Information Security Management SystemsSillabus

Fənn kodu

IF-2207y-EN

Kredit

5

Tələbənin iş yükü

135

Semestr

Payız semestri

Akademik il

3

Fənnin tipi

Məcburi

Təhsil forması

Əyani

Tədris dili

Azərbaycan

Auditoriyadaxili saatlar

a) 30 hours – lectures b) 30 hours – laboratory classes

Auditoriyadan kənar saatlar

a) 80 hours – independent study b) 55 hours – project work and consultation

This course introduces the principles, frameworks, and practices of Information Security Management Systems (ISMS) for protecting organizational information assets. It covers information security governance, risk assessment and management, security policies, asset management, access control, incident management, business continuity, compliance, and security monitoring. The course also examines internationally recognized standards and frameworks, including ISO/IEC 27001, ISO/IEC 27002, NIST, and related risk management practices. Students will develop an understanding of how to establish, implement, maintain, and continuously improve an ISMS to ensure the confidentiality, integrity, and availability of information within organizations.

• mühazirə
• seminar
• problem-based learning
• komanda işi
• təqdimatlar
• layihə əsaslı öyrənmə
• interaktiv müzakirə

1. 1

   CLO 1: Explain and apply the fundamental principles and elements of information security management systems (ISMS) and the application areas of frameworks such as ISO/IEC 27001, NIST and COBIT

2. 2

   CLO 2: Identify and assess an organization’s cyber risks and select appropriate managerial and technical measures to mitigate them.

3. 3

   CLO 3: Develop information security policies, procedures and controls and justify their implementation.

4. 4

   CLO 4: Identify security incidents and develop an incident response plan (IRP) and business continuity/disaster recovery plans (BCP/DRP).

5. 5

   CLO 5: Plan audit and compliance processes, analyze evidence and report the findings.

6. 6

   CLO 6: Plan and implement an information security management project individually or as part of a team, and analyze and present the results.

1. 1.
   Cybersecurity Fundamentals and PrinciplesMühazirə

   This course introduces the fundamental concepts, principles, and practices of cybersecurity. It covers key security objectives, including confidentiality, integrity, and availability, as well as authentication, authorization, access control, risk management, threat and vulnerability assessment, and security policies. Students will examine common cyber threats and attack vectors, including malware, phishing, social engineering, network attacks, and unauthorized access. The course also introduces basic cybersecurity frameworks, defense mechanisms, and security best practices for protecting information systems, networks, and digital assets.

2. 2.
   Compliance with StandardsMühazirə

   This course introduces the principles and practices of compliance with information security standards, regulations, and organizational requirements. It covers major cybersecurity and information security standards and frameworks, including ISO/IEC 27001, ISO/IEC 27002, NIST, and relevant regulatory requirements. Students will examine compliance assessment, security controls, documentation, risk management, audit processes, and continuous improvement. Emphasis is placed on understanding how organizations establish and maintain compliance, identify gaps, and implement appropriate controls to meet applicable security and regulatory requirements.

3. 3.
   Information Security Management System (ISMS)Mühazirə

   This course provides an in-depth introduction to Information Security Management Systems (ISMS) and their role in managing organizational information security. It covers the establishment, implementation, operation, monitoring, maintenance, and continual improvement of an ISMS in accordance with recognized standards such as ISO/IEC 27001. Students will study information security policies, asset management, risk assessment and treatment, security controls, access management, incident management, internal audits, and management review. The course emphasizes a systematic and risk-based approach to protecting information assets and maintaining confidentiality, integrity, and availability.

4. 4.
   Asset Management and Security PoliciesMühazirə

   This course covers the principles and practices of information asset management and the development and implementation of organizational security policies. It examines asset identification, classification, ownership, inventory management, risk assessment, and lifecycle management. Students will also study the structure and purpose of information security policies, including acceptable use, access control, data protection, and incident reporting policies. Emphasis is placed on aligning security policies with organizational objectives, regulatory requirements, and recognized information security standards.

5. 5.
   Risk ManagementMühazirə

   This course introduces the fundamental principles and practices of information security risk management. It covers the identification of information assets, threats, vulnerabilities, and potential impacts, as well as risk assessment, analysis, evaluation, and treatment. Students will examine qualitative and quantitative risk assessment methods, risk mitigation strategies, risk acceptance, transfer, avoidance, and monitoring. The course also focuses on developing risk management processes aligned with organizational objectives, security requirements, and recognized standards and frameworks.

6. 6.
   Organizational and Personnel SecurityMühazirə

   This course examines the organizational and personnel-related aspects of information security. It covers security roles and responsibilities, segregation of duties, personnel screening, security awareness and training, confidentiality requirements, acceptable use, and secure employee lifecycle management. Students will study how human factors and organizational processes can affect information security and explore measures for reducing insider threats, human error, and unauthorized access. Emphasis is placed on establishing a security-aware organizational culture and implementing appropriate administrative and personnel security controls.

7. 7.
   Physical SecurityMühazirə

   This course introduces the principles and practices of physical security for protecting information systems, facilities, equipment, and other organizational assets. It covers physical access control, security zones, surveillance systems, environmental protection, fire and power protection, equipment security, and protection against unauthorized physical access or damage. Students will examine physical security risks and vulnerabilities and learn how to implement appropriate preventive, detective, and corrective controls to support the confidentiality, integrity, and availability of information assets.

