Training FAQs & Answers

What is the CISA certification?

CISA is a globally recognized certification for information systems auditors. It validates competence in IT auditing, governance, risk management, and information security.

How do I build an AI governance framework that balances innovation and risk?

Effective AI governance defines clear roles, risk tiers, approval workflows, and ethical principles. It enables responsible innovation while managing bias, privacy, transparency, and accountability risks.

How do you manage digital transformation risks during implementation?

Manage transformation risk by identifying, analyzing, treating, and tracking risks throughout execution while aligning governance, resources, and change management to the strategy.

What is the EBIOS Risk Manager certification and what does it qualify you to do?

The EBIOS Risk Manager certification qualifies professionals to conduct structured information security risk assessments using the EBIOS RM method mandated by ANSSI. It confirms the ability to build threat-driven risk scenarios, assess risks, and define justified treatment measures aligned with ISO 27001.

What is the format of the EBIOS Risk Manager certification exam?

The EBIOS Risk Manager exam is a three-hour, open-book, paper-based exam aligned with ANSSI requirements. It assesses knowledge of EBIOS RM principles, framework, and practical risk assessment execution.

Who should take the EBIOS Risk Manager training?

EBIOS Risk Manager training is intended for professionals involved in information security risk assessments, including security managers, risk analysts, consultants, and managers who need to understand or validate EBIOS RM studies used for ISO 27001 or regulatory purposes.

What is included in a GDPR compliance program for DPOs?

A GDPR compliance program typically includes governance, documented policies, processing records, risk management, and monitoring activities. It also covers DPIAs, breach handling, and internal checks to track issues and improvements.

When should organizations formalize incident management?

Incident management should be formalized before incidents occur, not during a crisis.

Why does ISO 27035 focus on structured incident management?

ISO 27035 emphasizes structure to ensure incidents are handled consistently, legally, and with minimal business disruption.

How long is the ISO 31000 Lead Risk Manager exam and how is it delivered?

The exam is stated as three hours in duration and is available online. It is described as meeting the PECB Examination and Certification Programme requirements.

How does ISO 31000 support decision-making?

ISO 31000 supports decision-making by providing a structured way to understand uncertainty, prioritize risks, and select treatment options based on defined criteria.

ISO 31000 Risk Manager vs Lead Risk Manager: what's the difference?

The ISO 31000 Risk Manager certification is a 3-day course for professionals who run the risk management process in their role. The Lead Risk Manager certification is a 4-day course for those who lead a risk management program, adding framework design and improvement, process planning, and governance integration. Choose Risk Manager to apply ISO 31000, and Lead Risk Manager to own and improve it.

What is ISO 31000 certification and how do you get certified?

ISO 31000 does not certify organisations. It certifies professionals. PECB offers two certifications based on the ISO 31000 framework: the 3-day PECB Certified ISO 31000 Risk Manager for practitioners applying the standard, and the 4-day PECB Certified ISO 31000 Lead Risk Manager for those leading enterprise risk programmes. Both are recognised internationally and validate your ability to plan and improve a risk management process aligned with ISO 31000:2018.

What is covered on Day 2 of the ISO 31000 Risk Manager course?

Day 2 covers initiation of the risk management process, including defining scope, context, and criteria, and performing risk identification, analysis, and evaluation.

What is a Compliance Management System under ISO 37301?

A CMS is a management system that helps organizations identify, manage, and comply with their legal and regulatory obligations. ISO 37301 defines requirements for governance, controls, monitoring, and improvement.

What is an AI management system under ISO 42001

An AI management system structures how an organization governs, uses, and controls AI responsibly. ISO 42001 defines requirements to manage risks, ethics, and accountability.

What does an AI management system (AIMS) help an organization do?

An AIMS helps an organization govern how AI is planned, implemented, operated, and improved so AI initiatives remain controlled, consistent, and auditable.

When should organizations formalize network security practices?

Network security practices should be formalized before incidents or audits expose weaknesses.

What is ISO/TS 31050?

ISO/TS 31050 is a technical specification that gives organisations structured guidance for managing emerging risks: threats that are still forming and cannot yet be measured with confidence. It extends the ISO 31000 risk management standard into territory that conventional risk methods handle poorly, from detecting weak signals to treating risks whose probability and impact are still unclear.

What is an emerging risk, and how does it differ from a conventional risk?

An emerging risk is a threat that is developing but not yet well understood, with no reliable history to estimate how likely it is or how hard it will hit. A conventional risk is already known and can be measured against past data. The difference matters because standard risk tools tend to overlook emerging risks until they are already causing damage.

