Information Security Management
International standard for information security management systems (ISMS). Helps organisations manage the security of financial data, intellectual property, employee details, and third-party information through a risk-based approach.
ISO/IEC 27001 is the world's leading information security management system standard, specifying requirements for establishing, implementing, maintaining, and continuously improving an ISMS. The 2022 revision restructured Annex A into four control themes — organisational, people, physical, and technological — and introduced 11 new controls addressing areas including threat intelligence, cloud security, and data masking.
The standard's core is a risk-based approach: organisations identify information security risks, select appropriate controls from Annex A (or elsewhere), and continuously monitor their effectiveness. The Statement of Applicability documents which controls apply and why.
ACI-certified ISO/IEC 27001 auditors demonstrate competency in assessing ISMS design, evaluating risk treatment decisions, and reviewing the effectiveness of all 93 Annex A controls.
Attend an ACI-Approved Training Provider (ATP) course for your chosen grade level. ACI-approved courses are aligned to the examination syllabus for ISO/IEC 27001.
Examinations are administered exclusively through ACI Approved Training Providers. Foundation and Internal Auditor examinations require 70% to pass; Lead Auditor requires 65%.
Submit your application through the ACI portal with your examination result, training certificate, and relevant audit experience log. Upon approval you receive your ACI Card ID and digital certificate.
Available Grades for ISO/IEC 27001
All six ACI auditor grades are available for this scheme. Each grade has defined competence, experience, and examination requirements.
Entry-level certification for those beginning their auditing career. Suitable for individuals who have completed foundation training but have limited audit experience.
For auditors who have completed Internal Auditor training and have begun accumulating audit experience under supervision or in an internal audit role.
Full auditor grade for practitioners with demonstrated audit experience. Recognised as a competent independent auditor of management systems.
Senior grade for experienced auditors capable of leading audit teams and managing full audit programmes. The most widely recognised auditor grade internationally.
Advanced grade for highly experienced auditors demonstrating sustained performance in complex audit environments and contributions to the auditing profession.
The highest ACI designation, awarded to individuals who have made an exceptional contribution to the management system auditing profession and to the ACI community.
Find an Approved Training Provider, sit the examination, and submit your application to ACI.