ISO/IEC 27005 Security Risk Manager + EBIOS: Assessing and Treating Information Security Risks

Round-table introductions:

• Individual participant introductions.
• Exploring each participant’s expectations and objectives.
• Introduction to the training framework.
• Alignment with the specific objectives and challenges of ISO 27005 training.
• Identifying participants’ individual expectations and perspectives.

Part 1: introduction to risk management and ISO 27005

• Understanding and defining risk:
  • fundamental definitions of risk and the distinction between risk, threat and vulnerability.
• Understanding ISO/IEC 27005:2022:
  • exploring the specific features of the latest version of the standard and its role in information security risk management.
• Identifying sensitive business processes:
  • techniques for identifying strategic processes and their associated information systems, using SWOT analysis to align risk treatment decisions with business strategy.
• Establishing a risk management program: steps to develop an ISO 27005-aligned risk management program, including responsibilities and the decision-making process.

Part 2: implementing a risk management process in accordance with ISO 27005

• Defining the scope:
  • methods for synthesising information from collaborative working groups and documentation to clearly define the risk analysis scope.
• Developing and prioritising risk scenarios:
  • creating failure or attack scenarios based on criticality, working with experts to assess their likelihood and impact.
• Analysing and evaluating risks:
  • qualitative and quantitative risk analysis techniques.
• Developing risk treatment plans: creating risk management plans that integrate scenario analysis to propose solutions aligned with the company’s strategic objectives.

Part 3: monitoring and risk management culture

• Implementing the treatment plan:
  • strategies for effective implementation of risk treatment plans, including monitoring indicators and lessons learned to assess the effectiveness of actions over time.
• Fostering a risk management culture:
  • techniques to encourage information security incident reporting and analysis, strengthening the organisation’s risk management culture.

Part 4: risk analysis using EBIOS

• Introduction.
• Introducing the concept of risk.
• The 5 stages of the EBIOS method.
• Practical application in small groups of 2 to 3 people using a predefined case:
• Essential elements.

Part 5: applying the EBIOS method

• Using the method’s results to inform:
  • the SoA (Statement of Applicability).
  • the security policy (ISO 27001 requirements).
  • the security action plan (ISMS).
• Conducting a risk analysis.
• Expressing needs.
• Vulnerabilities.

Part 6: concluding an EBIOS risk analysis

• Practical application in small groups of 2 to 3 people using a predefined case;
• Risk analysis.
• Security objectives.
• Risk coverage.

Part 7: other methodologies and certification preparation

• Introducing risk assessment methods: exploring OCTAVE, MEHARI and EMR and discussing their integration into the company’s risk management strategy.
• Preparing for the ISO 27005 Security Risk Manager certification examination:
  • reviewing key concepts, examination practice and strategies for certification success.