ISO/IEC 27005 Provisional Risk Manager: PECB certification validating information security risk management skills, obtained as part of my professional watch in cybersecurity.
View badge on CredlyTable of contents
Real-world use case
I am certified ISO/IEC 27005 Provisional Risk Manager after passing the Lead Risk Manager exam. This certification naturally complements my ISO/IEC 27001 certifications (Lead Implementer and Provisional Auditor): where those cover the implementation and audit of an ISMS, ISO/IEC 27005 details its methodological core, namely the assessment and treatment of information security risks.
This qualification gives me a structured framework to identify, analyze, evaluate and treat ISMS risks, in line with ISO/IEC 27001 requirements. What remains is to put this methodology into practice on concrete risk assessments, alongside the audits and support work already carried out.
The "ISO/IEC 27005 Provisional Risk Manager" certification, issued by PECB, proves that its holder has gained the knowledge needed to support an organization in implementing, maintaining and continually improving an information security risk management process based on ISO/IEC 27005.
The certification criteria are notably based on:
- Passing the PECB Certified ISO/IEC 27005 Lead Risk Manager exam (or equivalent)
- Abiding by PECB's certification rules and policies
- Adhering to PECB's Code of Ethics
The skills covered include in particular:
- Information security risk assessment
- Information security risk management
- Security risk concepts
- Security risk assessment and treatment techniques
PECB is a Personnel Certification Body, accredited to ISO/IEC 17024 by the IAS (International Accreditation Service), UKAS (United Kingdom Accreditation Service), and COFRAC (Comité français d'accréditation).
Conclusion
This ISO/IEC 27005 Provisional Risk Manager certification complements my ISO/IEC 27001 certifications by adding a dedicated methodology for information security risk management. The next step is to turn this theoretical foundation into concrete experience through risk assessments applied to real-world ISMS.