ISO/IEC 27005 Lead Risk Manager study plan
ISO/IEC 27005 Lead Risk Manager · Give each week a clear focus.
8 weeks · About 7 hours per week
Fundamental concepts and principles of information security risk management & ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001
Define risk, uncertainty, asset, threat, vulnerability, likelihood, consequence and risk level in your own words and map each term onto the ISO/IEC 27005 process steps
Distinguish information security risk management from generic enterprise risk management and from incident management, and state where the boundaries sit
Outline the full ISO/IEC 27005 process cycle (context establishment through monitoring and review) on a single page, including the communication and consultation loop and the recording thread
Explain how ISO/IEC 27005 supports the risk-related requirements of ISO/IEC 27001 (risk assessment, risk treatment, risk owners, Statement of Applicability) without treating it as certifiable on its own
Your checkpoint
A one-page process diagram plus a 15-term glossary with a one-sentence definition and one example for each term
ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001 & Context establishment, risk identification and risk analysis
Derive context-establishment inputs: scope and boundaries, internal and external issues, interested parties, constraints, and the basic risk criteria (risk appetite, acceptance criteria, scales)
Construct qualitative and semi-quantitative likelihood and impact scales with explicit definitions for each level and a documented risk matrix
Select and justify an identification technique (for example asset-based, scenario-based, or threat-vulnerability pairing) for a given organisational context
Identify assets, threats, existing controls, vulnerabilities and consequences for a small worked scenario and record them in a structured register
Your checkpoint
A context statement of no more than 800 words with defined scales, a risk matrix, and a first-pass risk register of at least 12 identified risks
Context establishment, risk identification and risk analysis
Perform consequence, likelihood and level-of-risk analysis on the week-2 register, showing the reasoning behind each rating rather than only the number
Compare qualitative, semi-quantitative and quantitative approaches and justify which fits a stated decision, budget and data availability
Apply the concept of risk aggregation and correlation to show how individually low risks can combine into an unacceptable exposure
Document assumptions, data sources, uncertainty and confidence limits for each analysis so a reviewer can challenge them
Your checkpoint
A completed risk analysis workbook for at least 12 risks with ratings, rationale, assumptions and an uncertainty note per risk
Risk evaluation, risk treatment and risk acceptance
Compare analysed risks against the agreed criteria and produce a prioritised list with explicit accept, treat, transfer/share or avoid decisions
Select treatment options from ISO/IEC 27002-style control themes and map each chosen control back to the risk it addresses
Define residual risk, state who owns it, and draft acceptance decisions with named accountable risk owners and review dates
Draft a Statement of Applicability extract showing inclusion and exclusion justifications tied to risk treatment decisions
Your checkpoint
A risk treatment plan covering every risk above the acceptance threshold, each with owner, control mapping, target date and residual risk statement, plus a two-page SoA extract
Risk evaluation, risk treatment and risk acceptance & Risk communication, consultation, monitoring, review and recording
Design a risk communication and consultation plan identifying who needs what information, in what form, and at what frequency
Define monitoring and review triggers: control effectiveness checks, change triggers, key risk indicators and scheduled reassessment intervals
Specify the records the process must retain (registers, decisions, rationale, acceptance evidence) and how they are protected, versioned and retained
Explain how risk treatment progress and residual risk are reported to top management in language that supports governance decisions
Your checkpoint
A communication and monitoring plan plus a records-retention schedule and a one-page management dashboard mock-up
ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001 & Risk communication, consultation, monitoring, review and recording
Integrate the risk process with ISO/IEC 27001 clauses 6, 8, 9 and 10, showing where risk outputs feed the ISMS and where ISMS outputs feed back into risk work
Design a repeatable reassessment cycle that responds to changes in threat landscape, business context and control performance
Identify common failure modes in risk programmes (register rot, rating inflation, orphaned treatments, acceptance without authority) and propose a countermeasure for each
Review the week-1 to week-5 artefacts for internal consistency and correct any mismatches between criteria, ratings, treatments and acceptance
Your checkpoint
A revised, internally consistent risk management procedure of 4 to 6 pages covering process steps, roles, triggers, records and integration points with the ISMS
Fundamental concepts and principles of information security risk management & ISO/IEC 27005 framework, risk management process and integration with ISO/IEC 27001 & Context establishment, risk identification and risk analysis & Risk evaluation, risk treatment and risk acceptance & Risk communication, consultation, monitoring, review and recording
Answer scenario-style questions across all five domains under timed conditions and mark them against the source material
Re-derive from memory the process flow, the scales, the treatment options and the acceptance criteria without notes
Rewrite your weakest three explanations so they use precise standard terminology instead of everyday synonyms
Build a personal list of the ten concepts you most often confuse and a one-line disambiguation for each
Your checkpoint
A timed mock paper of at least 60 questions scored and reviewed, with a written error log and corrected explanations for every miss
Context establishment, risk identification and risk analysis & Risk evaluation, risk treatment and risk acceptance & Risk communication, consultation, monitoring, review and recording
Rehearse the full lifecycle on a fresh scenario from context through acceptance in under 90 minutes, producing all intermediate artefacts
Defend three judgement calls (a rating, a treatment choice, an acceptance decision) in writing as you would to an auditor or a risk owner
Consolidate the glossary, matrices and process diagrams into a single revision pack you can scan in 20 minutes
Complete a final self-assessment against every domain objective and close any remaining gap before exam day
Your checkpoint
A complete end-to-end worked case study with all artefacts, plus a final self-assessment sheet showing each domain objective as met or closed
Milestones
Week 2: You can explain, without notes, how context and risk criteria shape every later rating, and your scales have defined levels that another person could apply consistently
Week 4: Every risk in your register has a decision, a named owner and a rationale, and you can state the difference between inherent, current and residual risk
Week 6: You can trace a single risk from context through identification, analysis, evaluation, treatment, acceptance and reporting, naming the record produced at each step
Week 7: Timed mock score is at or above your self-set pass target with no domain below 60 percent, and every error has a written correction
Week 8: You can produce a defensible end-to-end risk assessment for a new scenario within 90 minutes and justify each judgement call to a sceptical reviewer