ISO 27001 audit in Windows server environment
Information and cyber security practically in the Windows environment according to the requirements of the ISO / IEC 27001 and ISO / IEC 27002 standards is the basic building block for the development of applications and services in this environment. You will also appreciate this knowledge when preparing for the certification of your products and services according to ISO 27001.
Virtual Training or e-Learning?
We offer flexibility. You can choose from our selection of in-class courses as well as online courses.
Try a live virtual courseTarget audience
Auditors, managers, security consultants, developers, IT administrators, and others who work in or implement products and services subject to ISO / IEC 27001 and ISO / IEC 27002 standards.
The course is also suitable for those who want to learn practical security for the right management decisions and justification of measures in the Windows environment, Active Directory and networks in general.
Aims of the course
You will learn:
- How to certify products and services over Windows
- How to secure a Win environment according to ISO 2700x
- How to perform a security audit in a Windows environment
- Practical measure of ISO 2700x standards on Windows + Active Directory
- Preparation of internal and certification audit only after defense before auditors
Benefits
Windows PCs, laptops, servers, and especially domain controllers, AD DS (Active Directory Domain Services) are exposed to a number of potential security risks.
From the point of view of safety, it is necessary to identify risks (risk analysis), monitor and evaluate. For these cases, Windows uses event logs, resp. Event Logs. Here you will find valuable information about all situations.
But how to work with these logs? We will teach you to analyze Event logs, evaluate them, set the basic principles of auditing, and we will go much further. You will master automated storage, sorting and processing. Throughout the plethora of information, you can choose the important ones and take fundamental measures.
Why Windows and ISO 27001
The ISO 27000 series standards are a pillar of information and cyber security. A number of modifications have emerged from these standards, such as the Cyber Security Act, the EU GDPR Regulation, or the security of PCI DSS payment cards.
While the ISO 27001 standard specifies requirements for the implementation and certification of the ISMS (Information Security Management System).
The ISO 27002 standard contains a detailed overview (catalog) of safety measures that must be used to meet the requirements of the ISO 27001 standard.
.png "ISO 27001")
Agenda
Day 1Hide agendaOpen agenda
09:00 - 17:00
ISMS Introduction
- ISO/IEC 27001 and ISO 27002
- Information Security Management System
ISO 27001 Audit
- Audit principles
- Requirements and practical examples
ISO 27002 Requirements
- Windows + Active Directory
- ISO 2700x standards in Win environment
Day 2Hide agendaOpen agenda
09:00 - 17:00
Information Security Policies
- practical example in a virtual Windows lab
System Acquisition, Development and Maintenance
- practical example in a virtual Windows lab
Supplier Relationships
- practical example in a virtual Windows lab
Day 3Hide agendaOpen agenda
09:00 - 17:00
Human Resource Security
- practical example in a virtual Windows lab
Access Control
- practical example in a virtual Windows lab
Asset Management
- practical example in a virtual Windows lab
Day 4Hide agendaOpen agenda
09:00 - 17:00
Communications Security
- practical example in a virtual Windows lab
Cryptography
- practical example in a virtual Windows lab
Information Security Incident Management
- practical example in a virtual Windows lab
Day 5Hide agendaOpen agenda
09:00 - 17:00
Physical & Environmental Security
- practical example in a virtual Windows lab
Operations Security
- practical example in a virtual Windows lab
Information Security Aspects of Business Continuity Management
- practical example in a virtual Windows lab
Conclusion
- summary
- exam tips
Windows Server and Security according to the ISO 2700x standard. All this is demonstrated from a practical point of view in a Windows environment (PC, Laptops, Networks, Servers). You will learn techniques that no security manager can do without today.
- Block duration 90 minutes
- Hours 40 hours
- Refreshments Yes
- Exam Yes
Prerequisites
Passive knowledge of ISO standards is recommended, especially ISO 2700x, Win environment, TCP / IP and DNS. However this course can be tailored to the organization, so it does not require any specific knowledge.
Vladimír Ráb
For twenty years he worked where IT really breaks: he administered thousands of servers, designed networks for T-Mobile, built branch infrastructure from Ukraine to India and managed the migration of 60,000 computers for Société Générale. DHL contracted him into its security teams three times. He therefore knows ISO/IEC 27001 from both sides: as the infrastructure administrator whose door the audit knocks on, and as a certified Cyber Security Manager, Auditor and Architect under the Czech Cyber Security Act.
What is his course like?
