🛡️ Certified ISO/IEC 27005 Lead Risk Manager Masterclass: Advanced Information Security Risk Management

Course Outline

Module 1: Foundation and Context of Information Security Risk Management (ISRM)

ü  Overview of ISO/IEC 27005 (2022) Standard and its relationship with ISO/IEC 27001

ü  Fundamental Risk Concepts: Threat, Vulnerability, Impact, Likelihood

ü  The Importance of ISRM in Organizational Strategy

ü  Key Terminology and Definitions

ü  Principles of Effective Risk Management

ü  Practical Session: Comparing the ISO/IEC 27005 framework with other risk models (e.g., NIST, OCTAVE)

 

Module 2: Organizational Context and Scope Definition

ü  Defining the External and Internal Context

ü  Determining the Scope and Boundaries of the ISRM process

ü  Establishing Risk Acceptance Criteria and Evaluation Scales

ü  Developing a Risk Communication Strategy

ü  Identification of Legal, Regulatory, and Contractual Requirements

ü  Practical Session: Drafting a formal ISRM Scope and Risk Criteria document for a simulated company

 

Module 3: Asset Management and Classification

ü  Methodology for Information Asset Identification and Inventory

ü  Asset Valuation and Criticality Assessment

ü  Defining Asset Owners and Custodians

ü  Information Classification Schemes (Confidentiality, Integrity, Availability)

ü  Mapping Assets to Business Processes

ü  Practical Session: Conducting an asset inventory and classification exercise for a department

 

Module 4: Advanced Threat and Vulnerability Identification

ü  Systematic Threat Source and Event Identification Techniques

ü  Mapping Threats to Specific Assets and Vulnerabilities

ü  Vulnerability Scanning and Assessment Methodologies

ü  Using Threat Intelligence to Inform Risk Identification

ü  Developing an Organizational Threat Catalogue

ü  Practical Session: Analyzing a recent cyber attack report to identify Threats and Vulnerabilities

 

Module 5: Principles of Qualitative Risk Analysis

ü  Methodologies for Qualitative Risk Analysis (e.g., Matrix-based)

ü  Estimating Likelihood/Probability of Threat Exploitation

ü  Assessing Business Impact Categories

ü  Determining the Qualitative Risk Level

ü  Advantages and Limitations of Qualitative Analysis

ü  Practical Session: Performing a Qualitative Risk Assessment on five high-value information assets

 

Module 6: Advanced Quantitative Risk Analysis Techniques

ü  Understanding the need for Quantitative Risk Analysis

ü  Annualized Loss Expectancy (ALE) Calculation (SLE x ARO)

ü  Introduction to Stochastic Models (e.g., Monte Carlo Simulation)

ü  Data Requirements and Challenges for Quantitative Analysis

ü  Interpreting and Presenting Quantitative Results

ü  Practical Session: Calculating ALE for specific risk scenarios and comparing the results

 

Module 7: Risk Evaluation and Risk Acceptance Criteria

ü  Comparing Analyzed Risk Levels with Risk Acceptance Criteria

ü  Prioritizing Risks Based on Business Impact

ü  Identifying "As Low As Reasonably Practicable" (ALARP) Risks

ü  Decision-making Process for Risk Treatment

ü  Documenting the Risk Evaluation Rationale

ü  Practical Session: Leading a simulated management review to decide on risk acceptance for borderline risks

 

Module 8: Principles of Risk Treatment and Control Selection

ü  The Four Strategies of Risk Treatment (Avoid, Transfer, Mitigate, Accept)

ü  Selecting Appropriate Security Controls from ISO/IEC 27001 Annex A

ü  Justification of Control Selection Based on Risk Reduction

ü  Cost-Benefit Analysis of Control Implementation

ü  Developing Control Implementation Plans

ü  Practical Session: Mapping selected Annex A controls to treat two priority risks

 

Module 9: Developing the Risk Treatment Plan (RTP)

