ISO 27005 RM

It covers four competency domains: fundamental principles and concepts of information security risk management; implementation of an information security risk management program; the risk management framework and processes based on ISO/IEC 27005; and other risk assessment methods. Expect questions on identifying, analysing, evaluating, treating and communicating risk, plus methods such as OCTAVE, MEHARI, EBIOS, NIST, CRAMM and Harmonized TRA.

PECB presents the exam as following its training course, and the free retake is limited to participants who completed the course and failed. You can still study independently, but check the current Examination Rules and Policies and the List of PECB Exams for eligibility and scheduling details before booking.

The published agenda is three days. Day 1 introduces ISO/IEC 27005 and risk management. Day 2 covers risk assessment, risk treatment, and risk communication and consultation. Day 3 covers risk recording and reporting, monitoring and review, and risk assessment methods. Participants receive over 350 pages of training materials and an attestation worth 21 CPD credits.

Participants who have completed the training course and fail to pass the exam are eligible to retake it once for free within a 12-month period from the initial date of the exam. Plan your first attempt so that a retake still falls inside that window, and confirm the mechanics with PECB support.

You can apply for the PECB Certified ISO/IEC 27005 Provisional Risk Manager credential, which requires no professional experience, or for the PECB Certified ISO/IEC 27005 Risk Manager credential, which requires two years of work experience, one of them in information security risk management, plus 200 hours of risk management activities. Both require signing the PECB Code of Ethics.

Work through the domains in sequence. Build the vocabulary of risk, asset, threat, vulnerability, likelihood and consequence first, then study how a programme is set up and governed, then walk the ISO/IEC 27005 process step by step, and only then compare the alternative methods. The method domain is easiest to absorb once the core process is solid.

Two recur. First, memorising definitions without being able to place a step in the process, such as distinguishing risk evaluation from risk analysis or risk treatment from risk acceptance. Second, skimming the alternative methods domain and being unable to link a described scenario to the right method. Practise scenario questions and justify each answer against the standard's process.

PECB states that certification fees and examination fees are included in the price of the training course. If you are arranging training through a partner or studying without the course, confirm the current pricing and what is bundled directly with the provider, since this page does not quote a fee.

PECB directs candidates to the List of PECB Exams and the Examination Rules and Policies for specific information about exam type, languages available and other details. Those two documents are the authoritative place to check format and rules, because this study page does not restate figures it cannot verify.