Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by BCS
Exam Format
90 min
60
39/60 (65%)
Practitioner
Registration
$290 USD
BCS Online Proctored or online proctoring
Validity
No expiry - lifetime certification
PCIRM Exam Topics and Domains
PCIRM is organized into 8 weighted domains. Expect to work with BS 31100 - Risk management code of practice, ISO 27001 - Information security management systems, ISO 27005 - Information security risk management, ISO 31000 - Risk management guidelines, and more.
1
The Concepts and Framework of Information Risk Management
5%
Explain the need for information risk management
The lifecycle of informationWhat information risk management is, and why and when it should be undertakenWhich parts of an organisation may practice information risk managementThe general legal and regulatory framework that surrounds risks to information
- Explain the need for information risk management
- Describe the lifecycle of information and its relevance to risk
- Identify which parts of an organisation practice information risk management
- Describe the general legal and regulatory framework surrounding information risk
Explain the context of risk in organisations
Why organisations must take account of information riskThe benefits to organisations of undertaking information risk managementThe potential consequences of not undertaking information risk management
- Explain why organisations must take account of information risk
- Describe the benefits of information risk management
- Explain the consequences of not undertaking information risk management
2
Information Risk Management Fundamentals
10%
Explain the fundamentals of information security
The concepts of confidentiality, integrity, availability (CIA)The concepts of accountability, non-repudiation, authenticity, privacy, secrecy, identification, resilience and reliabilityThe differences between information security, cyber security, information risk management and information assurance
- Explain the CIA triad and its application
- Describe extended information security concepts
- Differentiate between information security, cyber security, IRM and information assurance
Explain information risk management standards and good practice guides
The need for and the uses of international information risk management standardsVarious standards that apply to information risk managementThe need to understand the national legal and regulatory environmentVarious legal and regulatory instrumentsInformation from professional organisations
- Explain the purpose of international IRM standards
- Describe the key standards applicable to IRM including ISO 27001, 27005, 31000
- Identify relevant legal and regulatory instruments
- Recognise professional organisations and their contributions to IRM
Explain the process of information risk management
The overall process of risk managementThe concept of information risk ownershipThe four stages of information risk managementRisk management methodologies
- Describe the overall IRM process
- Explain the concept of information risk ownership
- Describe the four stages of IRM
- Demonstrate awareness of commercial risk management methodologies
Explain information risk terms and definitions
The meaning of threats, hazards, vulnerabilities, proximity, likelihood, probability and riskThe strategic risk treatment optionsThe choices of tactical risk controlsThe selection of operational risk controls
- Define key information risk management terms
- Explain strategic risk treatment options
- Describe tactical and operational risk control types
- Apply correct terminology in risk management scenarios
3
Establishing an Information Risk Management Programme
12%
Understand the requirements of an information risk management programme
The Plan-Do-Check-Act model (Deming Cycle)Leadership of the information risk management programmeAn information risk management policyResponsibility and accountabilityIntegration of IRM into business-as-usual operationsProper assignment of resourcesRegular communications and reporting
- Explain the PDCA model in the context of IRM
- Describe leadership requirements for IRM programmes
- Identify key components of an IRM policy
- Explain responsibility and accountability in IRM
- Describe how to integrate IRM into BAU operations
Explain the development of a strategic approach to information risk management
Establishing internal and external contextsDefinitions of risk appetite, risk tolerance and criteria for risk acceptanceVerification of information assurance requirementsVerification of legal and regulatory requirementsEnsuring communications and consultation between stakeholdersSetting the scope of the IRM programme
- Describe how to establish organisational contexts for IRM
- Define risk appetite, risk tolerance and risk acceptance criteria
- Explain how to verify information assurance and compliance requirements
- Describe stakeholder communication strategies for IRM
- Explain how to set the scope of an IRM programme
Explain the principles of information classification
The requirement for and purpose of a classification schemeIdentifying and documenting information assets and their ownersThe use of CIA in developing an information classification schemePeriodic reviews of information and its classificationsTypes of classificationThe difference between information classification, privacy marking and handling caveats
- Explain the purpose of information classification schemes
- Describe how to identify and document information assets
- Apply CIA concepts to classification scheme development
- Identify different classification levels and their applications
- Distinguish between classification, privacy marking and handling caveats
4
Risk Identification
21%
Describe the process to identify information assets
Examples of tangible and intangible information assets
- Identify all forms of organisational information assets
- Distinguish between tangible and intangible information assets
Conduct a business impact analysis
The overall business impact analysis process and who should be involvedHow to formulate business interruption costs in terms of CIAThe uses of cost of failure analysesThe concept of worst-case scenariosThe difference between direct and indirect impactsThe difference between primary and secondary impactsHow scales may be used to quantify impact levels
- Describe the business impact analysis process
- Formulate business interruption costs using CIA
- Apply cost of failure analysis
