ISO/IEC 27005: Information Security Risk Management

Name: ISO/IEC 27005: Information Security Risk Management
Rating: 4.5 (2347 reviews)

Master risk assessment and risk treatment for your ISMS — identify, analyse and evaluate risks with ISO/IEC 27005

Highest Rated

Created byCristian Vlad Lupa, rigcert.education

Last updated 5/2026

English

Arabic [Auto],German [Auto],

What you'll learn

What is an ISMS (Information Security Management System)
How to determine the risk appetite of an organization
What is risk acceptance criteria and how it can be established
The different approaches for information security risk identification
The relationship between threats and vulnerabilities
How to estimate likelihood and consequences for a risk
How to calculate a risk level
Why risks should be owned and who can be a risk owner
The options for treating information security risks
Key documents for an ISMS such as SoA and risk treatment plan

Course content

5 sections • 26 lectures • 2h 26m total length

Introduction4:04
Welcome to this online course on information security risk management according to the provisions of ISO/IEC 27005:2022
Information security management5:58
About the three attributes of information security (confidentiality, integrity and availability). About what represents an ISMS (Information Security Management System)
The ISO/IEC 27000 series of standards7:30
About the standards in the ISO/IEC 27000 series.
About ISO/IEC 270054:48
About the purpose of ISO/IEC 27005. About the structure of this standard and its revision history.
Information security risk management5:34
About the definition of risk. About what represents risk management. About the steps of the risk management process.

Context establishment5:56
About the identification of stakeholders for the risk management process. About the risk appetite of an organization
Risk acceptance criteria7:04
About the process to establish risk acceptance criteria
Criteria for performing information security risk assessments4:50
About likelihood and consequence as constitutive elements of risk. About establishing a risk level
Qualitative vs. quantitative approaches part 14:19
The differences between using a qualitative and a quantitative approach to defining potential consequences and examples to illustrate
Qualitative vs. quantitative approach part 25:20
About the differences between establishing likelihood and calculating a level of risk using a qualitative and a quantitative approach

Generic requirements for the information security risk assessment2:59
Details on the requirements for the risk assessment to produce consistent, valid and comparable results
The event-based approach to risk identification4:30
About the method to identify information security risks starting from event scenarios and considering potential attackers, their motivation and ability to act
The asset-based approach to risk identification5:12
About the approach to identify information security risks starting from assets and considering the threats and vulnerabilities that may affect them
Identifying risk owners3:47
About who can be a risk owner. About the requirements for risk owners and why it's important to appoint risk owners
Analyzing information security risks8:14
About combining consequences and likelihood to calculate a level of risk. About deliberate and accidental risk sources and what is the difference between them. About the basic sources of assessment uncertainty
Evaluating information security risks5:41
About comparing the calculated level of risk with the risk acceptance criteria to determine those risks that require treatment

Risk treatment options7:47
About the most common options available to an organization to treat its information security risks: avoidance, modification, sharing and retention
Determining the necessary controls5:32
About the security controls from ISO/IEC 27001 with examples and details about their classification
Preventive, detective and corrective controls3:54
About the classification of controls considering their purpose and when they are to be applied
The Statement of Applicability (SoA)5:58
About the requirements of ISO/IEC 27001:2022 regarding the Statement of Applicability
The risk treatment plan6:16
About the risk treatment plan required by ISO/IEC 27001:2022 as part of an ISMS

More considerations about the information security risk management process8:05
About integrating risk management into the organization's operations. About communication and consultation in relation to information security risk management. About evaluating the information security performance of an organization
Continual improvement6:08
Suggestions for improving continually the information security risk management process
Certification for information security management4:30
About the certification of organizations and persons in the context of information security risk management
Thank you and good bye!5:04
Thank you for taking this course!
Bonus lecture - My other courses on information security management7:28

Requirements

Familiarity with the ISO standards on information security management is useful but not mandatory

Description

ISO/IEC 27005 is the international standard for information security risk management — the detailed guidance for the risk assessment and risk treatment process at the core of every ISO/IEC 27001 information security management system (ISMS). Where ISO/IEC 27001 requires organizations to assess and treat information security risks, ISO/IEC 27005 explains how.

This course walks you through that framework step by step, applicable to any organization regardless of size or sector.

Course structure

Foundations — information security management, the ISO/IEC 27000 series of standards, and an introduction to ISO/IEC 27005
Context establishment — defining the organization's risk appetite, setting risk acceptance criteria, and the difference between qualitative and quantitative approaches to defining consequences and likelihood
Risk assessment — the complete process: risk identification using the two approaches of ISO/IEC 27005 (the event-based approach and the asset-based approach), risk analysis, risk evaluation, and the role of risk owners
Risk treatment — the risk treatment options for information security risks, the controls of ISO/IEC 27001:2022, and the key ISMS documents that capture the results: the Statement of Applicability (SoA) and the risk treatment plan
Improvement and certification — continual improvement of the risk management process, plus the certification paths for organizations and individuals

What you will be able to do

By the end of the course you will understand the full information security risk management process — threat and vulnerability analysis, calculating risk levels, selecting risk treatment options — and you will be able to run a risk assessment, document its results in the SoA and risk treatment plan, and support a risk management program that protects the confidentiality, integrity and availability of your organization's information.

Who this course is for

ISMS implementers and information security officers responsible for the risk assessment of ISO/IEC 27001
Risk managers and GRC professionals specializing in information security and cyber risk
IT and cybersecurity professionals moving into risk-based roles
Auditors and consultants who evaluate risk assessments and risk treatment plans
Anyone preparing an organization for ISO/IEC 27001 certification — the risk assessment is where every ISMS begins

Enhance your expertise in information security risk management with the standard that defines how it's done.

Who this course is for:

Information security officers
Information security risk managers and analysts
ISO enthusiasts
Information security auditors and consultants

ISO/IEC 27005: Information Security Risk Management

What you'll learn

Explore related topics

Course content

Introductive section5 lectures • 28min

Context establishment5 lectures • 27min

Information security risk assessment6 lectures • 30min

Information security risk treatment5 lectures • 29min

Considerations about the information security risk management process5 lectures • 31min

Requirements

Description

Who this course is for: