Aegentra
UK
United KingdomAustraliaNew Zealand

PECB / Lead Risk Manager

ISO/IEC 27005 Lead Risk Manager
Course & exam bundle.

Lead an information security risk management programme — the 5-day senior pathway, with OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA.

Compare learning formatsExplore the curriculum

Online · Self-paced · English

Verify PECB partner ID 232290

Course and exam, together

Choose your learning format.

Compare the course formats and their inclusions. Choose a bundle to pay securely on Stripe. Stripe asks for your email, which we use to assign your PECB course.

Self-Study course and exam bundle

Read and revisit the official slide-based materials at your own pace. No video lectures or live teaching.

What’s included
  • 12 months of myPECB course access
  • Official PECB course slides
  • Official PECB exam voucher: 2 attempts — initial exam + one free retake if needed
  • Certification application fee included
  • First-year certification maintenance fee included where applicable

Base price (excl. VAT)£650.00

Total to pay (incl. 20% UK VAT)£780.00

Per learner · GBP

Buy
Exam and purchase conditions

Complete the exam, included retake and application within 12 months of purchase. The first retake requires at least 15 days after an unsuccessful attempt. PECB reviews eligibility before awarding a credential; buying a bundle does not guarantee certification. An enquiry does not create an order. An order is confirmed after successful payment and acceptance.

Choose your payment currency in the top navigation. Prices shown are for UK personal purchases; other locations and business purchases need a written quote.

Your enrolment

ISO/IEC 27005 Lead Risk Manager

Total payable in GBP

—

Order details

Your selected course

    The badge identifies the course, not a credential already earned. One-off payment; no automatic renewal. Any valid promotion is applied on Stripe’s final payment screen.

    PECB access within 24 hours of confirmed payment.

    Purchase and billing details

    Base prices exclude VAT; the UK total adds 20% VAT. Outside the UK? Request a written quote confirming applicable tax and your total before payment. Payment currency does not determine tax.

    UK prices are fixed in GBP. Other currencies use a current exchange quote; your selected currency is charged at checkout.

    This does not remove remedies for faulty or misdescribed content, rights relating to examination services, or the 10-day Labs money-back guarantee.

    Examination services are separate from digital-content access. Accepting early digital access does not waive service cancellation rights. Any request to start an examination service during the cancellation period is handled separately.

    PECB courses have no additional voluntary cancellation refund. This does not remove statutory rights. Labs has the separate 10-day guarantee.

    You need your email account, an internet connection and compatible equipment; check the course and PECB examination requirements before paying.

    Prefer to start after the cancellation period? Arrange a later start with the Academy before payment.

    You can review and correct this order before continuing. Stripe handles card details; we do not receive your full card number. Checkout and purchase information are in English. Save the terms.

    Loading your course and total…

    Personal purchases only. Business or reverse-charge request? Contact us before paying.

    Is this your next step?

    Who this course
    suits best.

    • Managers or consultants responsible for information security in an organisation
    • Individuals responsible for managing information security risks
    • IT professionals and privacy officers
    • Project managers, consultants, and expert advisers seeking to master the management of information security risks

    Your learning format

    Independent study.
    Clear expectations.

    This course is listed as Self-Study only. Learn from the official course materials at your own pace; recorded presenter videos and live classes are not included.

    Which learning support is included?

    Self-Study is independent learning from the official materials. eLearning, where listed, adds recorded instruction; neither standard bundle promises live tuition or unlimited one-to-one support. For the listed ISO 27001 and ISO 42001 courses, the separately quoted consultancy option is explained above. PECB manages examination and certification decisions.

    Knowledge you can apply

    What you will
    work through.

    • Explain the risk management concepts and principles based on ISO/IEC 27005 and ISO 31000.
    • Establish, maintain, and continually improve an information security risk management framework.
    • Apply information security risk management processes.
    • Plan and establish risk communication and consultation activities.
    • Record, report, monitor, and review the information security risk management process and framework.

    Inside the course

    The curriculum.

    Modules describe the learning sequence. Day labels in the official curriculum do not mean scheduled live classes.

    Day 1 — Introduction to ISO/IEC 27005 and information security risk management
    • Structure of ISO/IEC 27005 and its relation to other risk frameworks
    • Fundamental concepts and principles of information security risk management
    • Confidentiality, integrity, availability, and the definition of risk
    • Threats, vulnerabilities, consequences, likelihood, and the role of the risk owner
    • Implementing an information security risk management programme
    Day 2 — Risk identification, analysis, evaluation, and treatment based on ISO/IEC 27005
    • Risk identification approaches and information gathering techniques
    • Primary and supporting assets, asset valuation, and existing controls
    • Risk analysis techniques, consequence and likelihood assessment
    • Inherent, residual, and target risk; evaluation against risk criteria
    • Treatment options — modification, retention, avoidance, and sharing
    • Risk treatment plans and residual risk acceptance
    Day 3 — Risk communication and consultation, recording and reporting, monitoring and review
    • Establishing a risk communication plan
    • Internal and external communication with decision-makers and stakeholders
    • Documenting the risk management process and maintaining records
    • Monitoring and reviewing programme effectiveness
    • Management review, corrective actions, and continual improvement
    Day 4 — Risk assessment methods
    • OCTAVE method, OCTAVE-S, OCTAVE-Allegro, and OCTAVE FORTE
    • MEHARI — three main phases for risk management
    • EBIOS — five workshops and modules
    • NIST publications and the seven steps of the NIST risk management framework
    • CRAMM risk analysis and management methodology
    • Harmonized Threat and Risk Assessment (TRA) — five phases
    Day 5 — Certification exam
    • PECB Certified ISO/IEC 27005 Lead Risk Manager exam
    • 80 multiple-choice questions across the six competency domains
    • Open-book: the standard, course materials, and personal notes permitted

    The exam and credential

    Know what
    you are preparing for.

