Information is crucial for the continuity and proper functioning of both individual organizations and the economies they fuel; this information must be protected against access by unauthorized people, protected against accidental or malicious modification or destruction and must be available when it is needed. The EXIN Information Security Management (based on ISO/IEC 27001’22) certification program consist out of three Modules: Foundation, Professional and Expert. This book is the officially by Exin accredited courseware for the Information Security Management Professional training. It includes: • Trainer presentation handout • Sample exam questions • Practical assignments • Exam preparation guide The module Information Security Management Professional based on ISO/IEC 27001 tests understanding of the organizational and managerial aspects of information security. The subjects of this module are Information Security Perspectives (business, customer, and the service provider) Risk Management (Analysis of the risks, choosing controls, dealing with remaining risks) and Information Security Controls (organizational, technical and physical controls). The program and this courseware are intended for everyone who is involved in the implementation, evaluation, and reporting of an information security program, such as an Information Security Manager (ISM), Information Security Officer (ISO) or a Line Manager, Process Manager or Project Manager with security responsibilities. Basic knowledge of Information Security is recommended, for instance through the EXIN Information Security Foundation based on ISO/IEC 27001 certification.