Description

ISO/IEC 27005 with MEHARI – Mastering the Evaluation and Optimal Management of Risk in Information Security based on ISO/IEC 27005 with MEHARI method.

In this five-day intensive course, the participants develop the competence to master the basic risk management elements related to all assets of relevance for information security using the ISO/IEC 27005:2011 standard as a reference framework and MEHARI method. The MEHARI method was developed by “Club de la Sécurité des Systèmes d’Information Français” (CLUSIF) in France. Based on practical exercises and case studies, participants acquire the necessary knowledge and skills needed to perform an optimal information security risk assessment and manage risks in time by being familiar with their life cycle.

This training fits perfectly in the framework of an ISO/IEC 27001:2005 standard implementation process.

Course agenda
Day 1: Introduction, risk management program according to ISO/IEC 27005

• Concepts and definitions related to risk management
• Risk management standards, frameworks and methodologies
• Implementation of an information security risk management program
• Understanding an organization and its context

Day 2: Risk identification and assessment, risk evaluation, treatment, acceptance, communication and surveillance according to ISO/IEC 27005

• Risk identification
• Risk analysis and risk evaluation
• Risk assessment with a quantitative method
• Risk treatment
• Risk acceptance and residual risk management
• Information Security Risk Communication and Consultation
• Risk monitoring and review

Day 3: Exam and start of a risk assessment with MEHARI

Certified ISO/IEC 27005 Risk Manager Exam (2 hours)
Presentation of MEHARI
Assessment and classification issues
Overview of the process
The value chain for failures
Classification of resources

Day 4: Assessment of vulnerabilities and risk, according to MEHARI

Assessment of the vulnerabilities
Qualities of a security service
Measuring the quality of a security service
Evaluation process
Risk assessment

Day 5: Security planning according to MEHARI and Exam

Security plans and procedures
Tools to support the implementation of MEHARI
The “MEHARI advanced” exam (3 hours)

See all our courses