ISO/IEC 27005 Information security, cybersecurity and privacy protection Certified Foundation

ISO/IEC 27005 Information security, cybersecurity and privacy protection Certified Foundation

The ISO/IEC 27005 Foundation certification validates a professional's foundational understanding of the information security risk management framework, methodologies, and concepts aligned with the ISO/IEC 27000 family of standards.

Domain 1: Fundamental Principles and Concepts of Information Security Risk Management

• Core terminology: assets, threats, vulnerabilities, impact, likelihood, risk appetite, and risk tolerance.
• Alignment and interoperability between ISO/IEC 27005, ISO 31000(general risk governance), and ISO/IEC 27001(ISMS risk requirements, particularly Clause 6.1.2).
• Objectives, scope, and strategic importance of managing information security, cybersecurity, and privacy risks.

Domain 2: Context Establishment

• Defining the internal and external context, boundaries, and scope of the risk management process.
• Establishing basic criteria: risk evaluation criteria, impact criteria, and risk acceptance criteria.
• Identifying legal, statutory, regulatory, and contractual obligations alongside stakeholder requirements.

Domain 3: Information Security Risk Assessment

• Risk Identification: Cataloging primary assets (information, business processes) and supporting assets (hardware, software, personnel, facilities), mapped against threat sources and vulnerabilities.
• Risk Analysis: Applying qualitative, semi-quantitative, or quantitative methods to assess likelihood and the severity of consequences.
• Risk Evaluation: Comparing estimated risk levels against pre-established acceptance criteria to prioritize risk treatment.

Domain 4: Information Security Risk Treatment

• Core treatment options: risk modification (mitigation), risk retention (acceptance), risk avoidance, and risk sharing (transfer).
• Selecting and justifying security controls (mapping directly to ISO/IEC 27001 Annex A controls).
• Assessing and formulating the management plan for residual risk.

Domain 5: Continuous Risk Activities (Monitoring, Communication, and Recording)

• Communication and Consultation: Facilitating ongoing dialogue with internal and external stakeholders throughout the risk lifecycle.
• Monitoring and Review: Tracking risk factors, emerging threats, control performance, and organizational changes.
• Recording and Reporting: Developing risk registers, risk profiles, and executive reporting mechanisms to maintain full traceability.