Risk Management: Certified ISO 27005 Risk Manager

Risk Management according to ISO 27005
The purpose of ISO 27005 (latest update) is to provide guidelines for Information Security Risk Management. ISO 27005 supports the general concepts specified in ISO 27001 and is designed to assist the satisfactory implementation of Information Security based on a Risk Management approach. ISO 27005 does not specify or recommend any specific risk analysis method, although it does specify a structured, systematic and rigorous process from analyzing risks to creating the risk treatment plan. The 3-day Certified ISO 27005 Risk Manager training offers you also knowledge of the concepts, models, processes and terminologies, described in ISO 27001 and ISO 27002, important for a complete understanding of the international ISO 27005 standard.

The ISO 27000 series is an international information security standard published by ISO (International Organization for Standardization). The ISO 27005 standard was published in June 2008. In 2011 a new version of ISO 27005 was released by ISO, ISO 27005:2011.

Risk Management is critical to good business governance!
The essential international ISO 27005 standard helps organizations with advice on the why, what and how of managing information security risks in support of their governance objectives.
In this intensive 3-day Certified Risk Manager training you develop the competence to master the basic risk management elements related to all assets of relevance for information security using the ISO 27005 standard as a reference framework.

What will you learn in the Certified ISO 27005 Risk Manager training?

• You will acquire the knowledge necessary for the implementation, management and maintenance of an ongoing Risk Management program.
• You will understand the concepts, approaches, standards, methods and techniques, allowing an effective management of risk according to ISO 27005.
• You will understand the relationship between the Information Security Management System (ISMS) (including Risk Management), the security controls and how to comply with the requirements of different stakeholders of your organization.
• How to interpret the requirements of ISO 27001 on Information Security Risk Management.
• How to acquire the competence to implement, maintain and manage an ongoing Information Security Risk Management program according to ISO 27005.
• You will acquire the competence to effectively advise organisations / your organization on the best practices in Information Security Risk Management.

Based on practical exercises and case studies, you acquire the necessary knowledge and skills to perform an optimal Information Security Risk Assessment and manage risks in time by being familiar with their lifecycle. You will learn the different methods of risk assessment used on the market e.g.: CRAMM, EBIOS, MEHARI, OCTAVE and Microsoft Security Risk Management Guide.

Educational approach of this Risk Management training
The 3-day Risk Manager training is based on both theory and practice. Sessions of lectures are illustrated with examples based on real cases. To benefit from the practical exercises, the number of training participants is limited.