EBIOS Risk Manager is the digital risk analysis method published by ANSSI, France's national cybersecurity agency. It is the latest in a generation of information security risk analysis methods (the EBIOS family) whose first version dates back to 1995. Unlike its predecessors, EBIOS RM is resolutely oriented towards deliberate cyber threats, focused on attackers and on strategic and operational attack scenarios.
It structures the analysis into five progressive workshops, from scoping to treatment, and integrates naturally into an ISO 27001 approach. It does not replace ISO 27005, which is a normative, global and strategic framework: EBIOS RM offers a concrete, operational, prescriptive and ready-to-use implementation.
PECB EBIOS Risk Manager certification validates real mastery of the method, beyond simply reading the ANSSI guide, which remains free and openly accessible. For a CISO, consultant or risk manager active in France, Switzerland or Belgium, it represents a solid investment. It is also available in English. For an SME without an established risk culture, training without certification is often more useful as a first step.
That said, the EBIOS Risk Manager method is divisive. Some find it too complex, too French, too oriented towards large organisations. Others have made it their central tool for years. The reality is more nuanced and deserves to be stated clearly.
Rest assured, this article is not a sales pitch for training. It answers a simple question: what is EBIOS RM, when is it useful, and is the PECB certification worth the investment you might consider for it?
What exactly is EBIOS Risk Manager?
The official ANSSI definition
EBIOS Risk Manager is the French national method for digital risk assessment and treatment. It was published by ANSSI (the French National Cybersecurity Agency) in October 2018, with the support of the Club EBIOS. A major update was published in March 2024 to align the method with ISO/IEC 27005:2022.
ANSSI describes it as an âadaptable toolboxâ applicable to public and private organisations of any size and sector. It is distributed under an open licence: the guide is free, downloadable directly from cyber.gouv.fr.
For the record, EBIOS stands for Expression des Besoins et Identification des Objectifs de SĂ©curitĂ© (âExpression of Needs and Identification of Security Objectivesâ), a legacy from the first version created in 1995 by SCSSI, the predecessor of ANSSI.
EBIOS Risk Manager
EBIOS Risk Manager is the French national method for digital risk analysis and treatment, published by ANSSI in 2018 under an open licence. It structures the analysis into five progressive workshops and applies to any organisation, public or private, regardless of size.
EBIOS 2010 vs EBIOS RM 2018: what fundamentally changed
The 2010 version was centred on âessential assetsâ and followed a relatively exhaustive inventory logic: identify every possible risk on every asset. Useful, but heavy as soon as the environment becomes even slightly complex.
EBIOS Risk Manager 2018 changed approach. Rather than seeking exhaustiveness, it aims for representativeness: identifying the most significant risks by starting from real intentional threats and from the organisation's ecosystem. The result is a more agile method, better suited to today's interconnected systems and sophisticated threats.
Another important difference: EBIOS RM explicitly integrates the notion of ecosystem. Partners, subcontractors, cloud providers, service vendors, everything that interacts with the system under study without being part of it, is taken into account from Workshop 3 onwards. This is precisely what makes the method relevant in the context of supply chain attacks and third-party risk.
EBIOS 2010 vs EBIOS RM 2018
Item: Approach
Item: Starting point
Item: Ecosystem
Item: ISO alignment
Item: Agility
What are the five EBIOS RM workshops, concretely?
The method is structured into five progressive workshops. Each workshop answers a precise question.
How to read this section
Each workshop is designed to feed the next. A sloppy Workshop 1 weakens the whole chain. Do not skip steps, even if your perimeter seems simple.
Workshop 1, Scope and security baseline: what are we protecting, and why?
This is the starting workshop. It defines the scope of the study, the organisation's missions, the business values, the supporting assets and the feared events. It also builds the security baseline: the state of application of legal, regulatory or normative requirements (ISO 27001, NIS 2, DORA, GDPR, FADP, etc.) on the perimeter under study.
In practice: at the end of Workshop 1, you know precisely what you want to protect, what you fear, and what compliance gaps already exist. This is also where accidental and environmental risks are treated, via the baseline rather than via attack scenarios.
Workshop 2, Risk sources: who could attack us, and why?
