ISO 31000 is an international standard that provides guidelines for risk management within organizations. The standard helps organizations to identify, analyze, assess, and treat risks in a structured and consistent manner. ISO 31000 is not a certification standard for organizations, but a practical guideline that is applicable to any sector and any type of organization. The goal is to support better decision-making, manage uncertainties, and improve performance by effectively managing risks.

ISO 31000 and ISO 27005 differ mainly in scope and application. ISO 31000 focuses on risk management at the organizational level (enterprise risk management), making it broadly applicable regardless of sector or type of risk, and provides general principles, frameworks, and processes. ISO 27005 specifically addresses information security risks, is part of the Information Security Management System (ISMS) domain, closely aligns with ISO/IEC 27001, and delves deeper into threats, vulnerabilities, and security controls. In short: ISO 31000 = general risk management ISO 27005 = risk management specifically for information security

Yes, in most cases it makes sense to first take the ISO 31000 training and then ISO/IEC 27005. If you are purely working in cybersecurity or information security, then ISO/IEC 27005 may be directly more relevant. The same applies if you already have experience with enterprise risk management. By first taking the ISO 31000 training, you will understand: The general methodology of risk management; Governance and decision-making regarding risks; Frameworks, context determination, and risk treatment; How organizations approach risks integrally. After that, ISO/IEC 27005 is easier to place, as that training makes more of the translation to: Information security risks; Threats, vulnerabilities, and impact; Security controls; Risk analysis within an ISMS.