Information Security

Overview

Security is now a management responsibility

Information security has become a legal question as well as a technical one. Regulation names management responsibility directly, customers ask for evidence before they will sign, and the answer to both has to be a system that works rather than a control list that reads well.

An information security management system (ISMS) asks for something narrower and harder than a control list: risks owned by people who can act on them, controls chosen because of those risks, and evidence that the choice still holds. Control catalogues are easy to map onto and easy to leave unexamined, which is how a security programme comes to be complete on paper and untested in practice.

Professional tracks

Halderstone tracks follow a modular structure. They first establish a strong, role-specific foundation across disciplines, which is then applied to the chosen discipline.

Information Security · ISO/IEC 27001ISO/IEC 27001 AuditorAuditing information security beyond control checklists◎Diploma in Management System Auditing◎Halderstone Certified ISO/IEC 27001 Auditor20 modules · capstone · examView the track →

Information Security · ISO/IEC 27001Information Security ManagerMake information security part of everyday management◎Diploma in Management System Management◎Halderstone Certified Information Security Manager23 modules · capstone · examView the track →

Training modules

Each module can be taken on its own and trains the calls a practitioner has to make without being prompted. These are the modules that teach this discipline; the cross-discipline core that every track shares is in the catalogue.

HAM-IS-A-02 · Information SecurityAuditing Information Security ControlsEvaluate control applicability, implementation evidence and common failure patterns across ISO/IEC 27001 Annex A control themesView details →

HAM-IS-A-01 · Information SecurityAuditing Information Security Risk ManagementEvaluate asset–threat–vulnerability logic, risk treatment decisions, and traceability to controls and the Statement of ApplicabilityView details →

HAM-IS-S-02 · Information SecurityInformation Security Risk ManagementBuild the capability to make the organisation's information security risk position visible, owned and defensibleView details →

HAM-IS-S-01 · Information SecurityISMS Scope & Statement of ApplicabilityDefine clear ISO/IEC 27001 ISMS scope and boundaries and maintain a defensible Statement of Applicability (SoA)View details →

HAM-IS-DF-01 · Information SecurityMechanisms of Information Security ControlsBuild practical control literacy across access, cryptography, logging, response and recoveryView details →

HAM-IS-S-03 · Information SecurityOperational Control in Information SecurityPlan, implement and operate information security controls consistently in day-to-day activities in line with ISO/IEC 27001View details →

Advisory

We help organisations strengthen information security through clear governance, risk-based prioritisation and practical control integration. This includes designing and improving ISMS structures, embedding security into operational processes, clarifying ownership and evidence, and creating an approach that supports assurance, audit readiness and effective decision-making.

The four phases below are the life of a management system, and an engagement can begin at any one of them.

1. 01

   Design

   Establishing clear security governance and control structures

   –Information security governance and policy framework design

   –Definition of roles, responsibilities and decision rights

   –Risk assessment methodology and risk treatment approach

   –Security architecture and control design

   –Integration into existing management systems (e.g. QMS, privacy, AI governance)

   –Design of documentation and evidence structures

2. 02

   Operate

   Making information security work in daily practice

   –Information security risk assessments and regular updates

   –Implementation of security controls and procedures

   –Supplier and third-party security requirements and onboarding

   –Incident and vulnerability handling processes

   –Security awareness and role enablement

   –Operational support for ISMS processes

3. 03

   Assure

   Providing confidence and audit readiness

   –Independent reviews of information security governance

   –Control effectiveness and implementation checks

   –Internal audits (ISO/IEC 27001 or integrated systems)

   –Supplier and third-party security reviews

   –Audit readiness assessments and preparation support

4. 04

   Evolve

   Keeping security effective as risks and environments change

   –Continuous risk monitoring and reassessment

   –Maturity assessments and improvement roadmaps

   –Integration of new regulatory or contractual requirements

   –Scenario analysis for emerging threats

   –Executive sparring on strategic security decisions

Audit

An ISMS audit tests effectiveness rather than coverage: whether the risks named are the risks actually run, whether the controls chosen against them reduce the exposure, and whether the reviews would notice if they stopped working.