Information security risk management based on ISO/IEC 27005 — plus OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA. Published Self-Study or eLearning enrolment starts from $714 + GST and includes the official exam access stated on this page. Training is delivered online. Available formats and booking arrangements are listed on this course page.
Available Australia-wide, in New Zealand and across Asia Pacific — and, because self-study and eLearning are delivered online through the myPECB platform, from anywhere in the world. Academy training is online only. Where a course offers live online teaching, dates and booking arrangements are confirmed before booking. Base prices are published in AUD, and course pages quote other supported currencies when a live quote is available; to pay in New Zealand dollars or pounds sterling, buy through aegentra.co.nz or aegentra.co.uk instead. An Australian billing address adds 10% GST; a non-Australian billing address has no Australian GST.
The PECB ISO/IEC 27005 Risk Manager Self-Study course costs A$714 excluding GST through Aegentra Academy, an official PECB authorised training partner in Australia. That price includes the official PECB examination voucher, the full course materials, 12 months of myPECB access, and one free exam resit within 12 months. Typical total learning effort is 21–30 hours. The eLearning format is A$880 excluding GST, with 21–30 hours of typical total learning effort. For non-Australian billing addresses, Australian GST is not charged and any applicable local taxes are determined at checkout.
Academy training is online only. Check the available formats and booking arrangements on this page. Any published live online option is arranged by enquiry; Self-Study and eLearning are available without waiting for a cohort.
This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply.
Complete the exam, included retake and application within 12 months of purchase. The first retake requires at least 15 days after an unsuccessful attempt. PECB reviews eligibility before awarding a credential; buying a bundle does not guarantee certification. PECB exam and fee conditions.
An Australian billing address adds 10% GST at checkout. For non-Australian billing addresses, Australian GST is not charged; any applicable local taxes are determined at checkout.
Ask Aegentra Academy about the online formats currently available for this course and their booking arrangements. An enquiry does not confirm live-class availability.
Contact us for online classAsk about prerequisites, delivery, employer invoicing, or which course fits your goal.
We normally reply within one Australian business day.
Learn · Implement
Official PECB training is included. The practical ISO/IEC 27005 resources are free to use after the course, with no email required.
Learn
Included with courseThis is what the A$714 + GST Self-Study price covers, or A$880 + GST with PECB eLearning.
Choose your courseImplement
Free · No email requiredGo beyond passing the exam. Practical resources built around the work itself — the documents you will actually have to produce.
Explore free ISO 27005 resourcesThe ISO 27005 Risk Manager course is $714 + GST self-paced, or $880 + GST with guided eLearning. There is no separate ISO 27005 exam cost — the official PECB examination voucher is included, along with one free retake within 12 months and 12 months of myPECB access. Aegentra Academy is an official PECB authorised training partner, and prices are quoted in Australian dollars ex-GST.
| Course | Course focus | Exam | Self-Study | eLearning |
|---|---|---|---|---|
| Risk Manager | Run information security risk assessments — assets, threats, vulnerabilities, likelihood, consequence, treatment | 60 questions, 2 hours, open book | $714 + GST | $880 + GST |
| Lead Risk Manager | Lead the risk management programme — criteria, methodologies, communication, monitoring and board reporting | 80 questions, 3 hours, open book | $989 + GST | — |
This is the question most people arrive with, and the answer is simpler than the internet makes it. ISO/IEC 27001 is the certifiable management system. ISO/IEC 27005 is the risk methodology you run inside it. They are not alternatives and you do not choose between them.
ISO 27001 Clause 6.1.2 requires you to define and apply an information security risk assessment process — but it deliberately does not say which one. ISO/IEC 27005:2022 is the guidance that fills that gap: how to identify assets, threats and vulnerabilities, how to analyse likelihood and consequence, how to evaluate against criteria you set in advance, and how to choose between modifying, retaining, avoiding or sharing a risk.
ISO 27005 is not certifiable for an organisation. There is no Stage 1 / Stage 2 audit and no certificate saying a company is “ISO 27005 certified” — it is guidance, not an auditable management system. Individuals are certified, through PECB. Where it does get audited is inside an ISO 27001 assessment: your risk method is evidence for Clause 6.1.2, and an auditor will test whether you actually followed it.
The third standard people ask about is ISO 31000, which is generic enterprise risk management. Most Australian organisations use ISO 31000 as the umbrella framework, ISO 27005 for information security risk specifically, and hold ISO 27001 as the certificate. See the ISO 27005 certification guide for Australia for the full comparison.