Workshop 2 identifies and characterises the relevant risk sources, in plain language, the potential attackers. It evaluates their resources, motivations, and what they concretely seek to obtain on your system.
This workshop is often the one that surprises participants. Seriously asking âwho would actually want to attack us and to do what?â forces you to leave the generic frame and anchor the analysis in the reality of the organisation.
Workshop 3, Strategic scenarios: where can they get in?
This is the ecosystem workshop. It maps everything that interacts with the perimeter under study (partners, suppliers, providers, technical interconnections) and identifies the plausible strategic attack paths through that ecosystem.
This is where EBIOS RM most clearly stands apart from classical approaches. By forcing the analysis of external dependencies, it surfaces risk vectors that are often ignored in a purely internal view of security.
Workshop 4, Operational scenarios: how will they act concretely?
Workshop 4 goes down to tactical and technical level. It details the attack operating modes and assesses their likelihood. It is the most technical workshop of the method, the one that demands the most operational cybersecurity expertise.
Workshop 5, Risk treatment: what do we do now?
This is the decision workshop. Now that risks have been identified and assessed, it is time to decide how to treat them: reduce them through additional security measures, transfer them (insurance, contracts), accept them in full awareness, or refuse them by modifying the perimeter.
Workshop 5 turns the study into actionable deliverables: treatment plan, documented trade-offs, governance decisions. It is what justifies the investment in the first four workshops.
Flow diagram of the five EBIOS Risk Manager workshops, showing how each workshop feeds the next, from initial scoping through to the final treatment plan.
The Workshop 4 pitfall
Without rigorous scoping in Workshop 1, Workshop 4 can produce an unmanageable combinatorial explosion. The Club EBIOS acknowledges this explicitly. The solution: discipline the granularity from the start, not afterwards.
Is EBIOS RM compatible with ISO 27001 and ISO 27005?
This is the question that comes up most often, and the answer deserves to be stated clearly.
Why EBIOS RM does not replace ISO 27001
ISO 27001 is a management system: it describes how to organise, document, audit and continuously improve an organisation's information security. It is not a risk analysis method, but a governance model.
EBIOS RM is a method: it describes how to concretely carry out the risk analysis that ISO 27001 requires. The two are complementary, not competing. Within an ISO 27001 certification approach, EBIOS RM directly but partially answers the requirements of Clause 6.1.2 (information security risk assessment).
Why ISO 27005 and EBIOS RM do not oppose each other
ISO 27005 describes the general process of information security risk management: context definition, identification, analysis, evaluation, treatment. It is a normative framework. It does not tell you how to do it; it tells you what to do.
EBIOS RM is a concrete implementation of that process. As the Club EBIOS puts it: EBIOS RM âdescribes practical techniques to enable its users to apply the model described in ISO 27005â. ANSSI explicitly updated the method in 2024 to make it fully aligned with ISO/IEC 27005:2022.
The most accurate framing: EBIOS RM replaces neither ISO 27001 nor ISO 27005. It complements ISO 27001 as an operational risk analysis method, and it concretely implements the logic described by ISO 27005.
ISO 27001 vs ISO 27005 vs EBIOS RM
Item: Nature
Item: What it describes
Item: Certifiable?
Item: Mutual link
Item: Who uses it?
When EBIOS RM is more operational
For organisations that need to demonstrate their risk control to an auditor, a regulator or their management, EBIOS RM produces structured, traceable and defensible deliverables. That is its main advantage over more informal approaches. It is also referenced by ENISA in its inventory of risk management methods, which gives it international legitimacy beyond the purely French context.
Who uses EBIOS RM today?
The professional profiles involved
The method is not driven by a single actor.
Club EBIOS makes this clear: EBIOS RM is âcarried out through workshops that bring together the perspectives of multiple actorsâ. In practice, around the table you find: the CISO who steers the approach, business representatives who know the values to protect, technical leads who know the supporting assets, and often a management representative for the Workshop 5 arbitrations.
The profiles with the strongest interest in mastering the method in depth: CISOs, security consultants, risk managers, security architects, project leads on critical IS, and internal auditors.
Who leads the workshops?
