ISO/IEC 27005 Risk Manager Training – PECB Certification
Over three days you learn to build and run an information security risk management framework based on ISO/IEC 27005 and aligned with ISO 31000. You practice every step of the process, from setting the context through assessment, treatment, communication and recording to ongoing monitoring, then compare it with other established methods. The course prepares you for the PECB ISO/IEC 27005 Risk Manager certification, and its case studies give you a reusable template for your own risk assessments.
Explain the risk management concepts and principles of ISO/IEC 27005 and ISO 31000
Establish, maintain and improve an information security risk management framework
Apply the risk management process following the ISO/IEC 27005 guidelines
Plan risk communication and consultation activities
Record, monitor and review risks over time
Position ISO/IEC 27005 against EBIOS, OCTAVE, MEHARI, NIST, CRAMM and Harmonized TRA
Program
Day 1 – ISO/IEC 27005 and risk management fundamentals
Standards and regulatory framework
Risk management concepts and principles
Setting up the program and establishing the context
Day 2 – Assessment, treatment and communication
Risk identification, analysis and evaluation
Treatment options and the treatment plan
Communication and consultation
Day 3 – Follow-up and other methods
Risk recording and reporting
Monitoring and review
Assessment methods: OCTAVE, MEHARI, EBIOS, NIST, CRAMM, Harmonized TRA
Prerequisites
PECB publishes no formal prerequisites
Some prior knowledge of risk management and ISO/IEC 27001 is advisable to get the most out of the course
Target audience
Information security managers and consultants
People responsible for managing information security risks
IT professionals and privacy officers
Project managers and expert advisers in information security
The exam
The exam follows the course. In its multiple-choice version, the PECB ISO/IEC 27005 Risk Manager exam has 60 three-option questions, either standalone or scenario-based. It covers four domains: fundamental principles and concepts, implementing a risk management program, the ISO/IEC 27005 framework and process, and other assessment methods. It is open book, the pass mark is 70%, and you can sit it online with remote proctoring or on paper. You then qualify as Provisional Risk Manager, or as Risk Manager with two years of experience, one of them in information security risk management, plus 200 hours of risk management activity. The certification is valid for three years, with an annual maintenance fee.
Preparation tips
Build a full risk register for a simple case, from context to treatment plan
Summarize EBIOS, OCTAVE and MEHARI side by side on one page
Tab the sections of the standard you will want during the open-book exam
Frequently asked questions (FAQ)
What is the difference between Risk Manager and Lead Risk Manager?
Risk Manager, over three days, trains you to run the risk management process. Lead Risk Manager, over five days, goes further so you can steer a program across the whole organization.
Is the EBIOS method covered?
Yes, alongside other methods on day three. For in-depth coverage, see our EBIOS Risk Manager course.
Is the exam open book?
Yes: the standard, the courseware and your own notes are allowed.
What does the price include?
More than 350 pages of PECB courseware, exam and certification fees, and one free retake within 12 months if you do not pass.
Which delivery formats are available?
Live online, in person in Casablanca or on-site at your organization, in French or English.