60 multiple-choice questions across 4 competency domains, open book, 2 hours, 70% to pass. PECB publishes the per-domain weighting in its certification scheme, which is worth knowing before you study:
More than half the paper sits in one domain. If you are short on study time, the framework and process is where it should go.
A caution on sources: PECB’s older candidate handbooks for this standard still describe ISO/IEC 27005:2008 and a 12-question essay exam. That is two editions out of date. The figures above come from the current ISO/IEC 27005:2022 certification scheme. If a provider quotes you an essay exam for ISO 27005, they are republishing the old handbook.
After passing, apply to PECB for Provisional Risk Manager (no professional or project experience threshold) or Risk Manager (two years of professional experience, including one in information-security risk management, and 200 hours of related activity). The current course page and candidate handbook do not offer a Senior tier from this examination. PECB validates the application and requires its Code of Ethics. Provisional credentials are maintenance-exempt; Risk Manager has the applicable maintenance fees and 60 CPD hours per three-year cycle.
APRA CPS 234 requires regulated entities to classify information assets by criticality and sensitivity and to size controls to the threat — which is an information security risk assessment by another name. The ASD Essential Eight maturity model assumes you know which systems matter most, and that judgement comes from a risk assessment rather than from the model itself.
Neither names ISO 27005. Both assume what it produces: a documented, repeatable method for deciding which information security risks matter and what to do about them. That is why Australian GRC and information security auditor roles ask for risk credentials alongside ISO 27001.
The two documents this method actually produces, published in full and free — no email required.
The official PECB course and exam package starts at A$714 + GST — with no separate exam fee after enrolment. Optional Aegentra Labs exam preparation is clearly priced separately.
The exam voucher is included in your enrolment, and so is one free resit if you don’t pass first time. Both the exam and the credential are issued directly by PECB.
After passing, apply to PECB for Provisional Risk Manager (no professional or project experience threshold) or Risk Manager (two years of professional experience, including one in information-security risk management, and 200 hours of related activity). The current course page and candidate handbook do not offer a Senior tier from this examination. PECB validates the application and requires its Code of Ethics. Provisional credentials are maintenance-exempt; Risk Manager has the applicable maintenance fees and 60 CPD hours per three-year cycle.
An exam pass is the first step. You must submit PECB's certification application and required declarations and references. PECB decides whether the requirements for the requested credential tier are met.
/ Before you enrol
These answers use this course's current catalogue record and PECB's published exam, certification, and maintenance policies.
The published price is A$714 for Self-Study or A$880 for eLearning, before tax. It includes the official PECB course materials, the first exam attempt, one free retake, and the certification application fee. This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. PECB’s partner-course policy also includes the first year of the Annual Maintenance Fee where maintenance applies; Foundation and Provisional credentials are maintenance-exempt. There is no separate first-exam or certification-application charge after enrolment.
PECB’s maintenance policy exempts Foundation, Provisional and Transition credentials. Other credentials have tier-specific CPD requirements and maintenance fees. Confirm the applicable amount and currency directly with PECB before renewal; its public fee table uses an unqualified dollar symbol, which must not be read as an Australian-dollar quote. Course-completion CPD credits and ongoing credential maintenance are separate requirements.
Every course supports AUD, USD, SGD, INR, EUR, AED, MYR, PHP, IDR and VND when a live quote is available. Paying in New Zealand dollars? Buy through our New Zealand site at aegentra.co.nz instead. Paying in pounds sterling? Buy through our United Kingdom site at aegentra.co.uk instead. Currency and tax are separate: an Australian billing address adds 10% GST, a United Kingdom billing address adds 20% UK VAT, and any other billing address has no tax added.
Self-Study costs A$714 before tax and uses the official PECB slide-based materials. eLearning costs A$880 before tax — A$166 more — and adds recorded trainer-led lessons and interactive learning activities. Both routes lead to the same PECB exam and credential, and both include the same exam package. Choose eLearning if explanations and video guidance help you learn; choose Self-Study if you are comfortable working through standards-based material independently.
