EBIOS Risk Manager is the digital risk assessment method published by France's national cybersecurity agency (ANSSI) and widely used across French-speaking organizations. Over two days you work through its five workshops on a practical case, from the security baseline to risk treatment; the third day is set aside for the PECB exam. You come away able to lead or oversee a structured risk study that stands up in front of senior management.
The essentials
Publisher : PECB
Certification : PECB Certified EBIOS Risk Manager
Duration : 3 days: 2 days of training + 1 exam day (21 CPD credits)
Level : Intermediate
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Exam voucher : Official PECB offer: exam and certification fees are included in the course price, with one free exam retake within 12 months if you do not pass.
Understand risk management concepts applied to information security
Master the EBIOS RM approach and vocabulary
Scope a study and define the security baseline
Identify risk origins and build strategic and operational scenarios
Define a treatment strategy and monitor risks over time
Program
Day 1 – Foundations and first workshops
Introduction to the EBIOS RM method
Workshop 1: scope and security baseline
Workshop 2: risk origins and target objectives
Day 2 – Scenarios and treatment
Workshop 3: strategic scenarios and the ecosystem
Workshop 4: operational scenarios
Workshop 5: risk treatment and improvement plan
Day 3 – Certification exam
PECB EBIOS Risk Manager exam
Prerequisites
A fundamental knowledge of risk management
Some background in information security is recommended, for example familiarity with common threats and security controls
Target audience
People who want to learn a risk management method
Participants in risk assessment activities
Managers who need to understand and oversee risk analysis
Those responsible for presenting and communicating risk study results
The exam
The exam takes place on day three, online with remote proctoring or on paper. It covers three domains: fundamental principles and risk management process, the information security risk management framework, and risk assessment methodology. Passing gives you the Provisional level; the Confirmed level requires two years of relevant experience or completed EBIOS training, plus documented use of the method within the previous three years. One free retake is available within 12 months. Candidates who have practised the full chain of workshops on the course case study, and who can explain why each step follows the previous one, are best placed to reason through the questions.
Preparation tips
Download and skim ANSSI's EBIOS RM guide before the course
Focus on how the five workshops chain together rather than on details
Redo the course case study, explaining each choice out loud
Frequently asked questions (FAQ)
Is EBIOS RM compatible with ISO/IEC 27005?
Yes. EBIOS RM can serve as the risk assessment method inside an ISO/IEC 27001 ISMS, in line with ISO/IEC 27005 principles.
Are two days enough to master the method?
They are enough to understand and practise all five workshops; real mastery comes with a first live study, ideally with support. We recommend picking a limited scope, such as one business service, for your first study after the course.
Is the course available in French?
Yes. We teach it in French or English, live online, in person in Casablanca or on-site at your organization.
What does the price include?
Under the official PECB offer: exam and certification fees, more than 200 pages of material and one free retake within 12 months.
Is EBIOS RM useful outside France?
Yes. Its attack-scenario approach works in any sector or country, and it gives executives a readable story of how an attacker could reach what matters most. Many organizations that work with French partners or regulators choose it for that reason.