Information Security Risk Management (ISO/IEC 27005) Fundamentals Training
A one-day fundamentals programme on ISO/IEC 27005. Learn how to assess information security threats and decide which risks need treatment using ISO/IEC 27005. Participants work through practical examples and a guided case before drafting actions for their own organisation.
Who should attend: IT, security, risk, compliance staff and information asset owners. No prior framework knowledge is required.
HRD Corp claim support available
Programme Agenda
9:00 AM to 10:00 AM
Risk Management in an ISMS
Introduce ISO/IEC 27005:2022 as guidance supporting information security risk management. Distinguish its role from ISO 27001 requirements and from a technical vulnerability scan.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Context, Assets and Criteria
Set the assessment scope and identify information, services, owners and dependencies. Agree impact, likelihood and acceptance criteria before ranking risks.
11:30 AM to 12:30 PM
Risk Identification and Analysis
Connect threats, vulnerabilities, existing controls and consequences. Write clear scenarios involving an exposed account, supplier access and a failed backup, noting uncertainty and evidence gaps.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Evaluation and Treatment
Compare risks against criteria, prioritise treatment and choose controls. Explain residual risk, treatment owners and acceptance authority; connect decisions to the Statement of Applicability where relevant.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Communication, Monitoring and Review
Maintain assessment and treatment records. Define triggers for reassessment after changes, incidents and new information, and explain results in language a business owner can use.
4:00 PM to 5:00 PM
Practical Exercise: A Business Application Assessment
Assess a fictional customer portal, compare two treatment options and record residual risk. Produce a starter register and three actions with owners and review dates.
Key Outcomes
- Distinguish security risk assessment from scanning
- Write risk scenarios and apply criteria
- Select treatment and document residual risk
- Maintain an assessment and review record
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior framework knowledge required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
High relevance for Malaysian IT and security teams supporting an ISMS or a practical security improvement programme. Assessment examples use email, business applications and supplier access.
Practical Takeaways
An information security risk register and treatment decision worksheet.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
Participants receive an Orbix Certificate of Completion upon full attendance. This introductory course does not confer professional certification or establish an organisation's compliance. Further implementation and assessment depend on the organisation's scope and obligations.
Frequently Asked Questions
Related Fundamentals Training
Cybersecurity Risk Management (NIST CSF 2.0) Fundamentals AI Security Verification (OWASP AISVS) Fundamentals AI Agent Security (OWASP Agentic Top 10) Fundamentals Generative AI Security (OWASP LLM Top 10) Fundamentals View all fundamentals programmes
Reference material: ISO: ISO/IEC 27005:2022.