ISO/IEC 27005:2022 Lead Risk Manager

Risk management as the engine behind ISO/IEC 27001

Every ISMS decision, whether to apply a control, accept it, or transfer it, ultimately traces back to a risk assessment. This course teaches the process itself: how to build a defensible methodology, apply it consistently, and communicate the result in terms that support real decisions.

Where it fits alongside ISO/IEC 27001

If you are implementing or auditing an ISO/IEC 27001 ISMS, this course gives you the depth behind the standard's risk assessment clause, useful whether you are building the programme yourself or reviewing someone else's.

What you will learn

• Master the concepts, approaches, methods and techniques for information security risk management
• Interpret ISO/IEC 27005:2022 requirements in the context of an ISMS
• Design and develop an information security risk management programme
• Apply recognised risk assessment methods, including OCTAVE, EBIOS and MEHARI
• Support and lead a team in managing information security risk

Course content

1. 1. Risk management concepts and principles

   Core terminology and the relationship between ISO/IEC 27005 and ISO 31000.

2. 2. The risk management process

   Context establishment, identification, analysis, evaluation and treatment.

3. 3. Risk assessment methods

   OCTAVE, EBIOS, MEHARI and harmonised TRA, and when each is appropriate.

4. 4. Building the risk management programme

   Designing a process model that supports an ISO/IEC 27001 ISMS.

5. 5. Leading a risk management team

   Communicating risk, managing the programme and reporting to stakeholders.

Exam and certification

Open-book written exam delivered online through PECB Exams.

Your fee includes your first exam attempt and one free retake within 12 months. After passing, you can apply for the relevant PECB credential.