ISO 27001 Intro

A graduate of the Faculty of Electrical Engineering, Czech Technical University in Prague. Since 2005 he has worked as a lead auditor for accredited certification bodies for ISO/IEC 27001, ISO/IEC 20000-1, ISO 9001 and ISO 50001, with dozens of certification and surveillance audits in public administration, healthcare, telecommunications, energy and banking, including audits abroad. As a consultant he has prepared a number of companies for ISO/IEC 27001 certification, he has audited bank identity services under the eIDAS regulation and since 1989 he has been a court-appointed expert witness in computing and economics. At TAYLLORCOX he teaches ISO 27001, the Czech Cyber Security Act and GDPR, and he also trains the auditors of certification bodies: so in his course you hear exactly what a certification audit will ask.

What is his course like?

No reading the standard aloud. He presents every ISO/IEC 27001 requirement the way an auditor verifies it: what evidence the auditor wants to see, where companies most often fail and what is a minor finding that can be fixed within a week. Participants leave prepared not only for the exam, but with a realistic picture of how to pass a certification audit and how to lead one themselves.

For more than fifteen years she has managed information security, risk management and data privacy in international corporations in the Czech Republic and the United Kingdom, from electronics and energy to pharmaceuticals and the public sector. She headed service operations for the UK and Ireland, including business continuity plans and their testing, assessed the cyber security of global suppliers and designed and delivered cyber security risk management courses for UK government institutions based on the NCSC framework. She is a CISM, an ISO/IEC 27001 Lead Auditor and Lead Implementer and an ISO 22301 Business Continuity Manager, holds a Senior Executive MBA and is pursuing a PhD in information security at Royal Holloway, University of London. She speaks at international conferences (GISEC, #RISK, PrivSec, ISACA London) and at TAYLLORCOX she teaches ISO 27001, ISO 27005 Risk Manager and ISO 22301 with the perspective of a practitioner who does not just audit the standards but has implemented them in corporations herself. She teaches in Czech and English.

What is her course like?

She teaches ISO 27001 the way it is used in the boardroom and in IT: from risk analysis through the selection of controls to the evidence an auditor wants to see. She brings in cases from corporations, supply chains and the UK public sector, where she dealt with cyber risks for real, and leads participants to be able to defend the standard in front of their management and the certification body alike.

For twenty years he worked where IT really breaks: he administered thousands of servers, designed networks for T-Mobile, built branch infrastructure from Ukraine to India and managed the migration of 60,000 computers for Société Générale. DHL contracted him into its security teams three times. He therefore knows ISO/IEC 27001 from both sides: as the infrastructure administrator whose door the audit knocks on, and as a certified Cyber Security Manager, Auditor and Architect under the Czech Cyber Security Act.

What is his course like?

He does not read the standard to you, he shows it in operation. He turns every Annex A control into a concrete setting: what access control that satisfies an auditor looks like, what logging you can actually investigate an incident from involves, and how to spot a backup nobody has ever restored. As a Certified Ethical Hacker and a Certified EC-Council Instructor he adds the attacker's view: why a given control is in the standard at all and what happens when it is missing.

On top of that, three things an online course cannot offer: teaching in Czech, groups of 7 to 12 people and dialogue. You can ask about situations from your own company and get an answer from someone who has most likely dealt with a similar one. He trains both technicians and company management, mainly in banking and telecommunications: he can present the same topic to server administrators and to the board's security committee alike.

Numbers instead of adjectives

• Thousands of trained graduates
• 5/5 average participant rating
• Since 2015 a TAYLLORCOX trainer
• 20 years of experience in IT operations and cyber security
• 98 %+ certification exam pass rate of his graduates
• 10 to 15 training days a month: teaching is not a side job but a craft