Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

Information Security Risk Assessment Process ISO 27001:2013

Name: Information Security Risk Assessment Process ISO 27001:2013
Rating: 3.9 (78 reviews)

Learn the fundamentals of IS Security, IS Security Risk Assessment Process and ISO 270001:2013 requirements

Created byGovernance Risk and Compliance GRC by GRC Professional

Last updated 6/2025

English

English [Auto],

What you'll learn

You will learn Informaton Security IS Risk Concepts and Risk Assessment Process as per ISO 27001
You will learn the concepts of Information Assets, Information Risks and Categorization of Risks
You will learn the Risk Assessment Methodology and Process
You will learn levels of Risks as Very High, High, Medium, Low and Very Low Risks and Score Ranges. You will learn application of 5 by 5 Risk Assessment Matrix
Understanding Impact and Likelihood Assessment of IS Risks, and Inherent and Residual Risk Assessments and Risk Ratings Calculation
You will learn the format and style of preparing Risk Register. You will learn how Inherent and Residual Risk Assessment Risk Scores are calculated
Risk Treatment Plans to Mitigate the Information Security Risks - Implementing Preventive, Detective and Corrective Controls
ISO 27001 - Risk Mitigation Strategy and Controls

Course content

8 sections • 31 lectures • 2h 44m total length

ISO 27001 ISMS Risk Assessment Process - Course Overview3:35
Who Should Join This Course0:38
Join information systems and security professionals, IT professionals, auditors, risk managers, consultants, internal controls specialists, risk assessors, security students, and anyone seeking ISO 27001:2013 information systems risk assessment.
What is ISO 27001 ISMS - Overview1:40

What is Information Security1:47
Data and Information are assets for the organization, especially critical data or information. To maintain the data or information integrity, they need to be protected from unauthorized access, cyberattackers, or other unauthorized users. In this lecture, students will learn the concepts of "Information Security" which ensures that critical information, systems, and resources are protected and not compromised.
Key Objectives of Information Security and Protection0:47
In this lecture, we shall discuss about the key objectives and purpose of protecting the information asset and resources.
Networks, Information and Data Availability3:02
Protects networks and data by ensuring availability and integrity across routers, switches, DNS, DHCP, proxies, and firewalls, while guarding environmental risks with backups and business continuity.
Information Asset Matrix5:46
Identify and classify information assets into critical and non-critical, and understand the information asset matrix guiding ISO 27001:2013 risk assessment, including financial data, contracts, and personal information.
CIA Triad5:23
Explain the CIA triad—confidentiality, integrity, and availability—and show how policies, access controls, and backups protect information assets for authorized users.

Understanding Risk, Activity or Event, and Adverse Impact or Outcome4:57
Define risk as the possibility that an activity or event causes an adverse outcome, and show how triggers like market downturns or new laws lead to losses and higher costs.
Understanding the Concept of Risk2:22
Different Categories of Risks Faced by Institutions and Organizations5:04
IS Security/ Cybersecurity risk is one of the types of Operational Risk, and Operational Risk is one of the categories of overall Enterprise Risks that organizations face and manage. Operational risk involves the "failure of systems and processes", therefore, cybersecurity/ information system risks are categorized as Operational Risks for the organizations, because they may cause loss of information systems or may cause compromise of a process.
In this lecture, we shall discuss the broader risks, including Operational Risk, which organizations face and manage. The purpose of this lecture is to have knowledge of other risks which organizations face.
Understanding Information Security Risks and Possible Adverse Impacts4:48
IS Security/ Cybersecurity risk is one of the types of Operational Risk, and Operational Risk is one of the categories of overall Enterprise Risks that organizations face and manage. Operational risk means the "failure of systems and processes", therefore, cybersecurity/ information system risks are categorized as Operational Risks for the organizations, because they may cause loss of information systems or may cause compromise of a process.
In this lecture we shall discuss the information security risks, which if occur, cause the loss of information or compromise of information system.
Understanding Cybersecurity Risk2:17
Identify cyber security risk as the risk of losing control over systems and critical resources. Prevent data losses, financial and regulatory penalties, ransom demands, and potential system failure.

