Information Security
ISO/IEC 27005 Risk Manager
Learn to identify, analyse, evaluate, treat and communicate information security risks based on ISO/IEC 27005 and ISO 31000 — and compare methods like OCTAVE, MEHARI, EBIOS and NIST. Self-paced on myPECB, with 24/7 access.
Veloraa Training
COURSE INFORMATION
Your Learning, at a Glance
- Price
- 699 USD
799 USD - Category
- Information Security
- Duration
- Self-paced; suggested pace: 4–6 weeks at 6–8 hours per week
- Format
- Self-paced online eLearning via myPECB
- Certification
- PECB Certified ISO/IEC 27005 Risk Manager (subject to passing the exam and meeting certification requirements)
Course Overview
The Credential for People Who Turn Information Security Risk Into Decisions
ISO/IEC 27005 gives guidance on managing information security risk, building on the principles of ISO 31000. It underpins the risk assessment and treatment that ISO/IEC 27001 requires.
As a Risk Manager, you set up a risk management programme, run the full assessment and treatment process, and communicate risk clearly to decisionmakers. You also learn how other recognised methods compare. Veloraa delivers the official PECB curriculum online, with practical examples, exercises and quizzes so you can apply what you learn straight away.
Risk Drives the ISMS
ISO/IEC 27001 requires risk assessment and treatment — ISO/IEC 27005 shows how.
More Than One Method
Compare OCTAVE, MEHARI, EBIOS, NIST, CRAMM and Harmonized TRA.
Decisions Need Evidence
Leaders need risk communicated in terms they can act on.
Who Should Attend?
Anyone who manages or advises on information security risk
No prior ISO/IEC 27005 certification needed.
Learning Objectives
By the end of the course you will be able to:
- Master risk fundamentals - Explain the risk management concepts and principles of ISO/IEC 27005 and ISO 31000.
- Build the framework - Establish, maintain and improve an information security risk management framework.
- Assess risk - Identify, analyse and evaluate information security risks.
- Treat risk - Select and apply risk treatment options.
- Communicate risk - Plan and run risk communication and consultation activities.
- Compare methods - Understand OCTAVE, MEHARI, EBIOS, NIST, CRAMM and Harmonized TRA.
Curriculum
4 modules · 16 lessons
Lessons follow the risk management process step by step, then compare other methods. Quizzes throughout.
Risk Management Foundations4 Lessons
- 1. Course Objectives and Structure
- 2. Standards and Regulatory Frameworks
- 3. Fundamental Concepts and Principles of Information Security Risk
- 4. The Information Security Risk Management Programme
You Will Be Able To Understand the concepts, the standards and the risk management programme
Assessing Risk4 Lessons
- 5. Context Establishment
- 6. Risk Identification
- 7. Risk Analysis
- 8. Risk Evaluation
You Will Be Able To Establish context, then identify, analyse and evaluate risks
Treating and Communicating Risk4 Lessons
- 9. Risk Treatment
- 10. Risk Communication and Consultation
- 11. Risk Recording and Reporting
- 12. Risk Monitoring and Review
You Will Be Able To Treat risk, consult stakeholders, record, report and review
Other Risk Assessment Methods4 Lessons
- 13. OCTAVE and MEHARI Methodologies
- 14. The EBIOS Method and NIST Framework
- 15. CRAMM and TRA Methods
- 16. Course Close and Exam Preparation
You Will Be Able To Compare recognised methods and prepare for the exam
Downloadable Resources: 350+ pages of course notes with valuable information and practical examples, in editable formats.
What’s Included
- 16 video lessons Expert-led, with quizzes
- 350+ pages of notes Information & practical examples
- Exam voucher Plus one free retake in 12 months
- Certification fee No extra cost once you pass
- 21 CPD credits Attestation of completion
Frequently Asked Questions
Do I Need a Technical Background?
No. The course focuses on risk management concepts and processes. Experience in information security risk counts towards the full credential.
How Long Do I Have to Finish?
You get [ACCESS PERIOD] of unlimited access and study at your own pace. You can take the exam whenever you are ready.
Is the Exam Online?
Yes. You book it through PECB Exams and take it remotely
What If I Fail the Exam?
You can retake it once for free within 12 months of your first attempt.
ISO/IEC 27005 or ISO 31000 Risk Manager — Which Should I Take?
Choose ISO/IEC 27005 if your focus is information security risk. Choose ISO 31000 for risk management across the whole organisation.
Can My Team Enrol Together?
Yes. Veloraa offers corporate and bespoke programmes. Use the enquiry form below for group pricing.
Exam & Certification
Your Path to Certification
The online exam covers four competency domains. If you don’t pass first time, you can retake it once at no cost within 12 months.
- Complete the eLearning
16 lessons and quizzes · earn 21 CPD credits
- Pass the Exam
Book online at a time that suits you
- Apply for Your Credential
Choose the level that matches your experience
- Sign the Code of Ethics
Then receive your PECB certificate
- Maintain It
Annual maintenance and continuing education
Exam Domains
- Fundamental principles and concepts of information security risk management
- Implementing an information security risk management programme
- Information security risk management framework and processes based on ISO/IEC 27005
- Other information security risk assessment methods
Credential Levels
| Credential | Experience | Project Activities |
|---|---|---|
| Provisional Risk Manager | None | None |
| Risk Manager This Course | 2 yrs (1 in ISRM) | 200 hours |
Both levels require passing the PECB Certified ISO/IEC 27005 Risk Manager exam (or equivalent) and signing the PECB Code of Ethics.
Happy Clients
