Information Security & ISO 27001 Awareness (2026 Edition)
Information Security and ISO 27001 Awareness is a free, CC BY 4.0 course outline of about 45 minutes for every employee and contractor with access to company systems. It covers phishing and AI-assisted social engineering, MFA and passkeys, data classification and safe sharing, and how to report an incident. A learner finishes able to spot and report common attacks, and with a completion certificate that has a public verification page.
See pricing (from $1 per active user): the outline is free to copy, and building it in Personal Academy starts on the Free plan.
| Course code | SEC-2026-01 |
|---|---|
| Estimated duration | About 45 minutes, self-paced |
| Block types | Built in the Course Studio, which offers 28 lesson block types |
| Delivery channels | Web on every plan; Slack, Microsoft Teams and Google Chat from the Basic plan; WhatsApp on Premium |
| Credential | Completion certificate with a public verification page. Certificates are included from the Basic plan. |
| Licence | CC BY 4.0 (Creative Commons Attribution 4.0 International) |
About this course
Written around ISO/IEC 27001:2022 control A.6.3 (information security awareness, education and training), this course trains employees on identifying contemporary social engineering attacks, safeguarding confidential company information, managing secrets responsibly, and reporting security incidents within SLA windows.
What is inside
- •Two modules and four lessons: the threat landscape, and access control and data hygiene
- •Branching scenarios, flashcards, sorting exercises and narrated audio
- •A knowledge check in each module and an acceptable-use attestation at the end
Who it is for
- •All employees and contractors with corporate system access
- •Engineering and IT personnel handling production environments
- •People Operations and Legal managers managing confidential records
Learning outcomes
- •Recognize and report sophisticated phishing, spear-phishing, and AI voice cloning attacks.
- •Apply NIST SP 800-63B password complexity and mandatory Multi-Factor Authentication (MFA) protocols.
- •Classify enterprise data into Public, Internal, Confidential, and Restricted tiers under GDPR and DPDP.
- •Execute prompt security incident reporting following internal escalation ladders.
How to use it
- Sign up for a free Personal Academy organisation; no card is needed to start.
- Open the Course Studio and paste this outline into the Brief step, with your audience and any policies of your own.
- Review the Blueprint the studio drafts from the brief, adjust modules and lessons, then Build.
- Review the built lessons, edit anything you want, and Deliver: publish and assign it to your people.
- People take it on the web on any plan; delivery in Slack or Microsoft Teams needs the Basic plan or above.
Syllabus
The modules, lessons and suggested block types in this outline.
Module 1: The Modern Threat Landscape
Analyzing contemporary cyber threats, AI-augmented social engineering, and the cost of security breaches.
1.1 Anatomy of a Modern Phishing Attack
Phishing attacks exploit psychological urgency. Learn the 5 subtle red flags in sender domains, unexpected attachment macros, and suspicious webhook links.
1.2 Social Engineering & AI Deepfakes in Chat
Threat actors impersonate executives in Slack and WhatsApp using AI voice clones. Understand verification protocols before authorizing wire transfers or credential resets.
Module 2: Access Control & Data Hygiene
Implementing least-privilege principles, credential security, and zero-trust hygiene across devices.
2.1 MFA, Passkeys, and Credential Governance
Master hardware FIDO2 passkeys, TOTP authentication steps, and why SMS OTP verification is vulnerable to SIM-swapping exploits.
2.2 Data Classification, Encryption & Safe Sharing
Safely handle PII, SPI, and proprietary source code under ISO 27001 Control A.8.2. Includes mandatory electronic attestation of acceptable use policies.
Frequently asked questions
Does this ISO 27001 course meet our annual auditor requirements?
It covers the awareness topics named in ISO/IEC 27001:2022 control A.6.3, and completion records keep timestamps and scores, exportable as CSV and JSON. Whether it meets your audit is for your auditor to decide; most organisations add their own policies to the course before relying on it.
How do I deliver this course in Slack or Microsoft Teams?
Build the course in your Personal Academy organisation from this outline, then connect Slack or Microsoft Teams. Chat delivery needs the Basic plan or above; on the Free plan learners take the course on the web.