A frequent Club EBIOS question: âConcretely, who runs the method, the CISO or the risk manager?â The answer: no one runs it alone. One lead, several contributors. Defining these roles before starting is a condition of success, not a detail.
The sectors where the method is most useful
EBIOS RM is essential in regulated sectors and in the French Operators of Vital Importance (OIVs). But ANSSI specifies that it applies âequally to public and private organisations, regardless of sizeâ. Use cases published by Club EBIOS cover contexts as varied as healthcare (medical imaging centre), digital projects, or product and service security.
For Swiss and Belgian organisations exposed to French requirements or to partners that use EBIOS RM, the method is increasingly present, even if it remains less systematic than in France. It is also used by EU suppliers whose clients are French government or military entities.
France, Switzerland, Belgium, Luxembourg: how recognised really?
The Club EBIOS itself states it plainly: EBIOS RM âis widely known in France and its use is by far the majority as a risk analysis method. However, it does not enjoy the same aura beyond our borders.â
In French-speaking Switzerland, Belgium and Luxembourg, the method is known and used (training exists, providers apply it) but it coexists with other risk management approaches. For a Switzerland-based professional, EBIOS RM certification is a real asset if their activity involves working with French organisations, subsidiaries of French groups, or French-European regulatory requirements. It is less decisive if the context is purely Swiss or international English-speaking.
International presence
EBIOS RM is referenced by ENISA in its official inventory of cyber risk management methods, one of the rare French-speaking methods to receive that recognition at the European level.
Why the method seems complicated at first
The fear of getting lost
âEBIOS Risk Manager to analyse an IS: how to avoid getting lost?â is one of the most viewed questions on Club EBIOS. This fear is legitimate. The method is rich, the concepts precise, and the five workshops can seem imposing before you have done one.
What helps: the method is designed to be modular. ANSSI explicitly states that the importance of each workshop varies according to the objective set and the maturity of the perimeter. A first study does not need to be exhaustive to be useful.
The combinatorial explosion risk
This is the most frequent criticism from experienced practitioners. Club EBIOS acknowledges it: âConducting a study is sometimes criticised because of the combinatorial explosion of elements to be studied.â In the absence of rigorous scoping, Workshop 4 can become unmanageable.
The solution: calibrate the granularity of the study from Workshop 1. The wider the perimeter and the more numerous the supporting assets, the more you need to discipline the level of detail of the subsequent workshops. This is a skill acquired with practice, and it is precisely what a good training course covers.
The PECB EBIOS Risk Manager certification: what does it really validate?
Exact name, levels, prerequisites
The certification is called PECB Certified EBIOS Risk Manager. The PECB scheme distinguishes two levels: Provisional Risk Manager (no experience required) and Confirmed Risk Manager (with documented experience).
To reach the Confirmed level, candidates must either complete an accredited EBIOS RM training or justify at least 2 years of relevant professional experience and have applied a significant part of the method at least once in the 3 years preceding the application. The baseline prerequisite is a fundamental level in risk management.
Provisional Risk Manager vs Confirmed Risk Manager
Item: Experience required
Item: Field application
Item: Obtained via
Item: For whom
Exam format, duration, passing score
The exam is open book, lasting 3 hours. It contains 60 questions: 57 multiple-choice questions and 3 essay-type questions. The passing score is 70 %.
âOpen bookâ does not mean easy. The essay questions require real mastery of the method, not just the ability to find a definition in the guide. Someone who has only read the ANSSI guide without having applied it or structured it mentally will struggle with the three hours.
PECB EBIOS RM exam format
3 hours, open book, 57 MCQ + 3 essay questions, passing score: 70 %.
Validity, renewal and maintenance
PECB certifications are valid for 3 years. To maintain them, you must satisfy the CPD (Continuing Professional Development) requirements and pay the annual maintenance fees. In case of default, the certification can be suspended for 12 months, then revoked.
Certify or just read the ANSSI guide?
What training actually brings
The ANSSI guide is excellent and free. But training does two things the guide cannot: it forces you to apply the method on practical cases, and it lets you ask questions to a practitioner who has run real EBIOS RM studies. The gap between âunderstanding the methodâ and âknowing how to run itâ is often 3 days of training.
