- Duration: 3 days
Course Overview
The PECB Certified ISO/IEC 27005 Risk Manager training course provides participants with the knowledge and practical skills required to establish, implement, maintain, and continually improve an information security risk management process based on ISO/IEC 27005.
This three-day training course explores the fundamental concepts and principles of information security risk management outlined in ISO/IEC 27005 and ISO 31000. Participants will learn how to identify, analyse, evaluate, treat, communicate, monitor, and review information security risks while understanding how risk management supports the implementation and maintenance of an Information Security Management System (ISMS) based on ISO/IEC 27001.
The course also introduces recognised risk assessment methodologies and frameworks, including OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized Threat and Risk Assessment (TRA). Through practical exercises, quizzes, and case studies, participants will develop a structured approach to managing information security risks in an organisational environment.
Upon successful completion of the training course and examination, participants may apply for the PECB Certified ISO/IEC 27005 Risk Manager credential, subject to the applicable certification requirements.
Learning Objectives
Upon successful completion of this training course, participants will be able to:
- Explain the fundamental risk management concepts and principles outlined in ISO/IEC 27005 and ISO 31000.
- Establish, maintain, and improve an information security risk management framework based on ISO/IEC 27005 guidelines.
- Apply information security risk management processes, including risk identification, analysis, evaluation, and treatment.
- Establish the context for information security risk management within an organisation.
- Plan and implement effective risk communication and consultation activities.
- Understand the processes for recording, reporting, monitoring, and reviewing information security risks.
- Identify and understand the application of recognised information security risk assessment methodologies.
- Support organisations in maintaining conformity with relevant information security risk management requirements.
Target Audience
This training course is intended for:
- Managers and consultants involved in or responsible for information security within an organisation.
- Professionals responsible for identifying, assessing, and managing information security risks.
- Members of information security teams and IT professionals.
- Privacy officers and professionals involved in information security governance.
- Individuals responsible for maintaining conformity with ISO/IEC 27001 information security requirements.
- Project managers, consultants, and expert advisers seeking to strengthen their information security risk management capabilities.
- Professionals involved in implementing, maintaining, or improving an Information Security Management System (ISMS).
Course Content
Day 1: Introduction to ISO/IEC 27005 and Risk Management
- Training course objectives, structure, and learning approach.
- Overview of relevant standards and regulatory frameworks.
- Fundamental concepts and principles of information security risk management.
- Introduction to ISO/IEC 27005 and ISO 31000.
- Establishing an information security risk management programme.
- Defining the context for information security risk management.
- Understanding the relationship between risk management and an ISO/IEC 27001-based ISMS.
Day 2: Risk Assessment, Risk Treatment, Communication, and Consultation Based on ISO/IEC 27005
- Information security risk identification.
- Information security risk analysis.
- Risk evaluation and prioritisation.
- Information security risk treatment strategies.
- Selection of appropriate risk treatment options.
- Risk communication and consultation with relevant stakeholders.
- Practical exercises and case studies on information security risk management.
Day 3: Risk Recording and Reporting, Monitoring and Review, and Risk Assessment Methods
- Information security risk recording and reporting.
- Information security risk monitoring and review.
- Overview of the OCTAVE risk assessment methodology.
- Overview of the MEHARI risk assessment methodology.
- Introduction to the EBIOS method and NIST framework.
- Overview of the CRAMM and Harmonized TRA methods.
- Review of key course concepts and certification preparation.
- PECB certification examination.
Examination and Certification
The PECB Certified ISO/IEC 27005 Risk Manager examination evaluates participants’ understanding of information security risk management principles, frameworks, processes, and recognised risk assessment methods.
The examination covers the following competency domains:
- Domain 1: Fundamental Principles and Concepts of Information Security Risk Management.
- Domain 2: Implementation of an Information Security Risk Management Programme.
- Domain 3: Information Security Risk Management Framework and Processes Based on ISO/IEC 27005.
- Domain 4: Other Information Security Risk Assessment Methods.
Examination Duration: 2 Hours
Participants who successfully complete the training course and pass the examination may apply for the relevant PECB certification, subject to the requirements of the selected credential.
Certification Requirements
Candidates may qualify for one of the following credentials, depending on their professional experience and documented information security risk management activities.
- PECB Certified ISO/IEC 27005 Provisional Risk Manager
- Successfully pass the applicable examination or meet the equivalent examination requirement.
- No professional experience or information security risk management experience is required.
- Sign and comply with the PECB Code of Ethics.
- PECB Certified ISO/IEC 27005 Risk Manager
- Successfully pass the applicable examination or meet the equivalent examination requirement.
- At least two years of professional experience, including one year of work experience in Information Security Management.
- At least 200 hours of information security risk management activities.
- Sign and comply with the PECB Code of Ethics.
- PECB Certified ISO/IEC 27005 Senior Risk Manager
- Successfully pass the applicable examination or meet the equivalent examination requirement.
- At least ten years of professional experience, including seven years of work experience in Information Security Management.
- At least 1,000 hours of information security risk management activities.
- Sign and comply with the PECB Code of Ethics.
The final certification is subject to PECB’s applicable Certification Rules and Policies and the candidate’s documented qualifications and experience.
Course Benefits
- Develop practical knowledge of information security risk management based on ISO/IEC 27005 and ISO 31000.
- Gain the skills required to establish, implement, and improve an information security risk management process.
- Strengthen capabilities in risk identification, assessment, treatment, communication, and monitoring.
- Understand how information security risk management supports an ISO/IEC 27001-based ISMS.
- Explore recognised risk assessment methodologies and frameworks used in professional practice.
- Apply theoretical knowledge through practical exercises, quizzes, and case studies.
- Receive comprehensive training materials containing over 350 pages of information and practical examples.
- Obtain an attestation of course completion worth 21 Continuing Professional Development (CPD) credits, subject to applicable attendance requirements.
- Benefit from examination and certification fees included in the training course price.
- Access one free examination retake within 12 months of the initial examination date in the event of failure, subject to PECB’s applicable rules and policies.
Duration
- Training Duration: 3 Days
- Examination Duration: 2 Hours
Prerequisites
No specific formal prerequisites are stated for attending this training course. However, a basic understanding of information security, risk management, and ISO/IEC 27001 concepts may help participants gain greater value from the programme.
Professional experience and documented information security risk management activities are required for the Risk Manager and Senior Risk Manager credentials, as specified by PECB.
Certification Body
PECB (Professional Evaluation and Certification Board)
PECB provides professional training, examination, and certification services across information security, risk management, governance, and related professional disciplines.