ISO/IEC 27005 Foundation: Information Security Risk Management

Foundation level: why that is the right starting point

This is a foundation course. It gives you the concepts and vocabulary of information security risk management without the depth required to lead a risk management programme.

That is deliberately useful for anyone supporting an ISO/IEC 27001 implementation who needs to understand what "risk treatment" and "residual risk" actually mean in the room.

Where to go next

If you need to lead an organisation's information security risk management process, the ISO/IEC 27005 Lead Risk Manager course builds directly on this material.

What you will learn

• Describe information security risk management concepts and principles
• Explain the ISO/IEC 27005 risk management process at a foundation level
• Identify how ISO/IEC 27005 supports an ISO/IEC 27001 ISMS
• Recognise common risk assessment methods referenced by the standard

Course content

1. 1. Risk management fundamentals

   Core concepts, principles and terminology of information security risk management.

2. 2. The ISO/IEC 27005 process

   Context establishment, risk identification, analysis, evaluation and treatment at a high level.

3. 3. Relationship to ISO/IEC 27001

   How ISO/IEC 27005 supports the risk assessment requirements of an ISMS.

4. 4. Common risk assessment methods

   An overview of methods such as OCTAVE, EBIOS and MEHARI referenced by the standard.

Exam and certification

Closed-book written exam delivered online through PECB Exams. Duration: 1 hour.

Your fee includes your first exam attempt and one free retake within 12 months. After passing, you can apply for the relevant PECB credential.