ü  Structure and Content of a Formal Risk Treatment Plan

ü  Assigning Ownership, Resources, and Timelines for Treatment Actions

ü  Integrating Treatment Actions into Operational Planning

ü  Measuring and Reporting Progress on the RTP

ü  Managing Dependencies between Treatment Actions

ü  Practical Session: Collaboratively creating a detailed Risk Treatment Plan for a major organizational risk

 

Module 10: The Statement of Applicability (SoA) and Control Justification

ü  Purpose and Importance of the Statement of Applicability (SoA)

ü  Justifying the Inclusion and Exclusion of ISO/IEC 27001 Annex A Controls

ü  Mapping Control Objectives to Business Requirements

ü  Review and Approval Process for the SoA

ü  Maintaining and Updating the SoA

ü  Practical Session: Creating a draft Statement of Applicability for a new ISMS scope

 

Module 11: Residual Risk and Ongoing Risk Management

ü  Definition and Calculation of Residual Risk

ü  Management's Role in Accepting Residual Risk

ü  Techniques for Managing and Monitoring Residual Risk

ü  The Concept of Secondary Risk

ü  Transitioning from Treatment to Ongoing Management

ü  Practical Session: Assessing and documenting the residual risk after implementing initial controls

 

Module 12: Integration with the ISO/IEC 27001 ISMS Lifecycle

ü  Aligning ISRM with the PDCA (Plan-Do-Check-Act) Cycle

ü  Ensuring Risk is Addressed in Policy and Objectives

ü  The Role of ISRM in ISMS Internal Audits

ü  Continuous Improvement of the ISRM process within the ISMS

ü  Documenting and Retaining Information Related to Risk

ü  Practical Session: Designing a flow chart showing the integration points between ISRM and core ISMS processes

 

Module 13: Risk Communication and Stakeholder Management

ü  Techniques for Effective Stakeholder Communication on Risk

ü  Tailoring Risk Reporting to Different Audiences (Technical vs. Executive)

ü  Obtaining Management Commitment and Buy-in for Risk Treatment

ü  Managing Conflicts and Concerns related to Risk Decisions

ü  Consultation Process with Internal and External Stakeholders

ü  Practical Session: Role-playing a scenario for communicating a high-impact risk to the executive board

 

Module 14: Risk Monitoring and Review Frameworks

ü  Establishing Metrics and Indicators for Risk Monitoring

ü  Frequency and Scope of Periodic Risk Review and Re-Assessment

ü  Techniques for Monitoring Changes to the Context, Assets, and Threats

ü  The Role of Auditing in Risk Monitoring

ü  Risk Reporting and Escalation Procedures

ü  Practical Session: Defining Key Risk Indicators (KRI) and their thresholds for a security program

 

Module 15: Continuous Improvement and Risk Auditing

ü  Identifying Non-conformities in the ISRM process

ü  Implementing Corrective and Preventive Actions

ü  The Principles of ISO/IEC 27005 Compliance Auditing

ü  Preparing for External Certification Audits

ü  Lessons Learned and Knowledge Retention

ü  Practical Session: Drafting a Corrective Action Plan following a simulated audit finding

 

Module 16: Handling Specific Risk Scenarios (Supply Chain, Cloud)

ü  Managing Risk in the Supply Chain (ISO/IEC 270036 considerations)

ü  Risk Assessment for Cloud Computing Environments

ü  Outsourcing and Third-Party Risk Management

ü  Geopolitical and Regulatory Risks

ü  Emerging Technology Risk (e.g., AI, IoT)

ü  Practical Session: Developing a third-party vendor risk assessment questionnaire

 

Module 17: Governance, Legal, and Regulatory Aspects of Risk

ü  The Role of IT Governance in ISRM

ü  Understanding Legal Liability related to Information Security Risks

ü  Mapping Risk to Regulatory Requirements (e.g., GDPR, HIPAA)

ü  Developing and Reviewing Risk Policies

ü  Ethical Considerations in Risk Management

ü  Practical Session: Linking a specific regulatory requirement to a corresponding organizational risk and control

 

