EBIOS Risk Manager study plan

Map the EBIOS Risk Manager five-step workflow (scope and framing, feared events, ecosystem, scenarios, risk treatment) and state the purpose and key outputs of each step from memory

Define the core vocabulary precisely: feared event, supporting asset, business asset, risk source, target objective, stakeholder, ecosystem, and risk scenario

Explain how EBIOS RM positions itself against the ISO 31000 and ISO 27005 risk-management frameworks, including where it plugs into an existing ISMS

Draft a one-page glossary in your own words with no copied text

Build a scope statement for a fictional organisation that defines the study perimeter, the business values to protect, and the assumptions made

Identify and classify business assets and supporting assets for that perimeter, and link each supporting asset to the business asset it serves

Select risk sources and target objectives, and justify why each pairing matters for the organisation's mission

Define feared events using the gravity scale and express them in business-impact language rather than technical language

Construct an ecosystem map for the fictional case covering suppliers, clients, partners, regulators, and internal entities

Classify each ecosystem party by dependency type and by the threat it may pose, including interdependent and adversarial relationships

Derive stakeholder-driven risk scenarios from the ecosystem map, showing how a party can become a path for a feared event

Explain the difference between a strategic scenario and an operational scenario and when each is used

Build operational scenarios using the standard elements: risk source, target objective, and the attack path through the ecosystem

Estimate likelihood using the EBIOS RM likelihood scale and gravity using the impact scale, and record the rationale for each rating

Place scenarios on the risk map and identify which fall above the organisation's risk appetite

Distinguish inherent risk from residual risk and state what changes between the two

Select treatment options for each above-appetite scenario using the standard categories of avoid, reduce, transfer, and accept, and justify each choice

Derive security measures from the scenarios and map each measure to the risk it addresses, avoiding measures that are not traceable to a scenario

Distinguish measures that act on likelihood from those that act on impact, and identify measures that create new dependencies

Define residual risk after treatment and document the acceptance decision and its owner

Produce a concise management summary that presents the top risks, chosen treatments, and residual exposure in business language for an executive audience

Explain how the EBIOS RM outputs feed a statement of applicability, a security roadmap, and an annual risk review cycle

Identify the common failure modes of an EBIOS RM study: scope too broad, feared events written as technical failures, ecosystem ignored, and scenarios not traceable to feared events

Describe how the method integrates with a broader governance, risk, and compliance process and with third-party risk management

Recite the five workshops, their inputs, outputs, and participants without notes

Recall the scales used for gravity and likelihood and the criteria that anchor each level

Distinguish EBIOS RM terms that are easily confused: feared event versus risk scenario, business asset versus supporting asset, strategic versus operational scenario

Work through at least forty practice questions and log every error with the underlying concept it exposed

Re-run a compressed end-to-end study on a new fictional case in under three hours to test fluency across all five workshops

Review the error log and re-test every previously missed concept until each is answered correctly twice

Complete two timed full-length practice sets under exam conditions and analyse the score by workshop

Confirm readiness by checking that no workshop scores below a self-set threshold and schedule the exam