8. 8.
   Technological SecurityMühazirə

   This course introduces the principles, technologies, and practices used to protect information systems, networks, applications, and digital assets from cyber threats. It covers technical security controls, authentication and access control, network security, endpoint protection, encryption, vulnerability management, secure configuration, monitoring, and incident detection. Students will examine common technological threats and security mechanisms and learn how to apply appropriate technical controls to protect the confidentiality, integrity, and availability of organizational information resources.

9. 9.
   Incident ManagementMühazirə

   This course introduces the principles and processes of information security incident management. It covers incident identification, reporting, classification, analysis, prioritization, response, containment, eradication, recovery, and post-incident review. Students will examine incident response procedures, roles and responsibilities, evidence preservation, communication, and documentation requirements. Emphasis is placed on developing effective incident response capabilities to minimize the impact of security incidents and support the continuous improvement of organizational security.

10. 10.
    Security Operations Center (SOC)Mühazirə

    This course introduces the structure, functions, and operational processes of a Security Operations Center (SOC). It covers security monitoring, log collection and analysis, threat detection, alert triage, incident investigation, and incident response. Students will examine the roles and responsibilities of SOC personnel, SIEM and security monitoring technologies, threat intelligence, endpoint and network security monitoring, and security incident workflows. Emphasis is placed on developing practical skills for detecting, analyzing, and responding to cybersecurity threats in organizational environments.

11. 11.
    Information Security Controls and AuditMühazirə

    This course introduces the principles of information security controls and auditing processes used to evaluate and improve an organization’s security posture. It covers administrative, technical, and physical controls, control objectives, implementation, monitoring, and effectiveness assessment. Students will examine security audit planning, evidence collection, control testing, compliance assessment, audit findings, risk identification, and corrective actions. Emphasis is placed on evaluating the effectiveness of security controls and supporting continuous improvement in accordance with organizational requirements and recognized security standards.

12. 12.
    Evaluating the Effectiveness of an Information Security Management SystemMühazirə

    This course focuses on evaluating the effectiveness, performance, and maturity of an Information Security Management System (ISMS). It covers the development and use of security metrics, key performance indicators (KPIs), control effectiveness assessments, internal audits, compliance reviews, and management reviews. Students will learn how to identify gaps, assess security risks, analyze audit findings, and develop corrective and improvement actions. Emphasis is placed on continuous monitoring and improvement of the ISMS in alignment with organizational objectives, security requirements, and recognized standards such as ISO/IEC 27001.

13. 13.
    Management of Secure Software DevelopmentMühazirə

    This course introduces the principles and management practices of secure software development throughout the software development lifecycle (SDLC). It covers security requirements, secure architecture and design, secure coding practices, vulnerability management, code review, security testing, and secure deployment. Students will examine approaches such as Secure SDLC and DevSecOps and learn how to integrate security controls into development processes, manage software security risks, and address vulnerabilities from design through maintenance. Emphasis is placed on developing secure, reliable, and maintainable software while aligning development practices with organizational security requirements and standards.

14. 14.
    Security Testing Management and DevSecOpMühazirə

    This course introduces the principles and practices of security testing management and DevSecOps for integrating security throughout the software development lifecycle. It covers security testing strategies, vulnerability assessment, penetration testing, code analysis, dependency and container security, automated security testing, and continuous security monitoring. Students will examine DevSecOps practices and learn how to integrate security controls and automated testing into CI/CD pipelines, identify and manage vulnerabilities, and support secure software delivery. Emphasis is placed on continuous collaboration between development, security, and operations teams to improve software security and reduce security risks.

15. 15.
    Information Security Project ManagementMühazirə

    This course introduces the principles and practices of managing information security projects within organizational environments. It covers project planning, scope definition, resource allocation, scheduling, budgeting, risk management, stakeholder communication, and quality control. Students will examine how to identify and manage security-related project risks, define security requirements, coordinate project teams, and monitor project progress and outcomes. Emphasis is placed on applying project management methodologies to effectively plan, implement, and evaluate information security initiatives in alignment with organizational objectives and security requirements.

1. Nair, A., & Greeshma, M. R. Mastering Information Security Compliance Management. Packt Publishing, 2023.
2. Bayuk, J. L. Stepping Through Cybersecurity Risk Management: A Systems Thinking Approach. John Wiley & Sons, 2024.
3. Maleh, Y., Sahid, A., Alazab, M., & Belaissaoui, M. IT Governance and Information Security: Guides, Standards, and Frameworks. CRC Press, 2022.
4. Basta, A., Basta, N., Anwar, W., & Essar, M. I. Open-source Security Operations Center (SOC): A Complete Guide to Establishing, Managing, and Maintaining a Modern SOC. John Wiley & Sons, 2025.
5. Brumfield, C. Cybersecurity Risk Management: Mastering the Fundamentals Using the NIST Cybersecurity Framework. John Wiley & Sons, 2022.
6. Thompson, E. C. Cybersecurity Incident Response: How to Contain, Eradicate, and Recover from Incidents. Apress, 2018
7. Susanto, H., & Almunawar, M. N. Information Security Management Systems: A Novel Framework and Software as a Tool for Compliance with Information Security Standard. Apple Academic Press, 2018.
8. ISO/IEC 27001:2022. Information Security Management Systems – Requirements.
9. ENISA Publications: https://www.enisa.europa.eu/publications