Module 18: Certification Exam Preparation and Advanced Case Studies

ü  In-depth Review of Complex ISO/IEC 27005 Concepts

ü  Detailed walkthrough of Advanced Case Studies

ü  Tips and Strategies for the Certification Exam

ü  Final Q&A and Knowledge Consolidation

ü  Mock Certification Exam with comprehensive debrief

ü  Practical Session: Full Mock ISO/IEC 27005 Lead Risk Manager Certification Exam

About Our Trainers

Our instructors are highly accomplished, globally certified professionals—each holding the ISO/IEC 27005 Lead Risk Manager certification, alongside multiple advanced security credentials such as CISSP, CISM, and CRISC. They bring a minimum of 12 years of hands-on experience in deploying and leading sophisticated Information Security Risk Management programs across finance, government, and technology sectors. Their deep expertise ensures that the training is not only academically sound but also rich with practical, actionable insights and strategic guidance.

 

Quality Statement

 

Phoenix Training Center is dedicated to providing superior professional development. We guarantee an engaging, expert-led learning environment with course materials that are current, comprehensive, and aligned with international standards. Our commitment to quality ensures that participants acquire measurable, high-value skills necessary for real-world impact and successful certification.

Admission Criteria

ü  Participants should be reasonably proficient in English. 

ü  Applicants must live up to Phoenix Center for Policy, Research and Training admission criteria.

Terms and Conditions

1. Discounts: Organizations sponsoring Four Participants will have the 5th attend Free
2. What is catered for by the Course Fees: Fees cater for all requirements for the training – Learning materials, Lunches, Teas, Snacks and Certification. All participants will additionally cater for their travel and accommodation expenses, visa application, insurance, and other personal expenses.
3. Certificate Awarded: Participants are awarded Certificates of Participation at the end of the training.
4. The program content shown here is for guidance purposes only. Our continuous course improvement process may lead to changes in topics and course structure.
5. Approval of Course: Our Programs are NITA Approved. Participating organizations can therefore claim reimbursement on fees paid in accordance with NITA Rules.

Booking for Training

Simply send an email to the Training Officer on training@phoenixtrainingcenter.com and we will send you a registration form. We advise you to book early to avoid missing a seat to this training.

Or call us on +254720272325 / +254737296202

Payment Options

We provide 3 payment options, choose one for your convenience, and kindly make payments at least 5 days before the Training start date to reserve your seat:

1. Groups of 5 People and Above – Cheque Payments to: Phoenix Center for Policy, Research and Training Limited should be paid in advance, 5 days to the training.
2. Invoice: We can send a bill directly to you or your company.
3. Deposit directly into Bank Account (Account details provided upon request)

Cancellation Policy

1. Payment for all courses includes a registration fee, which is non-refundable, and equals 15% of the total sum of the course fee.
2. Participants may cancel attendance 14 days or more prior to the training commencement date.
3. No refunds will be made 14 days or less before the training commencement date. However, participants who are unable to attend may opt to attend a similar training course at a later date or send a substitute participant provided the participation criteria have been met.

 

Tailor-Made Courses

We understand that every organization has unique challenges and opportunities as well as unique training needs. Phoenix Training Center offers tailor-made courses designed to address specific requirements and challenges faced by your team or organization. Whether you need a customized curriculum, a specific duration, or on-site delivery, we can adapt our expertise to provide a training solution that perfectly aligns with your objectives.

We can customize this Course to focus on your industry, specific risk profile, or internal stakeholder dynamics. Contact us to discuss how we can create a bespoke training program that maximizes value and impact for your team. For further inquiries, please contact us on Tel: +254720272325 / +254737296202 or Email training@phoenixtrainingcenter.com

 

Accommodation and Airport Pick-up

For physical training attendees, we can assist with recommendations for accommodation near the training venue. Airport pick-up services can also be arranged upon request to ensure a smooth arrival. Please inform us of your travel details in advance if you require these services. For reservations contact the Training Officer on Email: training@phoenixtrainingcenter.com or on Tel: +254720272325 / +254737296202