BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Definitive Conferencing - ECPv6.18.3.1//NONSGML v1.0//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Definitive Conferencing
X-ORIGINAL-URL:https://defincon.co.za
X-WR-CALDESC:Events for Definitive Conferencing
REFRESH-INTERVAL;VALUE=DURATION:PT1H
X-Robots-Tag:noindex
X-PUBLISHED-TTL:PT1H
BEGIN:VTIMEZONE
TZID:Africa/Johannesburg
BEGIN:STANDARD
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
TZNAME:SAST
DTSTART:20250101T000000
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
DTSTART;TZID=Africa/Johannesburg:20261202T080000
DTEND;TZID=Africa/Johannesburg:20261204T170000
DTSTAMP:20261028T101932Z
CREATED:20261028T101751Z
LAST-MODIFIED:20261028T101932Z
UID:3731-1796198400-1796403600@defincon.co.za
SUMMARY:Auditing Cyber Security & Information Security NIST & ISO 27002 Course
DESCRIPTION:This auditing cybersecurity and information security NIST ISO 27002 course is designed for internal auditors involved in IT audits or those interested in audit activities that require an understanding of how to manage the impact of cybersecurity events on business risks. This auditing cybersecurity and information security NIST ISO 27002 course allows auditors to examine preventive\, detective\, and corrective controls and how to apply the audit process to a cloud environment. \nAttendees will be exposed to the mobile environment and cyber standards\, and learn how to audit common security solutions — all through the lens of the NIST Cybersecurity Framework (CSF 2.0) and ISO 27002:2022. \nWho Should Attend?\nThis course is designed for those who need to understand and wish to undertake security audits\, including internal auditors involved in IT and cybersecurity audit activities. \nPlease review the content and course levels before booking to ensure you are attending the right course. \nCourse Content\nDay 1 — Foundations of Cybersecurity Auditing and Governance \nSession 1: Course Introduction and Overview of Cybersecurity\nIntroduction to course objectives\, cybersecurity landscape\, key business risks\, and the role of auditors in managing cybersecurity events. Overview of preventive\, detective\, and corrective controls. Introduction to NIST Cybersecurity Framework (CSF 2.0) and ISO 27002:2022 as audit references. \nSession 2: Cybersecurity Governance and Connections to Networking Concepts\nCybersecurity governance principles\, roles and responsibilities (board\, management\, auditors). NIST CSF Governance function and ISO 27002 organisational controls. Networking fundamentals relevant to audits including architecture\, protocols\, and common vulnerabilities. \nSession 3: Hacking\, Cyberwarfare\, and Internet Security\nCommon attack vectors\, threat actors\, and cyberwarfare implications from an audit lens. Auditing internet-facing controls\, firewalls\, and perimeter security using NIST/ISO mappings. Audit techniques for identifying weaknesses. \nSession 4: Cyber Security Governance Deep Dive and Audit Process\nAligning organisational governance with NIST and ISO 27002. Audit planning\, risk assessment\, and evidence collection for governance controls. Interactive exercise: mapping governance policies to NIST CSF and ISO 27002 controls. Case study on governance failures. \nDay 2 — Technical Controls\, Cloud\, Mobile\, and Encryption Auditing \nSession 1: Personal Data Security\, Encryption\, and Digital Certificates/Identities\nEncryption principles\, key management\, and data protection controls. Digital certificates\, PKI\, and identity management auditing. Audit procedures for data classification and protection. \nSession 2: Wireless Security\, Mobile Security\, and Cloud Environment Auditing\nWireless and mobile threats and controls including Wi-Fi security\, device management\, and BYOD. Auditing cloud environments: shared responsibility model\, configuration management\, and controls using NIST Cloud Computing resources and ISO 27002. Practical audit checklists for IaaS/PaaS/SaaS. \nSession 3: Auditing Common Security Solutions\nFirewalls\, IDS/IPS\, endpoint protection\, access controls\, and vulnerability management. Mapping to NIST Protect/Detect functions and ISO 27002 technical controls. Hands-on exercise: reviewing sample security solution configurations from an audit perspective. \nSession 4: Audit Application and Case Studies\nIntegrating preventive\, detective\, and corrective controls in audits. Group activity: develop audit test plans for cloud and mobile scenarios\, common pitfalls\, and best practices. \nDay 3 — Incident Response\, Forensics\, Legal Aspects\, and Audit Closure \nSession 1: Digital Forensics and Investigations\nForensics principles\, evidence handling\, and chain of custody in audits. Integrating forensics readiness into security programmes. Audit review of investigation processes. \nSession 2: Computer Security Incident Response Teams (CSIRTs) and Incident Management\nCSIRT structures and incident response lifecycle using NIST CSF Respond/Recover functions. Auditing incident detection\, response\, and recovery controls including metrics\, reporting\, and continual improvement. \nSession 3: Legal Framework in South Africa\nOverview of key laws: Protection of Personal Information Act (POPIA)\, Cybercrimes Act\, and other relevant regulations. Auditor responsibilities regarding data breaches\, privacy\, and compliance. Mapping South African requirements to NIST/ISO for integrated audits. Case studies on compliance failures and audit findings. \nSession 4: Course Integration\, Best Practices\, and Assessment\nHolistic audit approach combining all elements into a comprehensive cybersecurity audit. Reporting findings\, recommendations\, and follow-up. Emerging trends\, auditor toolkit (checklists and tools)\, final exercise\, Q&A\, and certificate of completion. \nTopics Covered\n\nOverview of cybersecurity\nCybersecurity connections to networking concepts\nHacking and cyberwarfare\nInternet security\nPersonal data security and encryption\nWireless security and mobile security\nDigital certificates and identities\nDigital forensics and investigations\nComputer Security Incident Response Teams (CSIRTs)\nLegal framework (South Africa — POPIA & Cybercrimes Act)\nCyber security governance\n\n\nContact:\nProject Coordinator: CPD and Events\nmduduzi@governanceacademy.co.za | 011 609 1761 Ext 403 \nLeadership Academy
URL:https://defincon.co.za/event/auditing-cyber-security-information-security-nist-iso-27002-course/
LOCATION:Definitive Conference Center\, ext\, Corner of Definitive Lane &\, Kruin St\, Harmelia\,\, Germiston\, Gauteng\, 1619\, South Africa
CATEGORIES:Training Workshop
ATTACH;FMTTYPE=image/jpeg:https://defincon.co.za/wp-content/uploads/2026/10/Auditing-Cyber-Security-and-information-Security-NISTISO.jpeg
ORGANIZER;CN="Leadership Academy":MAILTO:neo@governanceacademy.co.za
END:VEVENT
END:VCALENDAR