Information Asset Protection IAP5:58
Information is an asset for organizations, and it must be managed and protected from possible unauthorized data or information access or possible cyberattacks. Organizations manage the risks of information or data loss, through the application of information security controls.
Data Governance and Controls to Protect Information, Systems, & Infrastructure7:48
We shall discuss the overview of the Data Governance and Controls to Protect Information, Systems, & Infrastructure.
Types of Controls as per ISO 270012:35
Learn how ISO 27001:2013 guides information security with preventive, detective, and corrective controls, where detection triggers prevention to reduce business impact and protect the CIA triad.

Introduction to Information Security Risk Assessment3:19
Purpose of Information Security Risk Assessment5:21
You will learn about the broader reasons, why organizations perform Information Security Risk Assessment.
Risk Identification and Assessment with Quantitative Calculation8:31
Risk Assessment - Assets Based Approach ABA - Risks Threats and Vulnerabilities7:12
Apply ISO 27001:2013 risk assessment practices to information assets using an asset-based approach (ABA) to identify risks, vulnerabilities, threats, and mitigate with physical access controls.
Overview of Threat, Vulnerability, Consequences and Mitigation Plan7:19
Explore threats, vulnerabilities, and consequences for customer data, including weak physical access controls, legal and reputational risks, and outline mitigation plans.

Risk Assessment - Understanding Very High, High, Medium Low, and Very Low Risks8:41
Explains a five-level risk assessment methodology and risk matrix, defining very high (very critical), high, medium, low, and very low risks with examples like cyber attacks and regulatory impacts.
'5 by 5' Risk Assessment Matrix - For Impact and Likelihood Calculations12:55
Explore the five by five risk assessment matrix, linking impact and likelihood to compute a risk score and assign color-coded levels from very low to very high.
When Risk Assessment Matrix is Used0:56
Application of Risk Assessment Matrix for Risk Rating Calculation9:12
Apply a five by five risk matrix to calculate inherent and residual risk scores by multiplying impact and likelihood, using cyber attack scenarios to illustrate high and very high risk.
Rigorous Risk Cases and Risk Assessment Analysis5:15
Outline rigorous risk cases and risk assessment analysis under ISO 27001:2013 across very high to very low categories, linking service disruption, financial loss, reputational and legal consequences, and media attention.
Preparing Risk Register after Risk Assessment - Example Cybersecurity Risk11:19

Risk Treatment Options3:16
Identify and apply risk treatment options after risk assessment: avoid by stopping the activity, mitigate with security controls, share via third-party insurance, or accept when mitigation costs exceed risk impact.
Implementing Controls - Preventive, Detective and Corrective Controls5:33
Explore detective, preventive, and corrective controls in a bank's information security program to protect customer data, detect threats, prevent attacks, and recover via offsite data backups and recovery sites.
Information System Defense Controls3:43
We shall discuss the Information System Access controls which are defined and implemented by an organization to protect unauthorized data access or data manipulation.
ISO 27001 - Risk Mitigation Strategy and Controls13:29

Requirements

Basic Knowledge of Risk Management Practices

Description

Do you know why is it critical for companies and institutions to manage "Critical Information" and associated "Information Security Risks"?
Do you know what happens when IS Security Risks incident occurs? What are the consequences and risks involved?
Do you know how companies and IS Consultants, practically perform IS risk assessment to manage and maintain Information Security Infrastructure?
What ISO/IEC 27001:2013 ISMS standard prescribes for IS Security Risk Assessment and Treatments?

All these questions will be answered through a practical course, where standards' requirements are linked with real-world examples, risk assessment models, and techniques.