    Credential eligibility and the certification decision are assessed by PECB. Training does not certify your organisation.

    Format
    Open-book multiple choice — stand-alone and scenario-based questions, three options each
    Duration
    3 hours
    Questions
    80 multiple-choice questions across 6 competency domains — fundamental principles and concepts of information security risk management (13 questions), implementation of an information security risk management program (7), information security risk assessment (20, the largest domain at 25% of the paper), risk treatment (15), risk communication, monitoring and improvement (10), and risk assessment methodologies (15)
    Pass mark
    70%

    After passing, apply to PECB for the credential supported by your experience. The Lead tier requires five years of professional experience, including two in information security management, and 300 hours of related risk-management activity. The Senior Lead tier requires ten years, including seven in that field, and 1,000 hours. A Provisional pathway is available without those experience thresholds. PECB assesses the application and requires its Code of Ethics. Provisional credentials are maintenance-exempt; current three-year CPD requirements are 90 hours for Lead Risk Manager and 180 hours for Senior Lead Risk Manager, plus applicable maintenance fees.

    Before you enrol: prerequisites
    • A fundamental understanding of ISO/IEC 27005 and comprehensive knowledge of risk assessment and information security.
    • Prior ISO 27001 experience is strongly recommended — the framework is designed to sit inside an ISMS.

    From knowledge to a working decision

    A critical account could be misused

    Identify the information assets and business consequences, explain assessment assumptions and compare treatment options without claiming a score eliminates uncertainty.

    For an implementation or practitioner route, record a decision, owner, evidence requirement and review trigger. Explain your assumptions and what remains outside the exercise.

    Original optional study prompt, not an official PECB exam question, an additional included lab or evidence of professional experience. Use fictional information.

    Check the official PECB course catalogue

    Make time for the learning

    Your course.
    Your study plan.

    Turn the curriculum into a study plan: record your target dates, explain each topic in your own words and keep a list of questions to revisit. The downloadable sheet is pre-filled for this course and includes space for your notes. It is an optional Aegentra planning aid, not official PECB materials, an exam-question bank or evidence of professional experience. Use fictional examples, not confidential workplace information.

    Download your study planner (CSV)

    ISO/IEC 27005 Lead Risk Manager · Editable spreadsheet · No sign-up required

    Before you book the exam.

    Check your exact exam

    Confirm the course, exam language, duration and permitted materials against PECB’s current exam listing and rules. Similar titles from different training providers can lead to different qualifications.

    PECB exam listing
    Prepare your exam environment

    Before booking, check the latest online-exam manual for identification, equipment, connectivity and room requirements. Ask PECB about reasonable accommodations early if you need them.

    PECB online-exam manual
    Plan the credential application

    Passing the exam and being awarded a particular credential are separate steps. Check the applicable experience, references and application requirements; do not assume a Lead title is awarded automatically.

    PECB certification requirements

    For permitted materials, exam conduct and accommodation requests, read PECB’s exam rules. Requirements can change; check the current rules for your exact exam.

    Your questions

    Before you choose.

    Is the official PECB exam included?

    Yes. Each listed bundle includes the official examination voucher: an initial attempt and one free retake if needed. Complete the exam, included retake and application within 12 months of purchase. The first retake requires at least 15 days after an unsuccessful attempt. PECB reviews eligibility before awarding a credential; buying a bundle does not guarantee certification.

    What is the difference between Self-Study and eLearning?

    Self-Study provides official slides for independent study. eLearning adds recorded PECB video lectures. Only the formats shown above are offered for this course.

    Does this include a certification fee?

    The bundle includes the application fee and first-year maintenance where applicable. Foundation certificates have no annual maintenance fee. Credential eligibility and ongoing requirements vary; PECB makes the award decision.

    Can I purchase online?

    Choose your course and learning format, review the total in your selected currency and pay securely through Stripe. PECB access is arranged within 24 hours after payment confirmation. Optional Labs access is activated for the matching course after confirmation.

    How does this PECB bundle compare with other UK training offers?

    Compare the exact awarding body and credential, curriculum, delivery format, exam inclusion, retake conditions, access period and eligibility. Similar course titles do not establish equivalence to another provider or scheme. These are PECB bundles; no CQI and IRCA, IAPP, EC-Council or Linux Foundation credential is implied.

    Does 12-month access mean 12 months of teaching?

    No. It is the material-access period, not a scheduled course duration or a promise of unlimited instructor support. The listed bundles are self-paced. Curriculum day labels describe a learning sequence; they are not booked live classroom dates.

    Which standard edition or syllabus should I check?

    Confirm the exact course edition and current PECB syllabus before enrolment, especially where a standard is being revised. Publication of a newer standard does not automatically update a training bundle or include a transition course. Confirm the course edition with the Academy before payment.

    Choose the right course for your role.

    Tell us what you need to achieve, what is in scope and where you are starting.

    Talk about your project