- Develop worst-case scenario assessments
- Distinguish between direct/indirect and primary/secondary impacts
- Use scales to quantify impact levels
Conduct a threat and vulnerability assessment
How threats and likelihood combine to create a riskThe most common threats and hazards and the difference between themPossible motivations for threats and likely threat actorsThe most common vulnerabilitiesThe difference between likelihood and probabilityHow scales may be used to quantify likelihood levelsThe use of statistical or historic data to predict likelihood
- Explain how threats and likelihood create risk
- Identify and distinguish between common threats and hazards
- Describe threat actor motivations
- Identify common vulnerabilities
- Distinguish between likelihood and probability
- Use scales and data to assess likelihood
5
Risk Assessment
21%
Undertake a risk analysis
The differences between qualitative, quantitative and semi-quantitative risk analysisThe difference between generic and specific risk analysesThe construction and use of a risk matrixHow to specify suitable impact, proximity and likelihood scalesThe concept of risk as an opportunity
- Distinguish between qualitative, quantitative and semi-quantitative risk analysis
- Differentiate between generic and specific risk analyses
- Construct and use a risk matrix
- Specify suitable impact, proximity and likelihood scales
- Explain the concept of risk as an opportunity
Conduct risk evaluation
How to quantify the results of a risk assessmentComparing risk analysis results with organisational risk criteria and risk appetiteThe purpose and probable contents of a risk register
- Quantify risk assessment results
- Compare risk results with organisational risk criteria
- Describe the purpose and contents of a risk register
6
Risk Treatment
19%
Explain risk treatment options, controls and processes
The four strategic risk treatment optionsThe purpose of tactical risk treatment controlsThe three types of operational risk treatment controlsThe risk treatment processThe concepts of resilience, business continuity and disaster recovery
- Explain the four strategic risk treatment options
- Describe tactical risk treatment controls
- Identify the three types of operational risk treatment controls
- Explain the importance of combined treatment approaches
- Describe resilience, business continuity and disaster recovery as risk treatment methods
Explain the use of a risk treatment plan
Requirements for the management of a plan to treat identified risks
- Describe the requirements for a risk treatment plan
- Explain how to prioritise and resource risk treatments
- Describe the approval process for risk treatment plans
7
Monitor and Review
6%
Explain information risk monitoring
The need for monitoring of risks after treatmentThe need to monitor methods of risk treatment
- Explain the need for ongoing risk monitoring post-treatment
- Describe why treatment methods must be monitored for effectiveness and relevance
Undertake an information risk review
The need to review all risks at intervals and when impact or likelihood may have changedThe need to identify new threats and new risksHow new threats can be identifiedA process for ongoing reporting of information risk management status
- Explain the need for periodic risk reviews
- Describe how to identify new threats and risks
- Explain sources for threat intelligence
- Describe a process for ongoing IRM status reporting
8
Presenting Risks and Business Case
6%
Report and present the progress of a risk management programme
Requirements for reporting on an information risk management programmeThe possible contents of a risk report
- Describe reporting requirements for IRM programmes
- Identify the contents of a risk report
Present a business case
The need for a business caseBusiness case preparation process and formatPresentation of an outline business case
- Explain why a business case is needed
- Describe the business case preparation process
- Present a business case to board-level decision-makers
How do I earn this certification?
Passing PCIRM earns the Practitioner Certificate in Information Risk Management certification. It sits in the Information Security and Data Protection track.
Current Level Exams
- PCIAA - BCS Practitioner Certificate in Information Assurance Architecture
- PC-DP - BCS Practitioner Certificate in Data Protection
- PC-FOI - BCS Practitioner Certificate in Freedom of Information
Next Level Options
Alternative Paths
- PCIAA - BCS Practitioner Certificate in Information Assurance Architecture Complementary practitioner certification focusing on information assurance architecture rather than risk management
- PC-DP - BCS Practitioner Certificate in Data ProtectionComplementary practitioner certification with deep focus on data protection law and practice
- CRISC - ISACA Certified in Risk and Information Systems ControlIndustry-recognised IT risk management certification from ISACA, broader international scope
- ISO 27005 - ISO/IEC 27005 Risk Manager (PECB or similar) Focuses specifically on ISO 27005 information security risk management standard
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for PCIRM is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2022-07-01
Updates
- ISO/IEC 27001:2022 2022 Syllabus references ISO 27001:2017 but the updated 2022 standard is now the current version. Candidates should be aware of both. • Release date: 2022-10-25
- ISO/IEC 27005:2022 2022 Syllabus references ISO 27005:2018 but the updated 2022 standard is now current. The risk management process remains fundamentally similar. • Release date: 2022-10-01
Who should take this exam?
This exam is typically taken by Information Risk Managers and Information Security Professionals.
- Understanding of information assurance
- Good standard of written English
- Understanding of laws affecting information risk management (e.g., Data Protection, Freedom of Information)
- Ideally 2+ years experience in information security and risk management
- Understanding of ISO 27001, ISO 27002, ISO 27005
- BCS Foundation Certificate in Information Security Management Principles (CISMP) or similar
Related practice tests
- AIDBABCS Advanced International Diploma in Business Analysis
- TM12BCS Certified Tester Advanced Level (2012)
- EC-AIBCS Essentials Certificate in Artificial Intelligence
- FC-AgileBCS Foundation Certificate in Agile
- FC-ACDBCS Foundation Certificate in Architecture Concepts and Domains