Corporate training
01
A programme built around your team’s goals
02
Practice from people who do this work
03
An Audit3a certificate of completion
Practitioners from real projects
ISO/IEC 27001
DORA · NIS 2
ISO/IEC 27005 · ISO 31000
Audit and compliance
Who it is for
01
You have a specific goal
A customer asks you to certify your information security management system (ISMS), an audit is coming, a new regulation has landed, or you need your own internal auditors.
02
You are ready to invest
This is not a box-ticking course. The programme takes your people’s time and a budget, and in return the team gets skills it uses in daily work.
03
People from different functions learn together
When IT, security and compliance learn together, they read the standard the same way. Fewer arguments about what the auditor meant.
04
You are not sure where to start
Tell us what is going on in the company and we will help you work out what the team is missing.
Programme topics
For companies that a customer, bank or partner asks to certify their ISMS, and for those who already have one and want their own internal auditors.
Implementing an ISMS
Who: IT and information security managers, consultants, the team setting up the ISMS.
What the team can do afterwards: plan the implementation, maintain the system and prepare the company for the certification audit.
Standard: ISO/IEC 27001.
Internal audit of an ISMS
Who: internal auditors, people who audit suppliers’ ISMS, managers and consultants.
What the team can do afterwards: plan and run an internal ISMS audit under ISO 19011, record nonconformities and report, and manage an internal audit programme.
Standards: ISO/IEC 27001, ISO 19011.
For teams that assess risk in different ways, or with no common method. We cover information security risk and enterprise risk.
Information security risk
Who: information security managers and consultants, security and IT teams responsible for risk.
What the team can do afterwards: identify, assess and treat information security risk under ISO/IEC 27005, and communicate about risk.
Standard: ISO/IEC 27005.
Enterprise risk management
Who: managers and consultants responsible for risk management in the organisation.
What the team can do afterwards: build a risk management framework and apply the process under ISO 31000.
Standard: ISO 31000.
For companies under regulation, or preparing for it. We look at what a requirement means for the processes, roles and evidence in your company.
DORA
Who: security, risk and compliance teams in financial entities in scope of DORA and in their ICT third-party providers.
What the team can do afterwards: understand the DORA requirements and turn them into processes, roles and evidence of compliance.
Regulation: DORA.
NIS 2 and NBU requirements
Who: companies in scope of NIS 2 and financial institutions working to NBU requirements.
What the team can do afterwards: understand what a requirement obliges you to do and prepare the company to meet it.
Regulation: NIS 2, NBU requirements.
For companies where one person runs security, or where the role is only now being assigned, and for executives who make security decisions.
A company-wide security programme
Who: security managers and specialists growing into leadership roles, current CISOs (chief information security officers) and IT directors.
What the team can do afterwards: build an information security programme, assess risk, comply with regulation and manage incidents and change.
Running a cybersecurity programme
Who: cybersecurity leaders and managers, and those who put security measures in place.
What the team can do afterwards: draw up the company’s cybersecurity plan, assign roles, choose security measures and check that they work.
For managers and teams without a technical background. This is not hands-on technical training for penetration testers: we cover the basics so you understand what a penetration test is, how to order one and what to do with the report.
What it is, how to order one, how to read the report
Who: managers, IT and information security managers, compliance, teams with no technical penetration testing background.
What the team can do afterwards: explain what penetration testing is, set the brief and order a test, read the report and prioritise the fixes.
For companies where downtime is expensive, and for those who work with public contracts, large corporations or international partners.
Business continuity (ISO 22301)
Who: project managers, consultants, auditors and people responsible for the business continuity management system (BCMS).
What the team can do afterwards: set up and maintain a BCMS and audit it against ISO 22301.
Standard: ISO 22301.
Anti-bribery (ISO 37001)
Who: compliance, risk and governance managers, auditors and consultants.
What the team can do afterwards: set up an anti-bribery management system under ISO 37001 and audit it.
Standard: ISO 37001.
Not on the list? Tell us the standard or requirement and we will build a programme around it.
