Welcome to the ISO/IEC 27001:2022 Implementation Project Platform. This is not a lecture course. It is a hands-on, end-to-end business simulation in which you take on the role of an ISO/IEC 27001:2022 Lead Implementer hired by a hospital to build its Information Security Management System (ISMS) and take it all the way to certification.

1. Introduction

Meridian Specialist Hospital (MSH), a 250-bed private hospital in Dubai, has just had a security scare and its board has approved an ISO/IEC 27001:2022 project. They have hired you. Over the coming milestones you will walk into this organization exactly as a real Lead Implementer would: you will study the business, meet the stakeholders, discover the systems and data, assess the risks, write the policies, implement the controls, audit the results, and stand in front of a certification body.

Each section gives you real working materials — the hospital's profile and org chart, asset inventories, network information, interview notes, and the document templates and checklists you need to produce genuine ISMS deliverables. By the final milestone you will have completed a full A-to-Z implementation using realistic data, and you will hold a portfolio of the actual documents an ISMS requires.

2. Scope of this Project Platform

This platform covers the complete lifecycle of an ISO/IEC 27001:2022 ISMS implementation, structured around the standard's management-system clauses (4–10) and its Annex A control set:

• Understanding organizational context and defining the ISMS scope (Clause 4).
• Leadership, information-security policy and governance (Clause 5).
• Risk assessment & risk treatment and the Statement of Applicability (Clause 6).
• Support — resources, competence, awareness, communication and documented information (Clause 7).
• Operation — implementing the Annex A controls across the Organizational, People, Physical and Technological themes (Clause 8).
• Performance evaluation — monitoring, measurement, internal audit and management review (Clause 9).
• Improvement — nonconformity and corrective action (Clause 10).
• Certification — Stage 1 and Stage 2 audit readiness and the certification decision.

What this platform is not: it is not a substitute for the ISO/IEC 27001:2022 standard text itself, and it does not cover unrelated frameworks except where they help (e.g., ISO/IEC 27002:2022 implementation guidance and the relevant UAE regulations).

3. Objectives

By enrolling in and completing this project platform, you will be able to:

• Interpret every requirement of ISO/IEC 27001:2022 and explain what evidence an auditor expects for each clause.
• Define an ISMS scope and document the context of a real organization.
• Perform an information-security risk assessment and build a defensible risk-treatment plan and Statement of Applicability.
• Draft the full ISMS documentation set — policies, procedures, registers and records — from professional templates.
• Implement, operate and provide evidence for the Annex A controls in a live environment.
• Plan and conduct an internal audit and a management review, and manage corrective actions.
• Prepare an organization for, and take it through, a Stage 1 and Stage 2 certification audit.

4. Who this is for & how you will work

This platform is designed for aspiring GRC and information-security professionals, IT and quality staff, and anyone preparing for the ISO/IEC 27001 Lead Implementer certification. In each section you will: (1) receive the scenario and the client materials, (2) study the relevant clause(s) of the standard, (3) produce the required deliverable using the supplied templates, and (4) submit it for assessment. Deliverables build on one another — the output of one milestone becomes the input of the next — so the ISMS grows exactly as it would in a real project.

5. Your journey — milestone roadmap

6. What's in this section

Before you begin the work, get to know your client and your role. This section contains:

• Client Organization Profile — everything you need to know about Meridian Specialist Hospital, including its regulatory context, IT environment and current security gaps.
• Organization Chart — the hospital's structure and where your new Information Security Office sits.
• Job Description — ISO/IEC 27001:2022 Lead Implementer — your official appointment and the deliverables expected of you.

What you will produce in this section

Section 1 has two deliverables. Together they turn your appointment letter into a working mandate and an honest starting point for the whole project.

Why this matters

Every later milestone in this platform references the charter and the baseline you set here. A vague mandate or an overly generous baseline will make Sections 2–9 harder, not easier – exactly as it would on a real engagement. Take the time to get these two right before moving on.

How to work

Both assignments include instructions, the exact structure to follow, assessment criteria and a downloadable template. Base your baseline ratings on the Client Organization Profile and your own judgement, not wishful thinking – a realistic "where we actually stand" is far more useful than an optimistic one.

Start here: read the three resources above in order, then proceed to Section 2 where you will begin the real work by analysing the context of the organization.

Now that you have been appointed as Meridian Specialist Hospital's ISO/IEC 27001:2022 Lead Implementer, your first task is to understand the organization before you build anything on top of it. Section 2 covers Clause 4 – Context of the Organization: the internal and external issues, the interested parties, and the scope that every later decision in this ISMS has to trace back to. An ISMS that isn't grounded in MSH's real context and obligations will not survive an audit – and, more importantly, it will not actually protect patient data.

