【International】Certifcation Brief -- ISO 27001 LA(證照簡介─ISO27001 主導稽核員)

ISO 27001 IRCA refers to the ISO/IEC 27001 Information Security Management System Lead Auditor Course and Qualification certified by the International Register of Certified Auditors (IRCA, now part of CQI). This is one of the most authoritative and internationally recognized professional audit training certifications in the global information security field. 

In Taiwan, the ISO 27001 Lead Auditor (LA) course typically costs NT$37,000-45,000. The course lasts five days, with a computer-based exam on the last afternoon, but the pass rate is very high. Passing this LA certification allows you to work as an ISO consulting agent at cybersecurity companies and also to bid on ISMS (Information Security Management System) projects for government agencies.

Course and Examination Focus: Course Hours: Typically 40 hours of intensive training (5 days). Standard Version: Currently, all courses adopt the latest ISO/IEC 27001:2022 standard. Examination Method: Most authorized training institutions use CQI and IRCA online computer examination systems for testing. 

Suitable for: Corporate cybersecurity chiefs, cybersecurity managers, and IT administrators. Those responsible for organizing internal audits and promoting and implementing Information Security Management Systems (ISMS). Professionals aspiring to become auditors for external verification agencies or cybersecurity consultants. The qualification demonstrates professional competence in assessing, auditing, and establishing information security management systems. It meets the professional certification and regulatory requirements of the Taiwan government's information and communication security responsibility levels.

To actually use this Lead Auditor (LA) certification, annual dues must be paid, and Continuing Professional Development (CPD) records and actual audit records must be submitted. Therefore, serving as an ISO 27001 consultant for a contractor (client) does not constitute actual audit record and does not qualify one as an IRCA Lead Auditor. This certification is only truly valid when serving as an Lead Auditor for a verification or certification body such as SGS or BSI.

Additional notes:

Attending the course (LAC) and passing the exam will earn you a Certificate of Achievement.

However, to become an IRCA registered auditor, further requirements such as paying fees and providing proof of auditing experience are necessary.

Core Qualification Requirements Overview

project	Specific requirements and conditions	Notes
1. Training Certificate	Complete the 5-day ISO 27001 LA course certified by IRCA and obtain the certificate of passing the exam.	The certificate is usually valid for 3 years (registration application must be submitted within 3 years, otherwise supplementary or updated courses are required).
2. Work experience	Must have at least 4 years of full-time work experience.	Work experience from any industry can be included.
3. Professional experience	Of the four years of work experience, at least two years must be in the field of Information Security Management System (ISMS) .	Examples include: cybersecurity maintenance, IT management, cybersecurity consulting, and cybersecurity system construction.
4. Audit experience	Must participate in at least 4 formal audits, with a total audit period of 20 days or more.	This is the most difficult threshold to reach . See below for a detailed definition.
5. Leading Experience	The audit must include at least 15 days of serving as a "Lead Auditor" .	Leading responsibilities must be fulfilled under the supervision and guidance of senior auditors.

My first encounter with ISO 27001 was in 2007 when I was working for a state-owned enterprise. At that time, the company was implementing ISO 27001, and the Bureau of Standards, Metrology and Inspection was conducting verification. The core of ISO 27001 is to first select a scope of application, such as the company's computer room or application systems. Then, it involves inventorying information assets. After identifying the assets, acceptable risk standards are established, followed by risk assessments of the assets' weaknesses and threats. Once the risk value of the assets is obtained, the available risk management options are "acceptance," "avoidance," "transfer," and "reduction."

In Annex A of ISO 27001:2022, you can see many "control measures". Most of these control measures are used to "reduce" risks. In the declaration of applicability, ISO 27001 requires that all control measures be specified in the ISO document. If any control measures are not applicable, the reasons must be clearly stated.

ISO files are divided into four levels:

Phase One: Information and Communications Security Policy

Second Stage: Information and Communication Security Manual

Third Stage: Information and Communication Safety Operation Procedures

Level 4: Tables and Forms

In summary, the ISO 27001 LA certification is often the first certification that many newcomers to the cybersecurity field consider. Previously, a five-day course was almost guaranteed to pass, and it was one of the certifications recognized by the Ministry of Digital Development. However, the market for this certification is not large. Working as a consultant in a consulting firm allows one to take on both private and government projects, earning around NT$1 million per project. If the goal is simply to serve as an internal auditor for the company being served, then only the ISO 27001 internal auditor course is needed. Currently in Taiwan, within the NT$1 million required for implementing ISO 27001, offering a course to train several colleagues to obtain ISO 27001 LA is not very profitable.