He does not read the standard to you, he shows it in operation. He turns every Annex A control into a concrete setting: what access control that satisfies an auditor looks like, what logging you can actually investigate an incident from involves, and how to spot a backup nobody has ever restored. As a Certified Ethical Hacker and a Certified EC-Council Instructor he adds the attacker's view: why a given control is in the standard at all and what happens when it is missing.
On top of that, three things an online course cannot offer: teaching in Czech, groups of 7 to 12 people and dialogue. You can ask about situations from your own company and get an answer from someone who has most likely dealt with a similar one. He trains both technicians and company management, mainly in banking and telecommunications: he can present the same topic to server administrators and to the board's security committee alike.
Numbers instead of adjectives
- Thousands of trained graduates
- 5/5 average participant rating
- Since 2015 a TAYLLORCOX trainer
- 20 years of experience in IT operations and cyber security
- 98 %+ certification exam pass rate of his graduates
- 10 to 15 training days a month: teaching is not a side job but a craft
- Certified Cyber Security Manager, Auditor and Architect under the Czech Cyber Security Act, Accredited Trainer ISMS ISO/IEC 27001
- Certified Ethical Hacker (CEH), Certified EC-Council Instructor (CEI), Certified Network Defender (CND), EC-Council Incident Handler (ECIH), CCISO; CompTIA certifications across the portfolio he teaches
- Microsoft (MCSE, MCSA) and Cisco (CCNP Security); TAYLLORCOX trainer since 2015 with a certification exam pass rate of over 98 %
Jan Cuřín
A graduate of the Faculty of Electrical Engineering, Czech Technical University in Prague. Since 2005 he has worked as a lead auditor for accredited certification bodies for ISO/IEC 27001, ISO/IEC 20000-1, ISO 9001 and ISO 50001, with dozens of certification and surveillance audits in public administration, healthcare, telecommunications, energy and banking, including audits abroad. As a consultant he has prepared a number of companies for ISO/IEC 27001 certification, he has audited bank identity services under the eIDAS regulation and since 1989 he has been a court-appointed expert witness in computing and economics. At TAYLLORCOX he teaches ISO 27001, the Czech Cyber Security Act and GDPR, and he also trains the auditors of certification bodies: so in his course you hear exactly what a certification audit will ask.
What is his course like?
No reading the standard aloud. He presents every ISO/IEC 27001 requirement the way an auditor verifies it: what evidence the auditor wants to see, where companies most often fail and what is a minor finding that can be fixed within a week. Participants leave prepared not only for the exam, but with a realistic picture of how to pass a certification audit and how to lead one themselves.
- Lead Auditor ISMS ISO/IEC 27001, ITSM ISO/IEC 20000-1 and ISO 9001 for accredited certification bodies
- Certified Cyber Security Manager, Auditor and Architect under the Czech Cyber Security Act; Approved Trainer & Lead Auditor GDPR
- Risk Manager ISO/IEC 27005, court-appointed expert witness in computing and economics
Petra Dytrychová
A graduate of the Czech Technical University in Prague. For more than six years she managed the management systems at České Radiokomunikace, where, as the company's only Lead Auditor, she led internal ISMS audits under ISO/IEC 27001, ISO/IEC 20000-1 and the Czech Cyber Security Act in an environment of electronic communications, digital infrastructure and cloud services with high demands on availability and regulatory compliance. In 2024 she single-handedly guided Cloud4Com to a successful ISO/IEC 27001 certification. At TAYLLORCOX she trains and audits ISO 27001, NIS2 and the new Czech Cyber Security Act: not only what the standard says, but how to implement it so that it stands up to the certification audit and to everyday operations.
- Lead Auditor ISMS ISO/IEC 27001, ISO/IEC 20000-1 and the Czech Cyber Security Act
- Certified Cyber Security Manager and Cyber Security Auditor under NIS2, Act No. 264/2025 Coll. and Decree No. 409/2025 Coll.
- Lead Auditor ISO/IEC 42001 (AI Management System)
Methodology
The content of the course is minimized in theory. Each chapter is closed by a separate exercise in a virtual environment.
This environment is licensed by Cyber Security iLabs, special testing labs that are available to each participant and its price is part of the course.
Graduate ratings
What makes our references exceptional? They are not one-off events. Clients come back to us regularly.
View the full list of reference clients.
Recently viewed
Not sure if this is the right courese for you? Get in touch!
For assistance please give us a call.
We are available at +420 222 553 101 Always Monday to Friday: 9am - 5pm.
Cannot call? Send us a message.
Would you like a gift for your birtday?
