In this five-day intensive course, the participants develop the competence to master the basic risk management elements related to all assets of relevance for information security using the ISO/IEC 27005:2011 standard as a reference framework and MEHARI method. MEHARI method was developed by “Club de la Sécurité des Systèmes d’Information Français” (CLUSIF) in France. Based on practical exercises and case studies, participants acquire the necessary knowledge and skills needed to perform an optimal information security risk assessment and manage risks in time by being familiar with their life cycle. This training fits perfectly in the framework of an ISO/IEC 27001:2005 standard implementation process.

Concepts and definitions related to risk management

Risk management standards, frameworks and methodologies

Implementation of information security risk management program

Understanding an organization and its context

Risk identification

Risk analysis and risk evaluation

Risk assessment with a quantitative method

Risk treatment

Risk acceptance and residual risk management

Information Security Risk Communication and Consultation

Risk monitoring and review

Certified ISO/IEC 27005 Risk Manager Exam (2 hours)

MEHARI Presentation

Assessment and classification issues

Overview of the process

The value chain for failures

Classification of resources

Assessment of the vulnerabilities

Qualities of a security service

Measuring the quality of a security service

Evaluation process

Risk assessment

Security plans and procedures

Tools to support the implementation of MEHARI

“MEHARI advanced” exam (2 hours)

Risk managers -

Persons responsible for information security or conformity within an organization -

Members of information security team -

IT consultants -

Staff implementing or seeking to comply with ISO/IEC 27001 and involved in a risk -

management program based upon MEHARI method

To understand the concepts, approaches, methods and techniques allowing an- 

effective management of risk according to ISO/IEC 27005

To interpret the requirements of ISO/IEC 27001 on information security risk -

management

To develop the necessary skills to conduct a risk assessment with MEHARI method -

To master the steps to conduct a risk assessment with MEHARI method -

To understand the relationship between the information security risk management -

security controls and the compliance with the requirements of different stakeholders 

of an organization

To acquire the competence to implement, maintain and manage an ongoing -

information security risk management program according to ISO/IEC 27005

To acquire the competence to effectively advise organizations on the best -

practices in information security risk management