PECB CERTIFIED ISO/IEC 27005 WITH MEHARI
MASTER THE ASSESSMENT AND OPTIMUM MANAGEMENT OF INFORMATION SECURITY RISK, IN COMPLIANCE WITH ISO/IEC 27005, USING THE MEHARI METHOD
The target audience for training
- Risk managers
- Those responsible for information security or compliance within an organisation
- Members of an information security team
- IT consultants
- Staff responsible for implementing or wishing to comply with the ISO/IEC 27001 standard or involved in a risk management programme that complies with the MEHARI method.
What you will learn
During this intensive five-day course, participants will develop the skills to master the fundamentals of risk management for all relevant information security assets, using the ISO/IEC 27005:2011 standard as a reference framework and the MEHARI method. The MEHARI method was developed by the "Club de la Sécurité des Systèmes d'Information Français" (CLUSIF) in France. Through practical exercises and case studies, participants will acquire the knowledge and skills needed to carry out an optimal information security risk assessment and to manage risks in a timely manner, by familiarising themselves with their lifecycle.
This training is perfectly aligned with the process of implementing the ISO/IEC 27001:2005 framework.
Training programme
- Duration: 5 days
Day 1: Introduction, ISO/IEC 27005 risk management programme
- Risk management concepts and definitions
- Risk management standards, frameworks and methodologies
- Implementation of an information security risk management programme
- Understanding the organisation and its context
Day 2: Risk identification, assessment, evaluation, treatment, acceptance, communication and monitoring according to ISO/IEC 27005
- Risk identification
- Risk analysis and assessment
- Quantitative risk assessment Risk treatment
- Risk acceptance and residual risk management
- Information security risk communication and consultation
- Risk monitoring and review
Day 3: Reviewing and triggering risk assessment with MEHARI
- Certified ISO/IEC 27005 Risk Manager exam (2 hours)
- Presentation of the MEHARI method
- Assessing and classifying problems
- Process overview
- The value chain for failures
- Classification of resources
Day 4: Assessment of vulnerability and risk, according to MEHARI
- Vulnerability assessment
- Qualities of the security service
- Measuring the quality of a safety service
- Assessment process
- Risk assessment
Day 5: MEHARI safety planning and review
- Safety plan and procedures
- Tools to support the implementation of the MEHARI method
- MEHARI advanced" exam (2 hours)
Training exam
Training objectives
- Understand the concepts, approaches, methods and techniques for effective risk management in accordance with ISO/IEC 27005
- Interpreting the requirements of ISO/IEC 27001 for information security management
- Acquire the skills needed to carry out a risk assessment using the MEHARI method
- Mastering the steps involved in conducting a risk assessment using the MEHARI method
- Understand the relationship between information security risk management, security measures and compliance with other requirements of different stakeholders in an organisation
- Acquire the skills needed to implement, maintain and manage an information security risk management programme in accordance with the ISO/IEC 27005 standard
- Acquire the skills to advise organisations effectively on best practice in information security risk management
Training prerequisites
- Knowledge of the fundamental principles of cybersecurity.
- Understanding the basic concepts of information systems.
- Professional experience in the field of information security is a plus, although not compulsory.
- Familiarity with ISO/IEC 27001 and ISO/IEC 27005 is useful, but not essential.
Examination guide
Download the exam guide
- Level : Fundamental
- Certification body : 0
- Certification: Yes
- Accessibility : Yes
- Duration: 5 days
Important information:
Our courses are not registered with the Répertoire National des Certifications Professionnelles (RNCP), but they do comply with the requirements of the Répertoire Spécifique (RS).