ISO 27005: Certified Risk Manager

The ISO/IEC 27005 risk management training allows you to develop the necessary skills to master the risk management process associated with all information security-related assets, using ISO/IEC 27005 as a reference framework. You will also understand the best practices of risk assessment methods such as OCTAVE, EBIOS, MEHARI, and harmonized EMR. This course corresponds to the ISMS framework implementation process presented in ISO/IEC 27001.

Specific objective: Understand the concepts, approaches, methods, and techniques for an effective risk management process according to ISO/IEC 27005.

• Fundamental understanding of ISO/IEC 27005 and in-depth knowledge of risk assessment and information security

• Code: ISO 27005
• Duration: 3 days
• Schedule: 8:30 AM - 5:30 PM
• Location: Training Center, North Urban Center, Tunis

• Information security risk managers
• Information security team members
• Information security officers

• Course materials
• 40% demonstration
• 40% theory
• 20% practical exercises

• Day 1 : Introduction to the ISO/IEC 27005 risk management program
  • Objectives and training structure
  • Concepts and definitions of risk
  • Normative and regulatory frameworks
  • Implementation of a risk management program
  • Understanding the organization and its context
• Day 2 : Implementing an ISO/IEC 27005 risk management process
  • Risk identification
  • Risk analysis and assessment
  • Risk appreciation (quantitative method)
  • Risk treatment
  • Acceptance and management of residual risks
  • Communication and consultation on risks
  • Risk monitoring and review
• Day 3 : Overview of other risk assessment methods and examination
  • OCTAVE Method
  • MEHARI Method
  • EBIOS Method
  • Harmonized EMR Methodology
  • Training closure