Overview
Master the fundamental principles and concepts of Security Risk Assessment and Optimal Security Risk Management in Information Security based on ISO/IEC 27005. ISO/IEC 27005 Security Risk Manager training enables you to develop the competence to master the risk management process related to all assets of relevance for Information Security using the ISO/IEC 27005 standard as a reference framework. During this training course, you will also gain a thorough understanding of best practices of risk assessment methods such as OCTAVE, EBIOS, MEHARI and harmonized TRA. This training course corresponds with the implementation process of the ISMS framework presented in the ISO/IEC 27001 security standard.
After understanding all the necessary concepts of Information Security Risk Management based on ISO/IEC 27005, you can sit for the exam and apply for a “PECB Certified ISO/IEC 27005 Security Risk Manager” credential. By holding a PECB Security Risk Manager Certificate, you will be able to demonstrate that you have the necessary skills and knowledge to perform an optimal Information Security Risk Assessment and timely manage Information Security risks.
Target Audience
- Information Security risk managers
- Information Security team members
- Individuals responsible for Information Security, compliance, and risk within an organization
- Individuals implementing ISO/IEC 27001, seeking to comply with ISO/IEC 27001 or involved in a risk management program
- IT consultants
- IT professionals
- Information Security officers
- Privacy officers
Learning Outcomes
- Acknowledge the correlation between Information Security risk management and security controls
- Understand the concepts, approaches, methods and techniques that enable an effective security risk management process according to ISO/IEC 27005
- Learn how to interpret the requirements of ISO/IEC 27001 in Information Security Risk Management
- Acquire the competence to effectively advise organizations in Information Security Risk Management best practices
After successfully completing the exam, you will receive a certificate once you comply with all the requirements related to the selected credential.
Course Outline
Day 1 Introduction to Information Security controls as recommended by ISO/IEC 27002
- Course objectives and structure
- Concepts and definitions of risk
- Standard and regulatory framework
- Implementing a risk management programme
- Understanding the organization and its context
Day 2 Implementation of a risk management process based on ISO/IEC 27005
- Risk identification
- Risk analysis and risk evaluation
- Risk assessment with a quantitative method
- Risk treatment
- Risk acceptance and residual risk management
- Information Security Risk Communication and Consultation
- Risk monitoring and review
Day 3 Overview of other Information Security risk assessment methods and Certification Exam
- OCTAVE Method
- MEHARI Method
- EBIOS Method
- Harmonized Threat and Risk Assessment
- (TRA) Method
- Applying for certification and closing the training
Remote PECB Proctored Exam
Results will be communicated by email in a period of 6 to 8 weeks, after taking the exam. The results will not include the exact grade of the candidate, only a mention of pass or fail. Candidates who successfully complete the examination will be able to apply for a certified scheme which is explained in the course description. In the case of a failure, the results will be accompanied with the list of domains in which the candidate had failed to provide guidance for exams’ retake preparation. Candidates, who disagree with the exam results, may file a complaint by writing to examination@pecb.com or through PECB ticketing system.
The “PECB Certified ISO/IEC 27005 Security Risk Manager” remote proctored exam fully meets the requirements of the PECB Examination and Certification Programme (ECP). The remote proctored exam covers the following competency domains:
- Domain 1 Fundamental principles and concepts of Information Security Risk Management
- Domain 2 Implementation of an Information Security Risk Management program
- Domain 3 Information Security risk management framework and process based on ISO/IEC 27005
- Domain 4 Other Information Security risk assessment methods
Cyber Security learning paths
Want to boost your career in cyber security? Click on the roles below to see QA's learning pathways, specially designed to give you the skills to succeed.
= Required
= Certification
Governance, Risk & Compliance learning paths
Want to boost your career in Governance, Risk & Compliance? View QA's learning pathway below, specially designed to give you the skills to succeed.
= Required
= Certification
Frequently asked questions
See all of our FAQsHow can I create an account on myQA.com?
There are a number of ways to create an account. If you are a self-funder, simply select the "Create account" option on the login page.
If you have been booked onto a course by your company, you will receive a confirmation email. From this email, select "Sign into myQA" and you will be taken to the "Create account" page. Complete all of the details and select "Create account".
If you have the booking number you can also go here and select the "I have a booking number" option. Enter the booking reference and your surname. If the details match, you will be taken to the "Create account" page from where you can enter your details and confirm your account.
Find more answers to frequently asked questions in our FAQs: Bookings & Cancellations page.
How do QA’s virtual classroom courses work?
Our virtual classroom courses allow you to access award-winning classroom training, without leaving your home or office. Our learning professionals are specially trained on how to interact with remote attendees and our remote labs ensure all participants can take part in hands-on exercises wherever they are.
We use the WebEx video conferencing platform by Cisco. Before you book, check that you meet the WebEx system requirements and run a test meeting (more details in the link below) to ensure the software is compatible with your firewall settings. If it doesn’t work, try adjusting your settings or contact your IT department about permitting the website.
Learn more about our Virtual Classrooms.
How do QA’s online courses work?
QA online courses, also commonly known as distance learning courses or elearning courses, take the form of interactive software designed for individual learning, but you will also have access to full support from our subject-matter experts for the duration of your course. When you book a QA online learning course you will receive immediate access to it through our e-learning platform and you can start to learn straight away, from any compatible device. Access to the online learning platform is valid for one year from the booking date.
All courses are built around case studies and presented in an engaging format, which includes storytelling elements, video, audio and humour. Every case study is supported by sample documents and a collection of Knowledge Nuggets that provide more in-depth detail on the wider processes.
Learn more about QA’s online courses.
When will I receive my joining instructions?
Joining instructions for QA courses are sent two weeks prior to the course start date, or immediately if the booking is confirmed within this timeframe. For course bookings made via QA but delivered by a third-party supplier, joining instructions are sent to attendees prior to the training course, but timescales vary depending on each supplier’s terms. Read more FAQs.
When will I receive my certificate?
Certificates of Achievement are issued at the end the course, either as a hard copy or via email. Read more here.