Information Security Risk Management

Overview

Still identifying risks, but unable to quantify or justify them to leadership? Listing threats isn’t enough. Senior roles require people who can judge impact, prioritize exposure, choose responses, and communicate risk in business terms. And that’s precisely what this course develops. This Information Security Risk Management course develops CISM-aligned risk analysis and decision-making skills. You will learn to: • Establish risk appetite, tolerance, as well as enterprise context • List assets, threats, vulnerabilities, & control gaps • Build structured risk registers and risk scenarios • Apply qualitative and quantitative methods (ALE, FAIR, PRA) • Use NIST and ISO 27005 risk assessment frameworks • Select responses and report risk effectively to stakeholders Unlike other courses, this CISM course combines enterprise frameworks with practical risk analysis techniques. In the end, you’ll confidently assess, rank, and communicate risk to support strategic decisions. Enroll now and become a risk-driven security leader.

Syllabus

Introduction to Risk Management

This module provides an overview of risk management, covering its key concepts, types of risks, and the risk management framework. You'll also learn about risk appetite, tolerance, and the phases of enterprise risk management.

Information Risk Identification & Assessment

This module focuses on identifying and assessing risks, including techniques for asset identification, threat analysis, and documenting risks in a risk register. You'll also learn about identifying vulnerabilities and control deficiencies.

Risk Analysis and Evaluation

This module covers both qualitative and quantitative risk analysis methods, including tools like ALE and FAIR. You'll also explore risk ranking, evaluation, and the risk assessment methodologies used in frameworks like NIST and ISO 27005.

Risk Response and Communication

This module teaches risk response options, workflows, and decision-making between risk acceptance and ignorance. You'll also learn how to communicate risks effectively to stakeholders and monitor ongoing risk management efforts.