What certification actually brings
The PECB certification adds formal, internationally recognised proof of your mastery. You can make it visible on LinkedIn, verifiable by employers and clients, and at the Confirmed level it attests to documented real-world experience. For a consultant or CISO selling their skills on the market, that is a clear signal.
When certification is not a priority
If you are an in-house professional using EBIOS RM internally without needing to demonstrate it externally, training without certification may be enough. If you are in an SME discovering the method and looking to do a first solid study, the return on investment of training is immediate; the return on certification is less obvious in the short term.
- You work or wish to work as a security consultant or risk manager
- You need to demonstrate your skills to external clients or employers
- Your activity exposes you to French organisations, OIVs, or subsidiaries of French groups
- You are a CISO and must legitimise a risk management approach with your management
- You already have a foundation in ISO 27001 or in risk management
- You want to enhance your LinkedIn profile in the French-speaking GRC space
Who finds the certification most useful?
CISOs, consultants, risk managers, security architects
These are the profiles for which the certification carries the strongest signal value. A PECB-certified EBIOS Risk Manager security consultant can mention the certification in their proposals. A CISO can use it to legitimise a risk analysis approach with their management.
Beginners vs experienced profiles
For a beginner with little experience in risk management, starting with an ISO 27001 Foundation training or an introduction to cyber risks can be more useful than tackling EBIOS RM directly. The method assumes a basic understanding of the risk management context.
For an experienced profile (a CISO with a few years of practice, a consultant, an auditor), EBIOS RM is directly accessible and the value is immediate.
SME and mid-cap cases
For an SME or mid-cap, the method is applicable; ANSSI says so explicitly, and Club EBIOS has published a specific FAQ for SMBs. The main recommendation in this context: have at minimum a business/management representative and an IS lead around the table, and ideally engage a provider for the first study.
What we see in the field
At Abilene Academy, we have been training professionals in EBIOS Risk Manager for several years across the EU, French-speaking Switzerland and France. A few observations that are not in the guides:
The exam is honestly challenging for someone who has not practised. The essay questions demand structure, not recall. Candidates who pass on the first attempt are those who have worked on practical cases, not those who have spent the most time re-reading the guide.
The recognition in Switzerland varies by sector. In firms exposed to ANSSI requirements or in groups with French subsidiaries, the certification is directly valued. In purely Swiss contexts, ISO 27001 remains the primary reference and EBIOS RM comes as a complement.
The link with NIS 2 and DORA is real but indirect. These texts impose risk management approaches but do not name EBIOS RM. The method remains compatible and applicable in those contexts, but not mandatory.
For a Swiss-Romand SME discovering cyber risk management, we often recommend starting with training without an immediate certification requirement: run a first solid study, understand the method under real conditions, then decide whether certification is required based on the professional context.
NIS 2, DORA, FADP
None of these texts name EBIOS RM explicitly. They require a structured risk management approach (which EBIOS RM answers perfectly), but its use remains a choice, not an obligation.
Sources
- ANSSI, EBIOS RM update, March 2024: https://cyber.gouv.fr/actualites/lanssi-met-a-jour-la-methode-ebios-risk-manager/
- ANSSI, The EBIOS Risk Manager method: https://cyber.gouv.fr/securisation/analyse-des-risques/methode-ebios-rm/
- Club EBIOS, EBIOS RM & ISO 27005 link: https://club-ebios.org/site/lien-ebiosrm-iso27005/
- Club EBIOS, Who runs the method?: https://club-ebios.org/site/concretement-qui-deroule-la-methode-rssi-ou-risk-manager/
- Club EBIOS, How to avoid combinatorial explosion: https://club-ebios.org/site/comment-eviter-lexplosion-combinatoire-dune-etude/
- PECB, EBIOS Risk Manager certification: https://pecb.com/en/education-and-certification-for-individuals/risk-assessment-methods-training/ebios
- PECB Help Center, List of PECB Exams: https://help.pecb.com/index.php/list-of-pecb-exams/
- ENISA, Risk Management Inventory: https://tools.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-ra-methods/m_ebios.html
