fr
en
Risk management and compliance: leading cybersecurity with ISO 27005 and EBIOS
Cybersecurity decisions become more relevant when based on explicit risk analysis. Structure scenarios, assess impacts and choose appropriate responses. Develop a method for explaining priorities and connecting protective measures to business needs.
- Duration
- 2 days 14 hours
- Code
- GRC001FR Code
Presentation
How can you safeguard your digital assets against increasingly unpredictable cyber threats? As digital transformation accelerates, a reactive approach to security is no longer enough. This course offers a structured methodology for turning uncertainty into a controlled strategy, drawing on ISO 27005:2022 international standards and the EBIOS method. You will learn to move beyond a purely technical perspective towards genuine risk governance integrated with business priorities.
Through this two-day course, you will explore the processes for identifying, assessing and treating vulnerabilities within an ISMS (Information Security Management System). Your learning will follow the ISO 27005 structure to establish a rigorous management framework, complemented by the flexibility of the EBIOS method for analysing threat scenarios. You will develop the expertise to prioritise security investments around your organisation's most critical assets.
In practice, you will be able to develop precise risk treatment plans aligned with ISO 27001 requirements. By the end of the course, you will master the tools needed to manage compliance and continuously improve your defensive posture. You will leave with a proven methodology for making risk management a source of trust for partners and customers.
Objectives
By the end of this course, you will be able to:
- understand the fundamental principles and terminology of cyber risk management;
- implement the requirements and operational process set out by ISO 27005;
- perform risk analysis following the key stages of the EBIOS methodology;
- structure a threat treatment approach consistent with the business context;
- align risk management practices with ISO 27001 compliance priorities.
Program
Module 1: mastering the foundations and ISO 27005:2022 framework
- The strategic importance and objectives of risk management.
- Mastering terminology and key semantic concepts.
- The relationship between risk management, ISO 27001:2022 and the ISMS.
Practical workshop
- Identify and prioritise critical assets within your organisation.
Module 2: managing the assessment process under ISO 27005
- Exploring the standard's scope, structure and principles.
- The risk management cycle: roles, responsibilities and stages.
- Analysing vulnerabilities and mapping potential threats.
- Estimating impacts and likelihood, and defining acceptance criteria.
Practical workshop
- Assess a specific risk scenario using a decision matrix.
Module 3: applying the EBIOS risk analysis method
- The guiding principles and 5 stages of the method.
- Analysing differences and complementarities with ISO 27005.
- Defining the business context and identifying feared events.
Practical workshop
- Conduct a complete risk analysis on a practical case using EBIOS.
Module 4: coordinating treatment and integration into compliance
- Building threat scenarios and selecting security measures.
- Formalising the treatment plan and aligning it with the ISMS.
- Process documentation, audit preparation and continuous improvement.
Practical workshop
- Simulate an internal audit of the risk management component of an ISMS.
Audience
This course is designed for digital security experts and decision-makers, including:
- chief information security officers (CISOs) seeking a more professional risk analysis approach;
- IT project managers and compliance managers required to justify security measures and manage regulatory audits;
- internal auditors and consultants assessing or supporting compliance within ISO 27001-certified organisations;
- anyone involved in defining or monitoring their organisation's risk management strategy.
Prerequisites
The following prerequisite applies:
- Technical skills: general knowledge of information security concepts (availability, integrity, confidentiality). Familiarity with ISO 27001 principles is strongly recommended to support understanding of management concepts.
Teaching and assessment methods
- Initial skills assessment
- Training materials provided to participants
- Continuous assessment throughout the course
- End-of-course feedback questionnaire
- Combination of theory and practical application
- Attendance records
- Post-course follow-up evaluation
- Quiz / multiple-choice questions
- Practical exercises
- Case study
Course highlights
- Dual methodological expertise: learn to combine the rigour of ISO 27005 with the pragmatic EBIOS approach.
- Immersive workshops: consolidate learning through practical exercises based on real scenarios and decision matrices.
- Strategic alignment: master the integration of your analyses into the broader ISO 27001 certification framework.
- Management toolkit: leave with a practical methodology for developing your own treatment plans and optimising security KPIs.
Dates and sessions
Choose the date and delivery format that suit you.
No upcoming sessions are currently available.