ISO in the Sun: PECB ISO/IEC 27005 Information Security Risk Manager

This three-day course provides an overview to the principles of risk management in information security based on ISO/IEC 27005:2022, and how to apply the same across an organisation, eg for the context of certification to ISO/IEC 27001:2022.

Overview:
This three-day course enables participants to develop the necessary expertise to support an organisation in implementing risk management processes related to all assets of relevance for information security based on ISO/IEC 27005:2022.

ISO/IEC 27005:2022 builds onto the generic risk management principles set out in ISO 31000:2018, and applies those to the context of an information security management system (ISMS), thus providing a framework for satisfying the risk management requirements of ISO/IEC 27001:2022.

The course consists of a mix of presentation, discussion and exercises based on real-world examples.

Outline:
Introduction to Information Security Risk Management per ISO/IEC 27005:2022
Concepts and Definitions relating to Risk Management
Risk Management Standards, Frameworks and Methodologies
Implementation of a Risk Management Framework
Understanding an Organization and its Context
Elements of the Risk Management Framework
Risk Identification
Risk Analysis and Risk Evaluation
Risk Treatment
Risk Acceptance and Residual Risk Management
Risk Communication and Consultation
Risk Recording and Reporting
Risk Monitoring and Review
Examples of Risk Assessment Methodologies
Operational Critical Threat, Asset and Vulnerability Evaluation (OCTAVE)
Harmonised Risk Analysis Method (MEHARI)
Expression of Needs and Identification of Security Objectives (EBIOS)
NIST Framework
CCTA Risk Analysis and Management Method (CRAMM)
Harmonized Threat and Risk Assessment (TRA)

Objectives:
Completion of this course will enable students to:
Understand concepts, approaches, methods, tools and techniques for effective information security risk management according to ISO/IEC 27005:2022
Understand the relationship between risk management, controls and ISO/IEC 27001:2022
Implement, maintain and manage an ongoing
information security risk management program
Advise organisations on best practices in information security risk management

Audience:
This course is aimed at students with (future) roles like:

Risk managers and Information security officers
Project managers, consultants and team members implementing and operating information security management systems
Auditors requiring more risk management insight

Prerequisites:
General understanding of common business processes.

Some past exposure to risk management and / or management systems helpful, but not required.

Examination and Certification:
The course includes access to PECB's two-hour exam available in multiple languages to be taken online any time after the course (own laptop required). Exam and first year certification fees are included in the course fees.

This course is designed by PECB in Canada, who also mark the exam and issue respective certifications as per their criteria. PECB is a personnel certification body, accredited to ISO/IEC 17024:2012 by IAS. See www.pecb.com for full details.