Yes. PECB publishes remote online exam sessions that candidates can take from home or another suitable location through the PECB Exams application. The published course record lists these exam facts: duration — 2 hours; format — Open-book, multiple-choice — stand-alone and scenario-based questions; assessment — 60 multiple-choice questions across 4 competency domains — fundamental principles and concepts of information security risk management (13 questions), implementation of an information security risk management program (7), the risk management framework and processes based on ISO/IEC 27005 (31, the largest domain at 52% of the paper), and other information security risk assessment methods (9); pass mark — 70%; language — English (other PECB languages available on request). New Zealand candidates should choose a published session that suits their local time, meet PECB’s identity and technical requirements, and complete the system check before exam day. PECB’s general exam policy does not publish a New Zealand restriction.
After passing, apply to PECB for Provisional Risk Manager (no professional or project experience threshold) or Risk Manager (two years of professional experience, including one in information-security risk management, and 200 hours of related activity). The current course page and candidate handbook do not offer a Senior tier from this examination. PECB validates the application and requires its Code of Ethics. Provisional credentials are maintenance-exempt; Risk Manager has the applicable maintenance fees and 60 CPD hours per three-year cycle. Passing the exam does not by itself award a credential or guarantee the highest experience-based tier. PECB requires an online certification application and reference contact details, and its Certification Department decides whether the education, professional experience, and risk-management activity requirements are met.
PECB’s public certification-process page does not publish a closed list of documents that automatically proves project hours. It requires the online application and contact details for references who may be contacted to validate your experience. Keep a dated activity log showing the organisation or client, your role, the risk-management activity, dates, responsibilities, and hours; retain employer or client confirmations, statements of work, timesheets, or similar records in case PECB asks for support. The PECB Certification Department assesses the application and makes the final decision.
3 modules, fully on-demand. Click any module to see the topics inside.
Foundation establishes the language, Lead Implementer builds the management system, and Lead Auditor verifies it. Choose the level that matches the work you will perform.
Information security risk management based on ISO/IEC 27005 — plus OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA.
Lead an information security risk management programme — the 5-day senior pathway, with OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA.
Most ISO 27001 programmes fail their Stage 2 audit on risk, not on controls — the risk assessment is undocumented, the methodology is undefined, or the Statement of Applicability cannot be traced back to any assessed risk. ISO/IEC 27005 Risk Manager is the credential that says you can run that half of the management system properly: define the method, establish context, and produce a risk assessment an auditor can follow.
Information Security Risk Analyst, Security Risk Manager, GRC Analyst, ISMS Manager, and Cyber Risk Consultant roles all treat information security risk management as a named competency. It is a frequent requirement where an organisation is standing up or maintaining an ISO 27001 certified ISMS.
The course covers OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA alongside ISO/IEC 27005. That matters in consulting and in-house work alike, because you frequently inherit an existing method rather than choosing one — being able to work inside a client’s established approach, and explain its trade-offs, is what separates a practitioner from a checklist follower.
ISO 31000 is the enterprise risk framework; ISO/IEC 27005 is the information security specific companion. Practitioners who hold both can move between the enterprise risk register and the ISMS risk register without re-learning vocabulary, which is exactly the position integrated GRC roles are recruiting for.
Any organisation with a certified ISMS must perform and maintain information security risk assessments. ISO/IEC 27005 is the guidance those assessments are most commonly built on, which makes this the natural credential for the person who owns the risk register.
Commonwealth and state entities operating under the Protective Security Policy Framework run risk-based decisions on information handling and system authorisation. A documented, repeatable information security risk method is a standing requirement rather than a one-off deliverable.
CPS 234 obliges APRA-regulated entities to maintain information security capability commensurate with the size and extent of threats. That is a risk judgement, and it has to be evidenced — which is precisely what an ISO/IEC 27005 assessment produces.
Responsible entities for critical infrastructure assets must maintain a Risk Management Program covering cyber and information hazards. ISO/IEC 27005 supplies a defensible method for the information security portion of that programme.
The exam is open-book, but the questions reward fluency, not lookup. Plan your study around these checkpoints.
Free learning resources
Use Aegentra’s existing templates, checklists, registers and mappings alongside your course. No account or email is required.
Free companion reading for anyone studying information security risk management — the risk method behind every ISO 27001 risk assessment:
Compare the family
The ISO 27005 family page compares current levels, prices, delivery, audiences and exam facts before you choose a pathway.
Compare ISO 27005 pathwaysSource and review status
Price, delivery and course content are generated from Aegentra’s authoritative catalogue record. The official PECB course page and exam policy are linked directly below. Source-link checks and substantive human review are tracked separately so one is never presented as the other.
Official PECB sources
Editorial accountability
Harry Sidhu owns publication of this record. A separate course-specific substantive reviewer has not yet been recorded.