What is the ISO/TS 31050 Emerging Risks Manager certification and what does it qualify you to do?

The PECB ISO/TS 31050 Emerging Risks Manager certification proves you can identify, assess and treat emerging risks using ISO/TS 31050 inside an ISO 31000 process. It qualifies you to run an emerging risk programme in a risk, resilience or governance role, and to give a board a credible read on exposure that cannot yet be quantified.

What is the difference between ISO/TS 31050 and ISO 31000?

ISO 31000 sets the general principles and process for managing any risk, while ISO/TS 31050 is a technical specification that extends that process to emerging risks: threats that surface as weak, uncertain signals with no historical data. You apply 31050 inside the 31000 framework, not as a replacement for it.

What is the risk intelligence cycle in ISO/TS 31050?

The risk intelligence cycle is the method ISO/TS 31050 uses to turn scattered external signals into decisions leadership can act on. It runs continuously: gather signals, make sense of them, assess what they mean, communicate the finding, and feed it back into monitoring. It keeps an emerging risk under active management instead of sitting undetected until it becomes a crisis.

Who is the ISO/TS 31050 training for?

The ISO/TS 31050 training is for risk managers, resilience and business continuity leads, and governance or compliance professionals who need a structured method for uncertain, evolving risk. It also suits consultants who advise clients through strategic uncertainty and want a recognised, standards-based approach.

How do NIST AI RMF and the EU AI Act relate to the course?

They provide recognized structures for governing AI risk, defining controls, and demonstrating compliance and ethical AI use in organizational settings.

What makes AI risk management different from traditional IT risk?

AI risks are dynamic, probabilistic, and context-dependent. Unlike static IT systems, AI models degrade over time, produce unexpected outputs, and fail in ways difficult to predict or test comprehensively.

What are the core components of a cybersecurity program?

A cybersecurity program includes governance, risk management, controls, awareness, incident management, monitoring, and continual improvement.

What does the Lead Cybersecurity Manager exam assess?

The exam assesses your ability to design, govern, operate, and improve a cybersecurity program across defined competence domains.

What is the role of a Lead Cybersecurity Manager?

A Lead Cybersecurity Manager designs, governs, and improves a cybersecurity program to manage risks, protect assets, and strengthen organizational resilience.

How should you scope a penetration test based on risk?

Risk-based scoping prioritizes the assets and attack paths with the highest potential impact and defines clear rules of engagement to test them safely and legally.

Who is this course best suited for, and who may need a different starting point?

It is best for professionals who will lead or contribute to real penetration tests, while those without basic security foundations may benefit from preparatory learning first.

How is SCADA/ICS security different from traditional IT security?

SCADA/ICS security prioritizes safety and availability under operational constraints, so controls must be engineered to avoid disrupting physical processes.

How do you prepare an organization for a SOC 2 audit?

Preparation involves defining scope, identifying gaps, implementing controls, and collecting evidence that demonstrates control operation. Ongoing monitoring and reporting support audit readiness.

What does SOC 2 focus on?

SOC 2 focuses on controls related to security, availability, processing integrity, confidentiality, and privacy. It evaluates how organizations manage and protect information systems handling sensitive data.

What is the NIS 2 Directive trying to achieve?

The NIS 2 Directive aims to strengthen cybersecurity and resilience across critical infrastructure and essential services by setting clearer security and governance expectations.

Asset management and risk management in NIS 2 programs

Asset management provides visibility on what you run and what is critical. Risk management turns that visibility into prioritized decisions on controls, incidents, and resilience.

What does NIS 2 implementation look like beyond a policy update?

NIS 2 implementation is an operational program that combines governance, risk, controls, incident response, testing, and measurable improvement—not just documents.

What the NIS 2 Directive requires from organizations

NIS 2 sets expectations for governance, risk management, and security measures for covered entities. It also drives consistent incident handling, reporting, and resilience practices.

How do NIST SP 800-53, NIST RMF, and NIST CSF fit together in practice?

In practice, the NIST CSF helps structure outcomes, the RMF guides the risk-based process, and SP 800-53 provides a catalog of controls to implement and assess.

How should supply chain risk management be treated in a cybersecurity program?

Treat supply chain risk as part of system risk by identifying dependencies, setting requirements for suppliers, and monitoring ongoing exposure.

Who should take this course if they are not in a security role?

Non-security leaders and technical owners should take it when they must oversee risk, controls, and compliance expectations tied to NIST-aligned requirements.