ISO 27001 is the internationally recognized specification for Information Security Management System (ISMS) and is the most popular standard for Information Security. It serves as an IT Governance framework for organizations and businesses to enable the development and implementation of ISO 45001-prescribed controls to secure information assets.

COURSE OVERVIEW

In this course, you will get an insight into how companies and institutions perform Information Security IS Risk Assessment and manage or treat IS Risks, Threats, and Vulnerabilities. This course will give you conceptual and practical knowledge about IS Security Risk Assessment and Management as per ISO 27001.

COURSE TOPICS

Understanding ISO 27001 ISMS Risk Assessment

Understanding Information Security, Protection, and ISO 27001 Principles

Key Objectives of Information Security and Protection

Networks, Information, and Data Availability

Information Asset Matrix and CIA Triad

Understanding Risk, Activity or Event, and Adverse Impact or Outcome

Different Categories of Risks Faced by Institutions and Organizations

Understanding Information Security Risks and Possible Adverse Impacts

Understanding Cybersecurity Risk

Information Asset, Data Governance and ISO 27001 Protection Controls

Information Security IS Risk Assessment and Purpose of IS Risk Assessment

Risk Assessment with Quantitative Calculation

Risk Assessment - Assets Based Approach ABA - Risks Threats and Vulnerabilities

Overview of Threat, Vulnerability, Consequences and Mitigation Plan

Risk Assessment - Understanding High, Medium and Low Risk Levels

Risk Matrix /methodology - 5 by 5 Risk Assessment Matrix

Understanding When to Use a Risk Assessment Matrix

Application of Risk Assessment Matrix for Risk Rating Calculation

Rigorous Risk Cases and Risk Assessment Analysis

Example - Preparing Risk Register after Risk Assessment Calculations - Cybersecurity Risk as an Example

Risk Treatment Options

Implementing Controls - Preventive, Detective and Corrective Controls

Information System Defense Controls

ISO 27001 - Risk Mitigation Strategy and Controls

Multiple Choice Questions MCQs are also part of this course

You will be able to "prepare Asset Risk, Impact and Likelihood Matrix", "perform Risk Assessment using Methodology", "prepare Vulnerability and Threat Matrix", "perform Risk and Financial Impact Pyramid Analysis", "apply Treatment Options", "understand Controls Categories" etc. as per ISO 27001 - Information Security Management System.

To test your knowledge, the MCQs test is also part of this course

Other Benefits?

After attending this course you will be able to:

- apply concepts in your IS Security job

- communicate with IS Security and IS Audit professionals

- apply for jobs in organizations where ISO 27001 ISMS is implemented or to be implemented

- pursue a career progression in IS Security domain

- get the certificate of course completion etc.

Who is this course for:

Information System IS Security, IS Audit, IT Professionals and Students
IS Security Consultants
Risk Management Professionals and Students
Internal Audit Professionals and Students
Finance Professionals and Students
CISA, CISM students
Compliance professionals
Anyone who wants to learn the ISO 27001 standard's requirements for Information Security

Who this course is for:

Information Security IS Professionals
IS Security Auditors
IT Professionals
Internal Auditors
Risk Management Professionals
Information Security Risk Consultants
CIA, CISM, CISA Students
Finance students and others who want to learn IS Security and Risk Assessment Process

Information Security Risk Assessment Process ISO 27001:2013

What you'll learn

Explore related topics

Course content

Introduction3 lectures • 6min

Information Security, Protection, and ISO 27001 Principles5 lectures • 17min

Understanding Risk, Categories of Risks, Security Risk and Adverse Impacts5 lectures • 19min

Information Asset, Data Governance and ISO 27001 Protection Controls3 lectures • 16min

Risk Assessment Process5 lectures • 32min

Risk Assessment - Application of Risk Assessment Methodology, and Matrix6 lectures • 48min

Risk Treatments4 lectures • 26min

MCQs - Test your knowledge0

Requirements

Description

Who this course is for: