ISO 27001 & ISO 27701 Training: Run Security and Privacy as One System
A four-day integrated Lead Implementer course covering ISO/IEC 27001 and ISO/IEC 27701 together — one risk assessment, one Statement of Applicability, one internal audit. Built for teams who will implement both standards and do not want to pay for the same work twice. Mapped throughout to India’s DPDP Act 2023.
- Duration
- 4 days
- Format
- Live online
- Timing
- 10:00–18:00 IST
- Fee
- ₹26,500 + GST
- Next batch
- 14, 15, 21 & 22 Nov 2026
- Exam
- Included, 1 free retake
Get fee, dates & brochure
4 days · Live online · Exemplar Global certificate
One management system, two standards
The ISO/IEC 27001 & ISO/IEC 27701 Integrated Management System course teaches you to build and run information security and privacy as a single management system — one risk assessment, one Statement of Applicability, one internal audit — rather than two sets of documents maintained in parallel.
It runs over four days across two weekends, starts from first principles, and assumes no prior ISO 27001 knowledge. The fee is ₹26,500 + GST and includes the exam with one free retake.
Why integrate
ISO 27701:2025 is a standalone standard — but most teams still run it with ISO 27001
ISO/IEC 27701:2025 is a standalone management system standard. It has its own clauses 4–10 and its own privacy risk assessment process, and it can be certified without ISO/IEC 27001. This is a change from the 2019 edition, which was written as an extension to ISO 27001 and ISO 27002 and could only be certified alongside them.
Even so, most teams still implement both — customers ask for security and privacy assurance together, and the two standards share most of their machinery. Running them as separate projects costs more than it needs to: two risk assessments, two control sets, two audit programmes and two sets of evidence, where one of each would have served both.
What integration actually saves you
- One risk assessment covering information security risk and privacy risk, rather than two registers that drift apart.
- One Statement of Applicability covering the ISO 27001 Annex A controls and the ISO 27701 Annex A privacy controls, instead of two parallel documents.
- One internal audit programme and one management review covering both scopes.
- One certification audit cycle, which is where the commercial saving is largest.
- One evidence set — policies, records and logs that answer both standards at once.
Day four of this course is spent entirely on that integration work. It is the part that distinguishes this course from taking ISO 27001 and ISO 27701 as two separate programmes.
Syllabus
The four-day agenda
Four days, 10:00–18:00 IST, delivered live online across two consecutive weekends. Days one and two build ISO 27001 from the ground up; day three layers privacy on top; day four puts them together.
Day 1 — Management system foundations and ISO/IEC 27001 clauses 4–10
- What a management system is, and what certification does and does not prove
- The ISO/IEC 27001:2022 structure and the Annex SL common clauses
- Clause 4 — context of the organisation, interested parties, defining scope
- Clause 5 — leadership, policy, roles and responsibilities
- Clause 6 — information security risk assessment and risk treatment
- Clauses 7–10 — support, operation, performance evaluation, improvement
- Workshop: drafting a defensible ISMS scope statement
Day 2 — Annex A controls and the Statement of Applicability
- The 93 Annex A controls and the four themes: organisational, people, physical, technological
- Control attributes and how to use them
- Risk treatment: selecting controls against assessed risk rather than against a checklist
- Building the Statement of Applicability, including justified exclusions
- Documented information — what ISO 27001 actually requires you to keep
- Workshop: risk assessment through to a completed SoA extract
Day 3 — ISO/IEC 27701:2025, the privacy management system
- PIMS concepts: PII, PII principal, PII controller, PII processor
- The ISO 27701:2025 clauses 4–10, read side by side against ISO 27001's
- What changed in the 2025 edition — standalone certification, and what it means if you already hold ISO 27001
- Annex A privacy controls for PII controllers and processors; Annex B implementation guidance
- Determining your role — and the common mistake of assuming you are only a processor
- Mapping ISO 27701 to India's DPDP Act 2023 and the DPDP Rules 2025
- Mapping ISO 27701 to GDPR, and where the two diverge
- Workshop: extending the day-two SoA with privacy controls
Day 4 — Running them as one system, and the exam
- Designing a single integrated scope covering both standards
- Combining security and privacy risk into one assessment and one register
- One integrated SoA, one document set, one evidence trail
- Planning an internal audit that covers both standards in a single pass
- Management review for an integrated system
- The certification route: ISO 27001 first, or both together?
- Implementation roadmap you take back to your organisation
- Certification exam
Certification
Exam, certificate and what it proves
The certification exam is written on day four and is included in the fee. If you do not pass, you get one free retake.
Your certificate
Successful candidates receive an Exemplar Global approved certificate. It is a personal competence certificate: it certifies that you have been assessed as competent to implement an integrated ISO/IEC 27001 and ISO/IEC 27701 management system.
It does not certify your organisation. Organisational certification to ISO/IEC 27001 and ISO/IEC 27701 — together or separately — is awarded by an accredited certification body after an external audit. This course prepares you to lead that work.
Certificates issued by Pricoris can be checked at any time on our certificate verification page.
What you get
What’s included in the fee
- Four days of live online instruction, 10:00–18:00 IST
- Certification exam, with one free retake
- Exemplar Global approved certificate on passing
- Course materials and workshop templates
- Session recordings
- Doubt-clearing support after the course
Work you can take back to the office
The workshops are built around artefacts you will actually need: a scope statement, a combined risk register, an integrated Statement of Applicability and an implementation roadmap. You leave with drafts of each, not just notes about them.
Your trainer
Learn from Aashish Panchwadkar
Aashish Panchwadkar
Trainer, ISO/IEC 27001 & ISO/IEC 27701 Integrated Management System
Aashish delivers the integrated ISO 27001 and ISO 27701 course for Pricoris, live and online.
Fees
Information security and privacy courses and fees
All fees are per participant and exclude GST. The integrated course covers both standards for less than the two courses taken separately.
| Course | Days | Fee (+ GST) |
|---|---|---|
| ISO/IEC 27001 & ISO/IEC 27701 Integrated Management System | 4 | ₹26,500 |
| ISO/IEC 27001 Lead Implementer | 3 | ₹26,500 |
| ISO/IEC 27701 Lead Implementer (including DPDP) | 3 | ₹32,500 |
| ISO/IEC 27001 Lead Auditor | 4 | ₹36,500 |
| DPDP Act & Rules Lead Implementer | 2 | ₹16,500 |
Who it’s for
Who should take this course
- Teams implementing ISO 27001 who know privacy is coming next. Building the ISMS with ISO 27701 in mind from day one is far cheaper than retrofitting it afterwards.
- Organisations already certified to ISO 27001 that now need to demonstrate privacy compliance to customers or regulators.
- Indian organisations working through DPDP Act obligations that want a certifiable framework rather than a documentation exercise.
- Information security managers, DPOs, privacy leads, compliance managers, IT managers and consultants responsible for either or both standards.
- Internal auditors who will have to audit an integrated system.
Prerequisites
None. The course starts from management system fundamentals and builds up. Prior exposure to ISO 27001 is useful but is not assumed or required.
Standards you will work with
| Standard | Role in this course |
|---|---|
| ISO/IEC 27001:2022 | The base management system — requirements and Annex A controls |
| ISO/IEC 27701 | The privacy extension — PIMS requirements and controller/processor controls |
| ISO/IEC 27002 | Implementation guidance for the Annex A controls |
| DPDP Act 2023 & DPDP Rules 2025 | The Indian legal obligations the PIMS is mapped against |
| GDPR | Mapped where organisations have EU exposure |
Rolling out an integrated system across a team?
We deliver this course as closed corporate training, built around your own scope, your own risk register and your own documentation. Get in touch to discuss dates and group pricing.
FAQ
Frequently asked questions
What is the fee for the integrated ISO 27001 and ISO 27701 course?
₹26,500 plus GST per participant for the four-day course. The fee includes the certification exam, one free retake, course materials, session recordings and the Exemplar Global approved certificate on passing.
How long is the course and when does it run?
Four days, 10:00 to 18:00 IST, delivered live online. The next batch runs on 14, 15, 21 and 22 November 2026 — two consecutive weekends, Saturday and Sunday.
Can ISO 27701 be certified without ISO 27001?
Yes, since the 2025 edition. ISO/IEC 27701:2025 is a standalone management system standard with its own clauses 4–10 and its own privacy risk assessment process, and it can be certified without ISO 27001. Under the 2019 edition it was an extension to ISO 27001 and could only be certified alongside it. Most organisations still choose to hold both, because customers ask for security and privacy assurance together.
Why take an integrated course instead of the two separately?
Because in practice you will run one management system, not two. An integrated approach gives you one risk assessment, one Statement of Applicability, one internal audit programme and one certification cycle covering both standards. Day four of this course is devoted to that integration work. It is also four days rather than six, at a lower combined fee.
Do I need prior ISO 27001 knowledge?
No. The course starts from management system fundamentals. Days one and two build ISO 27001 from the ground up before privacy is introduced on day three.
What certificate do I receive?
An Exemplar Global approved certificate, awarded on passing the exam. It is a personal competence certificate confirming that you have been assessed as competent to implement an integrated ISO 27001 and ISO 27701 management system. Pricoris certificates can be checked on our certificate verification page.
What happens if I fail the exam?
You get one free retake included in the fee.
Does this certify my organisation to ISO 27001 or ISO 27701?
No. This is a personal competence certificate. Certifying an organisation requires an external audit by an accredited certification body. This course prepares you to lead the implementation and take the organisation into that audit.
How does ISO 27701 relate to India’s DPDP Act?
ISO 27701 gives you a certifiable framework; the DPDP Act 2023 and the DPDP Rules 2025 give you legal obligations. They overlap substantially but are not identical — the DPDP Act has India-specific requirements around consent, notice and data principal rights that ISO 27701 does not cover on its own. Day three maps one against the other and shows where the gaps sit.
Is there an official certification for DPDP Act compliance?
There is no official government certificate for DPDP Act compliance in India. Organisations demonstrate compliance through controls, audits and documentation — which is one reason an ISO 27701-based PIMS is a useful way to evidence it.
Is the course delivered online or in a classroom?
Live online, with the trainer present throughout. Sessions are recorded and recordings are shared with participants.
Can you run this for my team privately?
Yes. We deliver the course as closed corporate training built around your own scope and documentation. Contact us to discuss dates and group pricing.