Cyber Cultura course
ISO 27005: Cyber Risk Management
The information security risk process, from context to treatment.
Teaches how to implement the information security risk process according to ISO/IEC 27005, aligned with ISO 31000, and how to integrate third-party, cloud and privacy risks, with an introduction to quantification.
- Workload
- 5 hours
- Format
- Online or in-company
- Investment
- On request
We’ll reply with dates, format and investment.
Who it’s for
- Information security risk analysts and managers.
- ISMS owners who need to run the ISO/IEC 27001 risk process.
- GRC consultants and auditors.
What you’ll develop
- Define criteria, appetite and impact and likelihood scales.
- Identify, analyze and prioritize scenarios, qualitatively and semi-quantitatively.
- Select treatments (mitigate, accept, transfer and avoid) mapped to controls.
- Run the risk register, acceptances, exceptions and executive reporting.
- Integrate third-party, cloud and privacy risks, with an introduction to quantification.
Syllabus
5 hours
01Risk fundamentals and frameworks
- ISO/IEC 27005 and ISO 31000: principles, process and integration with the ISMS (ISO/IEC 27001)
- Terminology: threat, vulnerability, impact, likelihood, inherent and residual risk
- Connections with NIST CSF 2.0, CIS Controls v8, COBIT and COSO ERM
02Information security risk management
- The information security risk management process
- Information security risk management cycles
03Context establishment
- Organizational considerations
- Identifying the basic requirements of interested parties
- Applying risk assessment
- Establishing and maintaining risk criteria: general, risk acceptance criteria and criteria for performing risk assessments
- Choosing an appropriate method
04Risk assessment process
- General
- Risk identification: identifying and describing risks and risk owners
- Risk analysis: potential consequences, likelihood and determination of risk levels
- Risk evaluation: comparison against criteria and prioritization for treatment
05Risk treatment process
- General
- Selecting appropriate treatment options
- Determining all controls needed for the treatment options
- Comparing the determined controls with those in Annex A of ISO/IEC 27001:2022
- Producing the Statement of Applicability
- Treatment plan: formulation, approval by risk owners and acceptance of residual risks
06Operation
- Performing the risk assessment process
- Performing the risk treatment process
07Leveraging related ISMS processes
- Context of the organization
- Leadership and commitment
- Communication and consultation
- Documented information: about processes and about results
- Monitoring and review, including the factors that influence risks
- Management review
- Corrective action
- Continual improvement
08Simulated example and practical artifacts
What the course includes
- Simulated example
- Practical artifacts
For your team
This course is also offered in-company, on-site or remote, as a private class for your company.
Cyber Cultura course
ISO 27005: Cyber Risk Management
We’ll reply with dates, format and investment.
cyber@cyberconsulting.com.br