ISO/IEC 27005 Foundation study guide
ISO/IEC 27005 Foundation · Work through your exam, one topic at a time.
The ISO/IEC 27005 Foundation credential is an entry-level certificate offered by PECB for individuals who want to demonstrate general knowledge of the information security risk management guidelines published in ISO/IEC 27005. It is aimed at risk management professionals, staff who manage information security risks within their own area of responsibility, people who simply want to become familiar with the standard's guidance, and anyone considering a career in information security risk management. No professional experience or prior risk management project work is required to attend the training course or to apply for the certificate. Preparation is built around a two-day, participant-centered training course that combines lectures with examples and discussion, encourages interaction through questions and suggestions, and includes quizzes structured similarly to the exam. Topics on this exam: Fundamental concepts of information security risk management and Information security risk management approaches and processes. The ISO/IEC 27005 Foundation study guide has 2 sections and about 740 words.
01Fundamental Concepts of Information Security Risk Management
This domain tests the vocabulary and principles underneath ISO/IEC 27005. Candidates must distinguish a threat from a vulnerability, explain how likelihood and consequence combine into a level of risk, and state how 27005 relates to ISO/IEC 27001 and ISO 31000. Risk - the effect of uncertainty on objectives; in information security, the potential for loss or harm expressed as a combination of consequences and likelihood. Threat - a potential cause of an unwanted incident (ransomware operator, insider, flood).
395 words, about 2 min02Information Security Risk Management Approaches and Processes
This domain tests the end-to-end process and the identification approaches. Expect questions on the order of steps, the four treatment options, and the documents produced. Establish context - define scope, risk criteria (acceptance thresholds, impact and likelihood scales) and roles. Risk identification - find assets, threats, vulnerabilities, existing controls and consequences.
345 words, about 2 min