Lead Risk Manager
ISO/IEC 27005 Lead Risk Manager
2026 edition
Self-paced PECB training delivered via myPECB.
Global training partner Aegentra is an official PECB authorised training partner and an official CompTIA partner.
The senior pathway in the ISO/IEC 27005 scheme: establish, maintain, and continually improve an information security risk management framework, and lead the programme rather than operate a single process within it. Covers risk identification, analysis, evaluation and treatment, then communication, recording, reporting, monitoring and review — followed by a full day on the established assessment methods. Concludes with the official PECB certifying exam.
- Typical study effort
- 35–45 hours
- CPD credits
- 31
- Course languages
- English
Who it is for
- Managers or consultants responsible for information security in an organisation
- Individuals responsible for managing information security risks
- IT professionals and privacy officers
- Project managers, consultants, and expert advisers seeking to master the management of information security risks
What you will learn
- Explain the risk management concepts and principles based on ISO/IEC 27005 and ISO 31000.
- Establish, maintain, and continually improve an information security risk management framework.
- Apply information security risk management processes.
- Plan and establish risk communication and consultation activities.
- Record, report, monitor, and review the information security risk management process and framework.
Course content
Day 1 — Introduction to ISO/IEC 27005 and information security risk management
- Structure of ISO/IEC 27005 and its relation to other risk frameworks
- Fundamental concepts and principles of information security risk management
- Confidentiality, integrity, availability, and the definition of risk
- Threats, vulnerabilities, consequences, likelihood, and the role of the risk owner
- Implementing an information security risk management programme
Day 2 — Risk identification, analysis, evaluation, and treatment based on ISO/IEC 27005
- Risk identification approaches and information gathering techniques
- Primary and supporting assets, asset valuation, and existing controls
- Risk analysis techniques, consequence and likelihood assessment
- Inherent, residual, and target risk; evaluation against risk criteria
- Treatment options — modification, retention, avoidance, and sharing
- Risk treatment plans and residual risk acceptance
Day 3 — Risk communication and consultation, recording and reporting, monitoring and review
- Establishing a risk communication plan
- Internal and external communication with decision-makers and stakeholders
- Documenting the risk management process and maintaining records
- Monitoring and reviewing programme effectiveness
- Management review, corrective actions, and continual improvement
Day 4 — Risk assessment methods
- OCTAVE method, OCTAVE-S, OCTAVE-Allegro, and OCTAVE FORTE
- MEHARI — three main phases for risk management
- EBIOS — five workshops and modules
- NIST publications and the seven steps of the NIST risk management framework
- CRAMM risk analysis and management methodology
- Harmonized Threat and Risk Assessment (TRA) — five phases
Day 5 — Certification exam
- PECB Certified ISO/IEC 27005 Lead Risk Manager exam
- 80 multiple-choice questions across the six competency domains
- Open-book: the standard, course materials, and personal notes permitted
Prerequisites
- A fundamental understanding of ISO/IEC 27005 and comprehensive knowledge of risk assessment and information security.
- Prior ISO 27001 experience is strongly recommended — the framework is designed to sit inside an ISMS.
The exam
- Format
- Open-book multiple choice — stand-alone and scenario-based questions, three options each
- Duration
- 3 hours
- Questions
- 80 multiple-choice questions across 6 competency domains — fundamental principles and concepts of information security risk management (13 questions), implementation of an information security risk management program (7), information security risk assessment (20, the largest domain at 25% of the paper), risk treatment (15), risk communication, monitoring and improvement (10), and risk assessment methodologies (15)
- Pass mark
- 70%
What is included
Course materials
- PECB ISO/IEC 27005 Lead Risk Manager slide deck (digital)
- Over 450 pages of training material, practical examples, quizzes, and exercises
- 12 months access via myPECB
- Attestation of course completion worth 31 CPD credits
Exam and certification package
- First exam attempt included in the course fee
- One free retake included
- Certification application fee included
- First year of the PECB Annual Maintenance Fee (AMF) included