Training module
Information Security Risk Management
Build the capability to make the organisation's information security risk position visible, owned and defensible
Information security risk management that holds up in ISMS decisions
Develop the practical judgement behind ISO/IEC 27001 risk work: connecting business processes, services, information assets, threats, vulnerabilities and control gaps to treatment decisions, SoA rationale, residual-risk acceptance and review triggers.
Overview
What this module is about
Many ISMS risk registers look complete until a real decision is needed. This module uses the evolving Northstar case to connect business processes, services, primary and supporting information assets, threats, vulnerabilities, control gaps and weak signals to assessment and treatment decisions.
The focus is practical ISMS judgement, not scoring theatre, tool configuration or a control-by-control walkthrough. Participants practise improving risk statements, applying criteria, explaining control rationale, checking SoA traceability, documenting residual-risk acceptance and setting review triggers.
Audience
Who it is for
Management system implementers and coordinators
Executives and department heads accountable for management system performance
Those responsible for processes, policies, assets, risks and controls
Auditors seeking insight into management-side practice, not audit technique
Consultants working on management system design, governance or improvement
Decision supportIs this module for you?
It is a good fit if you…
work with ISMS risk assessment, treatment, acceptance or management review.
need risk information that explains why controls are selected, excluded or improved.
see weak risk statements, inconsistent criteria, unclear ownership or stale registers.
want to connect business processes, services and information assets to practical risk decisions.
need SoA rationale, residual-risk acceptance and assurance responses to be defensible.
It may not be the best fit if you…
want a short overview of ISO/IEC 27001 clauses only.
are mainly looking for technical hardening, penetration testing or SIEM operation.
need advanced quantitative risk modelling as the main focus.
expect a tool or template to make risk decisions without contextual judgement.
want a full SoA construction, control catalogue or audit execution course.
What to bring
No formal prerequisites. The module teaches the risk-management foundations needed for the ISMS case through concrete case artefacts.
Helpful background includes:
General familiarity with information security or management-system work
Basic understanding of organisational processes, roles and decision-making
Experience discussing organisational risks and trade-offs is useful but not required
Agenda
What is taught
7 parts01ISMS risk decision trail
Read risk artefacts before trusting them
Use core risk concepts through concrete ISMS records
Connect risk, treatment, SoA, acceptance and review
02Services, assets and exposure
Start top-down from business processes and services
Identify primary and supporting information assets
Use classification, criticality and dependencies as impact inputs
03Risk statements and criteria
Separate risks from issues, causes, controls and actions
Repair weak risk statements so they support decisions
Test criteria for consistency, authority and information-security relevance
04Assessment judgement and weak signals
Apply likelihood, impact and evidence confidence without false precision
Distinguish inherent, current and residual risk
Use incidents, supplier notes, access exceptions and assurance questions as reassessment inputs
05Treatment options and control rationale
Compare treatment options against risk effect, constraints and assurance value
Explain how selected controls are expected to change exposure
Clarify dependencies, limits and hand-offs to operational control
06SoA traceability and residual risk
Trace treatment decisions into SoA applicability and rationale
Find weak exclusions, optimistic implementation status and missing evidence
Record residual-risk acceptance with authority, rationale and conditions
07Review, reporting and assurance
Define reassessment triggers for changes, incidents and control signals
Prepare risk and control indicators for management review
Give customer-safe assurance without overstating the risk position
Outcomes
Learning outcomes
01
Identify information security risks from business processes, services, information assets, threats, vulnerabilities and control gaps
02
Assess ISMS risks using criteria, evidence confidence, weak signals and inherent/current/residual risk distinctions
03
Translate risk assessment into treatment choices, control rationale, SoA traceability and residual-risk acceptance
Distinguish primary information assets, supporting assets, owners, controls, dependencies and assurance needs
Repair vague risk statements and inconsistent criteria so risk artefacts become decision-ready
Use incidents, supplier signals, access exceptions and customer questions as reassessment triggers
Prepare risk information, indicators and assurance wording for management review
Use AI support to challenge artefacts and cluster weak signals without outsourcing accountability
Materials
The content and the assessment
Written module
The full content in writing, complete in itself. Videos are recorded for parts of it as an alternative way through, and the written module always carries everything.
Exercises
Graded work on the case organisation's own registers: structured answers checked against the encoded case, written answers scored against a rubric traced to it, with a trainer holding the final word on every assessed item.
On completion
The assessed exercises must be passed before the certificate is issued.
Scheduling
No public run of Information Security Risk Management is scheduled at the moment. Tell us you are interested and we will let you know when the next one opens, or discuss running it in-house.
Module facts
- Module ID
- HAM-IS-S-02
- Discipline
- Information Security
- Part of tracks
- Management System Manager
Case organisation
All modules share one company
Each module enters the company at a particular point in its history and finds it as that history has left it.
Northstar Integrated Services AG is a group headquartered in Zurich, operating in six European countries, with about 1,350 employees at the end of 2025. It provides digital operations platforms and managed operational services to regulated organisations in healthcare, the public sector and industrial services. Founded in 2008 as a field-operations firm serving business customers, it had about twenty-five employees when its first regulated customer, a hospital group, required documented decisions, named accountability and evidence on request. It moved into the platform business in 2016 and in 2024 acquired an operating business in Poland and the Czech Republic, whose legal entity continues inside the group.
Linked registers
Organisation and people, roles, risks, objectives, policies, documents and records, communications, findings, audits and reviews, interested parties, processes
Records, not summaries
The evidence sits in the registers and documents where a real organisation would keep it.
A history
The company has a timeline from 2008, so a structure can be examined before and after it changed.
More than one legal entity
A Swiss parent company and an acquired subsidiary in Poland and the Czech Republic, with customers in several jurisdictions
Why it matters
Judgement develops on material that is incomplete and partly contradictory, as it is in practice. Northstar is built that way on purpose. Because modules enter its history at different points, a governance structure can be seen while it is built, when it is outgrown and when it is rebuilt.
Delivery & dates
How this module reaches you
Delivered live online, combining conceptual framing, discussion, case work and direct interaction with the trainer. In-house and contextualised delivery is available on request.
No public run is scheduled at the moment. Most modules run on request as well as on the public calendar, so tell us the timing you need.
Want this module scheduled?
We will tell you when the next run is scheduled, or run this module in-house with your own case material.
Not sure it is the right module?
Describe your context in a short message and we will tell you honestly.