What you will do in this section

Read the Business Context & Background Information Pack first – it is your primary source of evidence – then complete the four Clause 4 deliverables below, in order.

Why this matters

Clause 4 is the foundation the entire management system stands on. Your issues (4.1) and interested-party requirements (4.2) feed directly into the ISMS scope (4.3), the risk assessment in Clause 6, and the Statement of Applicability. Auditors trace every later decision back to this analysis – so build it thoroughly and back it with evidence. A thin Clause 4 undermines everything that follows it.

How to work

Each assignment gives you detailed instructions, the exact structure to follow, the assessment criteria, and a downloadable template. Base every entry on evidence from the Information Pack – and where the pack doesn't give you a fact, make a reasonable, clearly-stated assumption exactly as you would on a real engagement, and note it as such. Submit each deliverable for assessment before moving on to Section 3.

Start here: open the Business Context & Background Information Pack, read it in full, then begin Assignment 1.

An ISMS lives or dies by leadership. Section 3 covers Clause 5 – Leadership: top management has to demonstrate real commitment, establish an information security policy, and assign clear roles, responsibilities and authorities. Here you convert the Board's mandate into the governance backbone of Meridian Specialist Hospital's ISMS.

What you will do in this section

Read the Leadership Context & Board Mandate brief, then produce the three Clause 5 deliverables below. They build directly on the context work you completed in Section 2.

Why this matters

Auditors open Stage 1 by testing leadership: is there a signed, communicated policy? Can people describe their ISMS responsibilities? Is there evidence top management actually drives the system – a chartered steering committee, allocated resources, defined objectives? Weak leadership is the single most common reason ISMS implementations fail. Your Clause 5 outputs need to be concrete, signed off, and consistent with the context and interested-party requirements you documented in Section 2.

How to work

Each assignment gives you instructions, the required structure, the assessment criteria, and a downloadable template. Ground your policy commitments and roles in the actual MSH context: the regulatory obligations, the interested parties, and the organization chart from Section 1. Submit each deliverable before moving on to Section 4.

Start here: open the Leadership Context & Board Mandate brief, then begin Assignment 1.

This is the heart of the ISMS. Section 4 covers Clause 6 – Planning: you define how information-security risks and opportunities are handled, assess the risks, decide how to treat them, select controls, and record your applicability decisions in the Statement of Applicability. Everything you built in Sections 2 and 3 – context, interested parties, scope, policy – feeds directly into this work.

What you will do in this section

Read the Risk Context & Asset Inventory brief, then produce the four Clause 6 deliverables below, in order – each one is an input to the next.

Why this matters

The risk assessment and the SoA are the two documents an auditor scrutinises most closely, and both are mandatory documented information. A weak or generic risk assessment, or an SoA whose applicability decisions can't be justified against your risks, will stop certification in its tracks. Your methodology has to be repeatable, your risks have to be real and tied to the MSH context, and every one of the 93 Annex A controls needs a clear applicable/not-applicable decision with a stated reason.

How to work

Work the assignments in sequence: your methodology (1) sets the scales you use in the register (2); the controls you select to treat risks in (2) justify the "applicable" decisions in the SoA (3); and (4) turns the whole picture into measurable objectives. Ground everything in the asset inventory and threat scenarios provided, and in your Section 2 and 3 outputs. Each assignment includes instructions, structure, assessment criteria and a downloadable template.

Start here: open the Risk Context & Asset Inventory brief, then begin Assignment 1.

An ISMS only works if the organization resources it, builds the right competencies, raises awareness, communicates effectively, and controls its documented information. Section 5 covers Clause 7 – Support, where the governance you built in Sections 3 and 4 becomes part of everyday hospital life.

What you will do in this section

Read the Support Context brief, then produce the four Clause 7 deliverables below.

Why this matters

Clause 7 failures are common audit findings: staff who can't describe the policy, no evidence of awareness training, uncontrolled documents with no version history, or no record of competence. Auditors will ask employees what they know and will inspect your document control directly. The recent phishing incident and the risks you identified in Section 4 make the awareness programme (7.3) especially important here.

How to work

Ground each deliverable in the MSH context: the org chart and RACI from Section 3, the risks and objectives from Section 4, and the Support Context brief. Each assignment includes instructions, structure, assessment criteria and a downloadable template. Submit each before moving on to Section 6.

Start here: open the Support Context brief, then begin Assignment 1.

This is where the ISMS stops being paperwork and starts running. Section 6 covers Clause 8 – Operation: planning and controlling the processes needed to meet your requirements, implementing the risk-treatment plan, and keeping the risk assessment current. In practice, this is where the Annex A controls you selected in your Statement of Applicability get implemented and start generating evidence.

What you will do in this section

Read the Operations & Implementation Context brief, then produce the four Clause 8 deliverables below. These operationalise the risk treatment and SoA you built in Section 4.

