10
Receive confirmation
- 11
Attend or access training
- 12
Complete the assessment
- 13
Receive the applicable certificate
- 14
Apply your skills in internal ISMS audits
Tutors and responsibilities
Learn from experienced information security auditing professionals
Tutor profiles will appear once verified. Training partner status, certification-body accreditation and individual course approval are separate things.
| Responsibility | Organization | Status |
|---|---|---|
| Organizes training and US enquiries | IAS | Confirmed |
| Delivers training | EAS | As advertised |
| Conducts assessments | EAS | Confirm rules |
| Issues certificates | EAS or IAS | Conflicting: IAS page names IAS certificates; confirm |
| Provides online portal access | EAS portal | Confirm terms |
| Collects payment | IAS or EAS | Confirm |
| Handles complaints and resits | IAS and EAS | Confirm process |
| Maintains course records | EAS | Confirm |
FAQ
ISO 27001 internal auditor training questions
80 answers. EAS confirms course rules when you enrol.
What is ISO 27001 Internal Auditor Training?
A two-day course that teaches you to plan, conduct, report and follow up internal audits of an information security management system.
What is ISO/IEC 27001:2022?
The international standard for information security management systems, with 93 Annex A reference controls in four themes.
Is ISO 27001:2022 still current?
Yes, together with Amendment 1:2024.
What is Amendment 1:2024?
It asks organizations to consider whether climate change is a relevant issue in their context and among interested-party requirements. It does not require a standalone climate cybersecurity plan.
Is ISO 27001:2026 published?
No.
What is ISO 19011:2026?
The current guidelines for auditing management systems, published May 2026.
What is an ISMS?
A management system for preserving the confidentiality, integrity and availability of information by applying risk management.
What is information security risk assessment?
Identifying, analysing and evaluating risks using defined criteria, with risk owners.
What is risk treatment?
Selecting and implementing options to address assessed risks, including the necessary controls.
What is a Statement of Applicability?
A document listing the necessary controls, justification for inclusion and exclusion of Annex A controls, and whether they are implemented.
What are Annex A controls?
A reference set of information security controls that organizations compare with the controls they determined as necessary.
How many Annex A controls exist?
93.
What are the four Annex A control themes?
Organizational (37), people (8), physical (14) and technological (34).
Are all 93 controls mandatory?
No. Organizations determine necessary controls through risk treatment and justify exclusions.
What is ISO/IEC 27002:2022?
Guidance on implementing information security controls. It is not a certification requirement.
What does an ISO 27001 Internal Auditor do?
Plans and conducts ISMS audits, gathers evidence, reports findings and follows up corrective action.
What does Clause 9.2 require?
Internal audits at planned intervals, an audit program considering importance and previous results, defined criteria and scope, objective and impartial auditors, and reporting to relevant management.
Why are internal ISMS audits important?
They show whether the ISMS conforms and is effectively implemented, and feed management review.
Who should attend?
Information security managers, ISMS coordinators, IT auditors, GRC analysts, cybersecurity, IT operations, risk, compliance, data protection and supplier assurance professionals.
Is the course suitable for beginners?
Yes. Prior audit experience is not required.
What are the prerequisites?
None are mandatory. Basic ISO 27001, PDCA and information security knowledge help.
Is previous audit experience required?
No.
How long is the course?
Two days for tutor-led delivery.
Is it two days?
Yes.
Is it 16 hours?
Yes, as advertised for tutor-led delivery.
What will I learn on Day 1?
ISMS requirements, risk assessment, the SoA and audit planning.
What will I learn on Day 2?
Conducting audits, auditing Annex A controls, reporting and follow-up.
Does the course include practical exercises?
Yes, in tutor-led formats.
Does it cover risk registers?
Yes.
Does it include SoA exercises?
Yes.
Does it teach Annex A auditing?
Yes, the themes and selected controls in depth.
Does it teach access control auditing?
Yes.
Does it cover cloud security?
Yes, as ISMS controls and supplier arrangements.
Does it cover supplier security?
Yes.
Does it cover incident management?
Yes.
Does it teach audit planning?
Yes.
Does it teach audit checklists?
Yes.
Does it cover audit interviewing?
Yes.
What is objective evidence?
