ISO 27005 RM study guide
ISO 27005 RM · Work through your exam, one topic at a time.
The PECB Certified ISO/IEC 27005 Risk Manager credential is issued by PECB (the Professional Evaluation and Certification Board) to individuals who pass the associated certification exam and meet the credential requirements. It demonstrates that the holder comprehends the concepts and principles of information security risk management, and that they can develop, establish, maintain and improve a risk management framework guided by ISO/IEC 27005, drawing also on the risk management principles of ISO 31000. The ISO 27005 RM study guide has 4 sections and about 1,609 words.
01Fundamental principles and concepts of information security risk management
ISO/IEC 27005:2022 gives guidance on managing information security risk without prescribing a single methodology. This domain tests precise use of the vocabulary on which every later step depends; candidates who confuse likelihood with vulnerability, or risk owner with control owner, fail scenario questions even when they know the process by heart.
430 words, about 2 min02Implementation of an information security risk management program
A risk process that exists only on paper changes nothing. This domain tests how you turn ISO/IEC 27005 guidance into an operating programme inside an ISO/IEC 27001 management system: governance, criteria, capability, and evidence that the programme actually changes decisions.
403 words, about 2 min03Information security risk management framework and processes based on ISO/IEC 27005
This is the engine of the exam: the ISO/IEC 27005 process, structured on ISO 31000 and aligned with ISO/IEC 27001 clause 6.1. Expect questions on step order, inputs and outputs, and on what belongs in each step.
410 words, about 2 min04Other information security risk assessment methods
ISO/IEC 27005 is deliberately method-agnostic: it states what a sound risk process must contain, not which calculation to use. This domain tests whether you can distinguish assessment methods and frameworks, and choose one defensibly.
366 words, about 2 min