Substantive review status
Official source links are checked separately. A course-specific substantive review date will be published when completed.
Official PECB training through an authorised partner. PECB is accredited by IAS and UKAS as a personnel certification body under ISO/IEC 17024 and by ANAB as a certificate issuer under ANSI/ASTM E2659-24. Accreditation is program- and scope-specific—verify the applicable credential before enrolment.
Official PECB training and credential pathway. Check PECB’s current accreditation information and the applicable program scope before enrolment.
This official PECB course is sold and supported by Aegentra Academy. PECB supplies the course material, examination and professional credential scheme. Aegentra's wider practice also runs governance, risk and compliance engagements and Microsoft 365 hardening for Australian organisations. Named eLearning trainers are credited separately on this page when the course record supplies them.
Published Self-Study and eLearning courses run online through the myPECB platform, so professionals across Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra and New Zealand enrol online. Any live online option and its booking arrangements are stated on the relevant course page. Physical classroom and onsite Academy training are not offered. Multi-seat team pricing is available for five or more seats — email Academy@aegentra.com.au for an enterprise quote. Tax invoices with GST and ABN are issued automatically at checkout.
Aegentra Academy training is delivered online; physical classroom and onsite training are not offered. The published option is self-paced study. Available formats and booking arrangements are listed on this course page. Email Academy@aegentra.com.au with your requirements.
Three days of material: an introduction to ISO/IEC 27005 and risk management concepts including context establishment; risk assessment, treatment, and communication; then risk recording, reporting, monitoring and review, plus the other assessment methods — OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA. Delivered self-paced, it is typically 21–30 hours of study.
ISO 31000 is the general risk management standard — principles, framework, and process for any kind of risk across an enterprise. ISO/IEC 27005 is the information security specific guidance, designed to be used with an ISO/IEC 27001 ISMS. The Risk Manager course explains the concepts and principles of both, but the process it trains you to run is the information security one.
It helps considerably. PECB expects a fundamental understanding of ISO/IEC 27005 plus knowledge of risk assessment and information security. The course teaches risk assessment by combining ISO/IEC 27005 with ISO/IEC 27001, so prior exposure to an ISMS makes the material land faster. It is not a formal prerequisite.
Two hours, open-book, covering four competency domains: fundamental principles and concepts of information security risk management; implementation of an information security risk management program; the risk management framework and processes based on ISO/IEC 27005; and other information security risk assessment methods. Pass mark is 70%.
After passing, apply to PECB for Provisional Risk Manager (no professional or project experience threshold) or Risk Manager (two years of professional experience, including one in information-security risk management, and 200 hours of related activity). The current course page and candidate handbook do not offer a Senior tier from this examination. PECB validates the application and requires its Code of Ethics. Provisional credentials are maintenance-exempt; Risk Manager has the applicable maintenance fees and 60 CPD hours per three-year cycle.
Self-Study at $714 + GST gives you the official PECB slide deck and course material to work through at your own pace. The eLearning option at $880 + GST adds recorded video lectures and scenario-based quizzes on top of the same material. Both include the exam voucher and the free resit, and both lead to the identical PECB credential.
Participants receive an attestation of course completion worth 21 CPD credits. These count toward the continuing professional development requirements of ISACA, IIA Australia, and other professional bodies on submission.
Yes — Day 3 surveys OCTAVE, MEHARI, EBIOS, the NIST framework, CRAMM, and Harmonized TRA, and Domain 4 of the exam covers them. The point is to be able to work within whichever method an organisation already uses rather than only the one you were trained on.
Yes. Either complete checkout yourself and forward the Stripe tax invoice for reimbursement, or write to Academy@aegentra.com.au and we will issue an invoice direct to your organisation with payment terms. For group enrolments, request a written quote confirming the current price, payment terms and inclusions before purchase.
Self-Study — Typical total learning effort: 21–30 hours. Course-day equivalent: approximately 3 training days. eLearning — Typical total learning effort: 21–30 hours. Course-day equivalent: approximately 3 training days. These are typical total-learning-effort estimates. They are separate from course-material access, exam duration, any live-class calendar span, and professional-experience requirements.
After payment, the Academy team confirms your enrolment with PECB and you receive login details by email — usually within one business day.
This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination.
One PECB-issued resit is included under the applicable conditions. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. Aegentra does not publish a pass-rate claim without an audited cohort dataset.
Questions about invoicing, GST, group bookings, refunds or instructor-led delivery? Read the Academy FAQ.