ISO 27001 IRCA 指的是由英國國際認證稽核員註冊機構（IRCA，現隸屬 CQI）所認證的 ISO/IEC 27001 資訊安全管理系統主導稽核員課程與資格。這是全球資訊安全領域中，最具權威與國際認可的專業稽核培訓認證之一。 

ISO27001的LA（主任稽核員）的課程，在台灣，通常是37000-45000元學費，5天的課程，最後一天下午上機考試，但考過的比例很高。考過此LA證照，就可以在資安公司接ISO輔導顧問的案子，也可以標公家機關ISMS的標案。

課程與考試重點課程時數：通常為 40 小時的密集訓練（5天）。標準版本：目前皆採用最新 ISO/IEC 27001:2022 標準規範。考試方式：多數授權訓練機構採用 CQI 與 IRCA 的線上電腦考試系統進行測驗。 

適合對象：企業資訊安全長、資安主管與 IT 管理人員。負責組織內部稽核、資訊安全制度（ISMS）推動與導入的承辦人員。想成為外部驗證機構稽核員或資安輔導顧問的專業人士。取得資格好處證明個人具備評鑑、稽核與建置資訊安全管理系統的專業能力。符合台灣政府資通安全責任等級之專業證照及相關法規要求。

實際上要用這張LA主導稽核員證照時，期間須按年繳交會費，並提交持續專業發展（CPD）紀錄及實際稽核紀錄。所以擔任乙方（接案方）的ISO27001輔導顧問並不算實際稽核紀錄，不能登錄成為IRCA的LA主導稽核員。只有擔任驗證公司如SGS、BSI等驗證、發證機構的LA主導稽核員，這張證照才真正有效。

補充說明：

上過課(LAC)、考過試拿到的是結業證書 (Certificate of Achievement)

但要進一步成為 IRCA registered auditor的話才會有後續的繳費、證明稽核經歷等等的要求

核心資格要求一覽表

項目	具體要求條件	備註說明
1. 培訓證書	通過 IRCA 認證的 ISO 27001 LA 5天課程並取得考試合格證書。	證書效期通常為 3年內（需在3年內提出註冊申請，否則需補修轉版或更新課程）。
2. 工作經驗	具備至少 4 年 的全職工作經驗。	任何行業的工作經驗皆可計入。
3. 專業經驗	4年工作經驗中，必須包含至少 2 年 的資訊安全（ISMS）相關領域經驗。	如：資安維運、IT管理、資安輔導顧問、資安系統建置等。
4. 稽核經歷	必須參與至少 4 場 正式稽核，且總稽核天數高達 20 天 以上。	此為最難達成的門檻。詳細定義見下方。
5. 主導經歷	在上述 20 天的稽核中，必須包含至少 15 天 擔任「主導稽核員（Lead Auditor）」的角色。	必須在資深稽核員的監督指導下完成主導職責。

筆者第一次接觸ISO27001時，是在2007年任職於國營企業時，那時服務單位要導入ISO27001，且由標準檢驗局來驗證。ISO27001的核心是先選定一個適用範圍，例如單位的電腦機房、應用系統。然後盤點資訊資產，在資產確定後，設立可接受的風險標準，再進行資產的弱點、威脅等風險評估。得到資產的風險值後，可以選擇的風險處置有「接受」、「避免」、「移轉」、「降低」。

而在ISO27001：2022的附錄A中，可以看到很多「控制措施」，大部分的控制措施都是用來「降低」風險的，而在適用性聲明中，ISO27001要求所有的控制措施都要訂在ISO文件中，如果有不適用的，要特別書明原因。

而ISO文件有分成四階：

第一階：資通安全政策

第二階：資通安全手冊

第三階：資通安全作業程序書

第四階：表格與表單

綜合來看，ISO27001 LA的這張證照，是很多初進資安領域者第一個考慮的證照，因為以前只要交錢上五天的課程，幾乎100%都能通過測驗，且是數位發展部承認的證照清單之一。但是拿到證照後的市場並不大，擔任輔導（顧問）公司的輔導人員，可以接民間的案子也可以接政府的案子，一個案大概100萬左右。如果目標僅為擔任所服務企業內部的內部稽核，則僅需要上ISO27001 內部稽核員的課程即可。現在台灣會是要求導入ISO27001時的100萬的案子裡面，要開個課培訓公司裡面有數位同仁拿到ISO27001 LA，其實效益並不大。