Verifiable records, statements of fact or observations.
Does it include a mock audit?
Yes, as a role-play in tutor-led formats.
How are nonconformities reported?
As statements linking a requirement to verified evidence, under the organization’s audit method.
Does it teach corrective action?
Yes, how auditors evaluate it.
How often must internal audits be conducted?
At planned intervals set by the program. No fixed six- or twelve-month rule applies to every control.
Can employees audit their own work?
No. Auditors should not audit their own work.
Do internal auditors require a formal certificate?
ISO 27001 requires competence, not a specific certificate.
Is the course EAS certified?
IAS lists it among EAS-certified internal auditor courses.
Is it CQI-IRCA certified?
No. CQI-IRCA certification applies to the separate Lead Auditor course.
What is the difference between Internal and Lead Auditor Training?
Internal auditor training is two days and focused on your own ISMS; Lead Auditor is five days, covers certification audit methodology and is CQI-IRCA certified.
What is CQI-IRCA PR320?
The reference for the earlier ISO/IEC 27001:2013 Lead Auditor course. The current ISO/IEC 27001:2022 Lead Auditor reference in EAS’s list is PR373. Neither applies to this course.
Who delivers the training?
EAS, IAS’s training partner.
Who issues the certificate?
Being confirmed. The current IAS page names IAS certificates; EAS describes an internal auditor training certificate. We confirm before you enrol.
Does ISO issue training certificates?
No.
Can the certificate be verified?
EAS offers a training certificate search.
Does the certificate expire?
Confirmed with the certificate wording.
Is classroom training available?
Ask us; no public venue is published.
Is live virtual training available?
Yes. The IAS schedule lists sessions on November 14–15 and December 26–27, 2026.
Is self-paced learning available?
Yes, through the EAS portal.
Does the self-paced course include 30-day access?
Yes, as advertised. It is access to materials, not 30 days of tutor time.
Do all formats offer the same certificate?
Not confirmed. The current IAS page describes different certificates for classroom and online; we confirm before you enrol.
Is there a final examination?
Yes. EAS describes an online examination at the end.
What is the passing mark?
Not published. We confirm it when you enrol.
Can I retake the examination?
Where EAS rules permit.
Does the course qualify me to audit third-party clients?
No.
Does it grant IRCA registration?
No.
Can ISO 27001 internal auditors conduct SOC 2 audits?
No. SOC 2 reports are issued by licensed CPA firms.
Does ISO 27001 certification satisfy HIPAA?
No. It can support HIPAA security efforts but does not establish compliance.
Does it satisfy PCI DSS?
No. PCI DSS has its own assessment.
How does ISO 27001 relate to NIST?
NIST CSF is voluntary guidance with no certification scheme; controls can be mapped, but they are not equivalent.
Can I audit ISO 22301 after taking this course?
The method carries over, but you need ISO 22301 knowledge too.
Is the course useful for SaaS companies?
Yes. The exercises use a fictional SaaS company.
Can corporate teams arrange training?
Yes.
Is group pricing available?
Ask for a group quotation. No discounts are published.
What are upcoming course dates?
Virtual sessions on November 14–15 and December 26–27, 2026 are listed on the IAS schedule. Confirm before registering.
What time zone is used?
The schedule lists 9:00–18:00 without a time zone. We confirm it with you.
What is the course fee?
Request a fee. No price is published until approved.
Can international delegates join?
Usually yes for virtual sessions; confirm the time zone.
What is the cancellation policy?
See the refund policy and your quotation.
How do I register?
Use the registration form. A coordinator confirms dates, fees and availability.
What happens after enrollment?
You receive confirmation and joining instructions only once your place is confirmed in writing.
How can I request corporate training?
Choose Corporate Group Registration in the form.
Related courses
Training and certification resources.
- ISO 27001 Lead Auditor
- ISO 22301 Lead Auditor
- ISO 27001 certification
- Internal Auditor training
- Lead Auditor training
- ISO training
- Foundation training
- Training schedule
- Accreditation information
- About IAS
- IAS Insights
- Contact IAS USA
- ISO 27001 standard (blog)
- ISO 27001 requirements (blog)
- Frequently asked questions
- Training nomination form (DOC)
- Course or service brochure (PDF)