ISO 27005 RM study plan
ISO 27005 RM · Give each week a clear focus.
8 weeks · About 6 hours per week
Fundamental principles and concepts of information security risk management
Define risk, uncertainty, threat, vulnerability, asset, likelihood, consequence and risk level in your own words and record where ISO/IEC 27005 wording differs from ISO 31000 wording
Distinguish information security risk management from general IT risk management and enterprise risk management, listing three boundary decisions a practitioner must make
Explain the risk management principles of creating value, integration, structured approach, customization and continual improvement and map each to one concrete activity in a security program
Identify the roles of top management, risk owner, asset owner, risk assessor and risk treatment owner and state which decisions each is accountable for
Your checkpoint
A one-page glossary of 20 terms with your own definitions, each cross-referenced to the ISO/IEC 27005 concept it belongs to
Fundamental principles and concepts of information security risk management & Information security risk management framework and processes based on ISO/IEC 27005
Walk through the ISO/IEC 27005 process steps in order: context establishment, risk identification, risk analysis, risk evaluation, risk treatment, communication and consultation, monitoring and review
Describe how the risk management process nests inside the ISO/IEC 27001 management system clauses and where the two documents hand off to each other
Construct a worked example of context establishment for a fictional organization, covering scope, boundaries, risk criteria, constraints and the risk acceptance criteria
Differentiate risk appetite, risk tolerance, risk capacity and risk acceptance criteria and show how each is used in a risk evaluation decision
Your checkpoint
A context-establishment document of 400 words for a fictional organization including scope, risk criteria and acceptance criteria
Information security risk management framework and processes based on ISO/IEC 27005
Perform a full risk identification for a fictional asset set, producing threats, vulnerabilities and potential consequences for each asset
Apply both a qualitative and a semi-quantitative analysis technique to the same risk set and compare the resulting risk rankings
Evaluate identified risks against the acceptance criteria from week 2 and justify which risks are treated, retained, avoided or shared
Explain the ISO/IEC 27005 treatment options and the role of controls from ISO/IEC 27002 as treatment instruments rather than as risk decisions
Your checkpoint
A risk register with at least 15 risks, each with asset, threat, vulnerability, existing controls, likelihood, consequence, risk level and treatment decision
Information security risk management framework and processes based on ISO/IEC 27005 & Implementation of an information security risk management program
Write a risk treatment plan that names a treatment owner, a deadline and a residual risk estimate for every treated risk
Explain the Statement of Applicability in relation to the risk treatment plan and identify which document records which decision
Describe the monitoring and review activities that keep a risk register current, including trigger events, review frequency and indicator selection
Draft the communication and consultation plan that specifies who receives which risk information and at what cadence
Your checkpoint
A risk treatment plan covering all treated risks from the week 3 register, with owners, dates and residual risk estimates
Implementation of an information security risk management program
Build a business case for a risk management program that states scope, mandate, budget, staffing and expected outcomes in management language
Sequence the implementation steps of a risk management program, from obtaining top management commitment to the first full risk assessment cycle
Define the risk criteria, scales and matrices an organization will adopt, and justify the choice of scale granularity
Identify the competence, awareness and documentation needs of staff participating in risk management and specify how each is met
Your checkpoint
A 600-word implementation roadmap with phases, owners, dependencies and success measures for the first year
Implementation of an information security risk management program & Other information security risk assessment methods
Explain how risk assessment results feed management review, internal audit and continual improvement under ISO/IEC 27001
Design the metrics that show whether the risk management program is working, distinguishing activity metrics from outcome metrics
Compare the ISO/IEC 27005 process with at least two other assessment approaches in terms of effort, rigor, repeatability and output
Select the assessment approach that fits a given scenario and defend the choice in writing
Your checkpoint
A comparison table of three assessment approaches scored against five criteria, plus a one-paragraph recommendation for a stated scenario
Other information security risk assessment methods
Describe the structure and use of an asset-based, scenario-based and vulnerability-based assessment approach and state when each is preferable
Explain the purpose and limitations of quantitative techniques such as annualized loss expectancy and of qualitative ranking scales
Outline how a control-oriented or maturity-oriented assessment differs in output from a risk-oriented assessment
Identify the assumptions and biases that distort assessment results and describe one mitigation for each
Your checkpoint
A 500-word briefing comparing qualitative, semi-quantitative and quantitative assessment, with stated limitations of each
Fundamental principles and concepts of information security risk management & Implementation of an information security risk management program & Information security risk management framework and processes based on ISO/IEC 27005 & Other information security risk assessment methods
Consolidate all deliverables into a single coherent risk management package and check internal consistency of criteria, scales and decisions
Answer practice questions across all four domains and log every miss with the underlying concept gap
Re-derive the ISO/IEC 27005 process flow from memory, including the communication and monitoring loops
Write a personal exam-day strategy covering question triage, time allocation and handling of scenario questions
Your checkpoint
A consolidated 10-page portfolio plus a scored practice test log with a remediation note for each missed concept
Milestones
Week 2: You can explain context establishment and risk criteria to a colleague without notes and have a written context document to show
Week 4: Your risk register passes a self-review: every risk has an owner, a treatment decision and a residual estimate, and criteria match the week 2 document
Week 6: You can justify your chosen assessment approach against two alternatives using explicit criteria rather than preference
Week 8: You score at least 80 percent on a full-length practice set across all four domains and can name the concept behind every miss