Why this matters

At Stage 2, the auditor tests whether controls actually operate – not just whether policies exist. They will sample controls from your SoA and ask for evidence: records, logs, screenshots, tickets, minutes. A control marked "implemented" in the SoA with no operating evidence becomes a nonconformity. Clause 8.1 also requires you to control planned changes and the processes you outsource – for example, the HIS vendor and the cloud provider.

How to work

Drive everything from your Statement of Applicability and risk-treatment plan (Section 4). Your policies pack (3) provides the "how", your implementation tracker (2) drives the work, and your evidence log (4) proves it happened. Each assignment includes instructions, structure, assessment criteria and a downloadable template. Submit each before moving on to Section 7.

Start here: open the Operations & Implementation Context brief, then begin Assignment 1.

A management system has to prove it is working. Section 7 covers Clause 9 – Performance Evaluation: monitoring and measuring the ISMS, auditing it independently, and having top management review it. This is where you generate the evidence that the ISMS is effective – and find the gaps before the certification body does.

What you will do in this section

Read the Performance-Evaluation Context brief, then produce the four Clause 9 deliverables below.

Why this matters

These three processes are mandatory and heavily audited. The certification body expects defined metrics with real results and analysis (9.1); a completed internal audit covering the whole ISMS, run by competent and independent auditors (9.2); and management-review minutes that cover every required input and produce decisions on improvement and resources (9.3). Running a genuine internal audit now lets you fix nonconformities before Stage 2 finds them for you.

How to work

Measure against the objectives you set in Section 4 and the controls you implemented in Section 6. Your internal audit (2/3) tests the whole ISMS you have built across Sections 2–6, and its results – together with your metrics – become inputs to the management review (4). Each assignment includes instructions, structure, assessment criteria and a downloadable template. Submit each before moving on to Section 8.

Start here: open the Performance-Evaluation Context brief, then begin Assignment 1.

The ISMS has been measured and audited; now you make it better. Section 8 covers Clause 10 – Improvement: you take the nonconformities from your Section 7 internal audit and drive them to proper closure, and you establish how MSH will keep improving its ISMS going forward, not just react when something breaks.

What you will do in this section

Read the Improvement Context brief, then produce the three Clause 10 deliverables below. They build directly on your Section 7 audit findings.

Why this matters

Clause 10.2 requires more than fixing the immediate symptom: you have to evaluate the need for action to eliminate the cause, implement it, and review whether it actually worked. Auditors specifically look for the difference between a "correction" (fixing this instance) and a "corrective action" (stopping it recurring) – and they will sample your CAPA log for exactly that distinction. A perfectly clean audit with nothing to improve is itself a red flag: it suggests the review wasn't rigorous, not that the ISMS is flawless.

How to work

Transfer every finding from your MSH-24 Internal Audit Report into the CAPA log (1), then pick your single worst finding and run a genuine root-cause analysis for it in (2) – don't stop at the first plausible answer. Populate the improvement register (3) with items from varied sources: audit findings, near-misses, staff suggestions, and management-review outputs. Each assignment includes instructions, structure, assessment criteria and a downloadable template. Submit each before moving on to Section 9.

Start here: open the Improvement Context brief, then begin Assignment 1.

This is the finish line. Meridian Specialist Hospital's ISMS has been designed, implemented, measured, audited and improved. Section 9 is the Capstone – Certification Readiness milestone, where you prove the ISMS is actually ready for the certification body, exactly as a real Lead Implementer would before inviting an auditor in.

What you will do in this section

Read the Certification Readiness Context brief, then produce the four capstone deliverables below, in order – each one draws on every artefact you have produced since Section 1.

Why this matters

Stage 1 and Stage 2 are different tests, and confusing them is a common first-time mistake: Stage 1 checks whether the ISMS is documented and internally consistent; Stage 2 checks whether it actually operates, using objective evidence rather than policy citations. A self-assessment that scores every requirement "Ready" is itself a warning sign to an experienced auditor – a real ISMS at this stage almost always has some genuinely partial areas, and disclosing them honestly is a sign of a mature, functioning management system, not a weakness to hide.

How to work

Build the documentation index (1) first – it is your master cross-reference to every deliverable from Sections 1–8. Use it to run the Stage 1 self-assessment (2), then sample controls across all four Annex A themes plus Clauses 9 and 10 for the Stage 2 assessment (3). Finally, synthesise all three into the Executive Report (4): an honest, evidence-based recommendation the Board can actually act on. Each assignment includes instructions, structure, assessment criteria and a downloadable template.

Start here: open the Certification Readiness Context brief, then begin Assignment 1. Completing this milestone means you have taken an organization from zero to certification-ready, A to Z, using realistic data.