The ISO/IEC 27005 Lead Risk Manager training course provides participants with the competencies required to support organizations in establishing, managing, and improving an Information Security Risk Management (ISRM) program based on ISO/IEC 27005 guidelines. Beyond outlining the steps for program implementation, the course details best practices and methodologies for effective risk management.
Risk management is a critical element of any information security program. An effective ISRM program enables organizations to identify, assess, mitigate, and prevent information security risks.
This training presents a risk management framework aligned with ISO/IEC 27005 guidelines, which also supports the requirements of ISO/IEC 27001. Participants will gain a thorough understanding of other leading risk management frameworks and methodologies, including OCTAVE, EBIOS, MEHARI, CRAMM, NIST, and Harmonized TRA.
Achieving the PECB ISO/IEC 27005 Lead Risk Manager certification demonstrates the holder’s skills and knowledge in performing the processes necessary for managing information security risks and supporting the maintenance and continual improvement of an organization’s ISRM program.
The training is followed by a certification examination. A passing score qualifies candidates to apply for the “PECB Certified ISO/IEC 27005 Lead Risk Manager” credential.
This training course is designed for:
Managers or consultants responsible for or involved in organizational information security.
Individuals responsible for managing information security risks, such as ISMS professionals and risk owners.
Members of information security teams, IT professionals, and privacy officers.
Individuals tasked with ensuring conformity to the information security requirements of ISO/IEC 27001.
Project managers, consultants, or expert advisors seeking to master information security risk management.
Upon successfully completing this training course, you will be able to:
Explain the risk management concepts and principles based on ISO/IEC 27005 and ISO 31000.
Establish, maintain, and continually improve an information security risk management framework using ISO/IEC 27005 guidelines and best practices.
Apply the information security risk management processes defined in ISO/IEC 27005.
Plan and execute risk communication and consultation activities.
Document, report, monitor, and review the information security risk management process and framework.
The course presents risk management best practices to prepare participants for real-world scenarios.
Instruction includes essay-type exercises (some based on a case study) and scenario-based multiple-choice quizzes.
Participants are encouraged to collaborate and discuss during exercises and quizzes.
Quiz structures are designed to reflect the format of the certification exam.
Participants should possess a fundamental understanding of ISO/IEC 27005 and comprehensive knowledge of risk management and information security principles.
The course covers five days of content, with the certification exam on the fifth day, and carries 31 CPD credits. In the self-study format you cover the same material at your own pace.
Yes. The course fee includes the PECB certification and examination fees. If you do not pass, one complimentary retake is available within 12 months of your first attempt.
Participants should possess a fundamental understanding of ISO/IEC 27005 and comprehensive knowledge of risk management and information security principles.
It is available as self-study (English, French) and hybrid learning (English). Choose the format and language before adding the course to your cart.
Hybrid learning combines the self-paced course with one day of one-to-one live coaching with the instructor. The day can be split into a half day before you start studying and a half day before your exam, so you go in prepared.
There is no scheduled live class for this course at the moment. The hybrid option adds one day of one-to-one live coaching with the instructor. Organizations that want a dedicated live session can contact us at [email protected].
PECB issues the certificate. After passing the exam you can apply for the “PECB Certified ISO/IEC 27005 Lead Risk Manager” credential. Horus Academy is a PECB Authorized Silver Partner and does not issue the certificate itself.
The “PECB Certified ISO/IEC 27005 Lead Risk Manager” exam meets all the requirements of the PECB Examination and Certification Program (ECP). It covers the following competency domains:
Domain 1: Fundamental principles and concepts of information security risk management
Domain 2: Implementation of an information security risk management program
Domain 3: Information security risk assessment
Domain 4: Information security risk treatment
Domain 5: Information security risk communication, monitoring, and improvement
Domain 6: Information security risk assessment methodologies
Upon successfully passing the examination, you may apply for the relevant “PECB Certified ISO/IEC 27005 Lead Manager” credential based on your professional experience, as specified in the program’s qualification scheme. The official certificate will be issued after you have fulfilled all associated educational and professional requirements.
| Credential | Exam | Professional experience | Risk Management experience | Other requirements |
|---|---|---|---|---|
| PECB Certified ISO/IEC 27005 Provisional Risk Manager | PECB Certified ISO/IEC 27005 Lead Risk Manager or equivalent | None | None | Signing the PECB Code of Ethics |
| PECB Certified ISO/IEC 27005 Lead Risk Manager | PECB Certified ISO/IEC 27005 Lead Risk Manager or equivalent | Five years: Two years of work experience in Information Security Risk Management | Information Security Risk Management activities: 300 hours | Signing the PECB Code of Ethics |
| PECB Certified ISO/IEC 27005 Senior Lead Risk Manager | PECB Certified ISO/IEC 27005 Lead Risk Manager or equivalent | Ten years: Seven years of work experience in Information Security Risk Management | Information Security Risk Management activities: 1000 hours | Signing the PECB Code of Ethics |
To be considered valid, information security risk management activities must adhere to established best practices and include the following:
The training course fee is comprehensive and includes all associated certification and examination costs.
Participants will receive extensive training materials comprising over 450 pages of instructional content, practical examples, exercises, and quizzes.
Attendees who complete the training will be awarded a certificate of course completion, accredited for 31 Continuing Professional Development (CPD) credits.
Candidates who do not pass the examination on their first attempt are eligible for one complimentary retake within a 12-month period from the initial exam date.
Course agenda
Day 1: Introduction to ISO/IEC 27005 and information security risk management
Day 2: Risk identification, analysis, evaluation, and treatment based on ISO/IEC 27005
Day 3: Information security risk communication and consultation, recording and reporting, and monitoring and review
Day 4: Risk assessment methods
Day 5: Certification exam
