Duration
ISO/IEC 27005:2022 Information security risk management
2 days
Overview
With the increasing number of internal and external information security threats, organizations recognize the importance of adopting a formal risk management programme. Without a mechanism to identify, analyse and manage information security risks, it’s difficult for organizations to prioritize their security remediation efforts and resource allocation and associated costs. This leaves organizations more susceptible to security breaches, which can lead to financial and reputational damage.
Building on the concepts and framework specified in ISO/IEC 27001, ISO/IEC 27005 provides guidelines for adopting an information security risk management approach that is appropriate to all organizations.
Who is this course for?
Anyone who wants to learn about:
- Identifying and analysing information security risks
- How risks can be evaluated
- What treatments, controls and measures can be implemented in order to mitigate risks
- Ongoing governance and risk monitoring processes
The course is applicable to individuals from any size or type of organization who are currently involved in (or will be in the future) planning, implementing, maintaining, supervising, or assessing information security, as part of an ISO/IEC 27001 ISMS or a standalone system.
What will I learn?
Upon completion of this training, you will be able to:
- Explain concepts specific to information risk management including terms and definitions
- Recognize typical information security risks faced by organizations
- Recognize typical information security risk management concerns
- Communicate ISO/IEC 27005:2022 introduction, background, purpose, scope, and structure
- Explain how ISO/IEC 27005:2022 integrates and interfaces with other standards such as ISO/IEC 27001:2022
- Implement the topics covered in ISO/IEC 27005:2022 within your organization
- Determine the value of the information assets under your control
- Evaluate threats to information assets
- Identify, analyze, and evaluate information security risks
- Prioritize and choose appropriate risk treatments
What are the benefits?
You will:
- Identify key benefits associated with using ISO/IEC 27005:2022 for protecting information assets, as part of an effective information security management system (ISMS)
- Understand the best practice risk management processes contained in ISO/IEC 27005:2022
- Understand the rationale behind the processes, their usage and implementation
- Establish an acceptable level of risk for your information assets based on a knowledge and understanding of the risks your organization faces
- Develop processes for assessing and managing the many different risks related to your organization’s information assets
- This course will help organizations investigate and score information security risks in a robust, quantifiable and repeatable way.
Prerequisites
You are expected to have the following prior knowledge:
You should have a basic knowledge of ISO/IEC 27001:2022 and ISO/IEC 27002:2022, as well as an understanding of the key principles of an ISMS.
We also recommend that you have an awareness of generic risk assessments and basic understanding of information security principles and terminology.
Some delegates on this course will have already attended our Information Security Management System (ISMS) Requirements of ISO 27001:2022 or Information Security Management System (ISMS) Implementing ISO/IEC 27001:2022 course.
We also recommend delegates have an understanding of the risk assessment approach currently employed in their organizations, should one exist.
Day 1
- Benefits to you, welcome and introductions
- Course aims, objectives and structure
Programme scope, delivery arrangements and suitability are confirmed during enquiry.