ISO/IEC 42001: AI management
ISO/IEC 27701 and GDPR: personal data protection
NIST Cybersecurity Framework (CSF) 2.0: managing cybersecurity risk
Process
01
We look at your team’s goals
It starts with a conversation. You tell us what the team needs to be able to do, where the gaps are and what a customer or regulator requires.
02
We design the programme
The programme and materials are Audit3a’s own development, built around your team’s goals. We develop them ourselves, drawing on international ISO standards, regulation and our specialists’ practical experience on real projects. We combine several topics, for example ISO/IEC 27001, risk management under ISO/IEC 27005 and audit, into one programme. We agree the format and schedule with you.
03
Practitioners teach
The people teaching do this work themselves: penetration testing, audits, ISO 27001 implementations, DORA and NIS 2 compliance projects, risk management. We go through examples from real projects. Most of our projects are under NDA, so in training we rarely name clients and we anonymise the data.
04
An Audit3a certificate
After the programme, participants receive an Audit3a certificate of completion. It is our own internal document and it is not accredited.
05
What next
If you want, we help apply it in a real project, see “After the programme” below.
Outcome
A programme for your goal
Not a course on a fixed timetable: we choose topics, depth and order around what your team needs.
Practice, not only theory
Examples from our specialists’ real projects, anonymised because of NDA. The team sees how the requirements work in real companies.
Your own situations
In a programme for one company you can discuss your own processes openly instead of textbook examples. There are no outsiders.
Online and in person
We teach both online and in person. Group size, format and schedule are not fixed. We agree them with you when we design the programme.
An Audit3a certificate
After the programme, participants receive an Audit3a certificate of completion. It is our own internal document and it is not accredited.
Who teaches
Our specialists work on the kind of projects the programme covers.
01
Hands-on experience
Penetration testing, audits, ISO 27001 implementation, DORA and NIS 2 compliance, risk management: this is our team’s own work, not textbook theory.
02
International certifications
Our team includes certified ISO/IEC 27001 auditors, risk and DORA specialists, holders of ISACA and ISC2 certifications, and practical penetration testing certifications.
03
PECB Certified Trainers
Our specialists include PECB Certified Trainers.
04
PECB Titanium Partner
Active Audit Agency holds PECB Titanium Partner status.
05
Under NDA
We show real projects in anonymised form: no client names, no sensitive data.
AAA services
Training gives knowledge. The result is a working system. If you need help alongside, we do that work ourselves. Say so in your request and we will propose training together with implementation.
Tell us about your team and its goals and we will propose a programme. We agree the format and schedule with you.
Frequently asked
How is this different from an ordinary course?
A scheduled course is the same for everyone. Here the programme is built around your team’s goals and taught by practitioners who do this work themselves, using anonymised examples from real projects.
Can several topics be combined into one programme?
Yes. The programme and materials are Audit3a’s own development, built around your team’s goals. We put them together from several topics, for example ISO/IEC 27001, risk management under ISO/IEC 27005 and audit, drawing on international ISO standards, regulation and our specialists’ practical experience on real projects.
What is the format, and how many people should be in the group?
We teach both online and in person. Group size is not fixed. We agree it, the format and the schedule with you when we design the programme.
What certificate will participants receive?
After the programme, participants receive an Audit3a certificate of completion. It is our own internal document and it is not accredited. The programme does not lead to a PECB exam. If you need an official PECB certificate, that is a separate standard PECB course with an exam: the courses are described on the course pages of our site.
How much does it cost?
There are no prices on the page because the cost depends on the programme: topics, number of people and format. After a conversation we will send a quote for your team.
We do not know what exactly we need. Where do we start?
Describe the situation in your own words: “a customer requires ISO 27001 certification”, “we need internal auditors”, “someone has just been made responsible for risk”. We will define the goal together and then build the programme.
Discuss a programme for your team
Active Audit Agency provides extensive cybersecurity services for businesses, ensuring robust protection and compliance for organisations of various sizes.
