Risk Manager
ISO/IEC 27005 Risk Manager
2026 edition
Self-paced PECB training delivered via myPECB.
Global training partner Aegentra is an official PECB authorised training partner and an official CompTIA partner.
Identify, evaluate, analyse, treat, and communicate information security risks based on ISO/IEC 27005. The course combines ISO/IEC 27005 with ISO/IEC 27001 so risk assessment is taught in the context of a working ISMS, and covers the risk management concepts and principles of ISO 31000. It also surveys the other established assessment methods — OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA — so you can choose a method rather than inherit one. Concludes with the official PECB certifying exam.
- Typical study effort
- 21–30 hours
- CPD credits
- 21
- Course languages
- English, French
Who it is for
- Managers or consultants responsible for information security in an organisation
- Individuals responsible for managing information security risks
- Members of information security teams, IT professionals, and privacy officers
- Individuals maintaining conformity with the information security requirements of ISO/IEC 27001
- Project managers, consultants, and expert advisers seeking to master information security risk management
What you will learn
- Explain the risk management concepts and principles outlined by ISO/IEC 27005 and ISO 31000.
- Establish, maintain, and improve an information security risk management framework based on the guidelines of ISO/IEC 27005.
- Apply information security risk management processes based on the guidelines of ISO/IEC 27005.
- Plan and establish risk communication and consultation activities.
- Select an appropriate assessment method — OCTAVE, MEHARI, EBIOS, NIST, CRAMM, or Harmonized TRA — for the organisation in front of you.
Course content
Day 1 — Introduction to ISO/IEC 27005 and risk management
- Training course objectives and structure
- Standards and regulatory frameworks
- Fundamental concepts and principles of information security risk management
- Information security risk management program
- Context establishment
Day 2 — Risk assessment, treatment, and communication based on ISO/IEC 27005
- Risk identification
- Risk analysis
- Risk evaluation
- Risk treatment
- Information security risk communication and consultation
Day 3 — Risk recording and reporting, monitoring and review, and assessment methods
- Information security risk recording and reporting
- Information security risk monitoring and review
- OCTAVE and MEHARI methodologies
- EBIOS method and NIST framework
- CRAMM and TRA methods
- Closing of the training course
Prerequisites
- A fundamental understanding of ISO/IEC 27005 and comprehensive knowledge of risk assessment and information security.
- Prior ISO 27001 exposure is helpful — the course teaches risk assessment in the context of an ISMS.
The exam
- Format
- Open-book, multiple-choice — stand-alone and scenario-based questions
- Duration
- 2 hours
- Questions
- 60 multiple-choice questions across 4 competency domains — fundamental principles and concepts of information security risk management (13 questions), implementation of an information security risk management program (7), the risk management framework and processes based on ISO/IEC 27005 (31, the largest domain at 52% of the paper), and other information security risk assessment methods (9)
- Pass mark
- 70%
What is included
Course materials
- PECB ISO/IEC 27005 Risk Manager slide deck (digital)
- Over 350 pages of training material with practical examples
- 12 months access via myPECB
- Practical exercises, quizzes, and case studies
Exam package
- Official PECB ISO/IEC 27005 Risk Manager exam voucher
- Two-hour exam covering four competency domains
- Two exam attempts (initial + one free resit within 12 months)
- Attestation of course completion worth 21 CPD credits