ISO 27005 is the standard for information security risk management and a central part of ISO 27001 and an ISMS. This guide gives you a concrete, practical approach to identifying, analysing and treating risks.
What You Get in the Guide
- A step-by-step method from context and risk assessment to risk treatment and monitoring
- Five-point scales for assessing impact and likelihood
- A threat catalogue and scales for assessing the maturity of your measures
- A method for calculating a risk factor and building an overall risk picture
- A reference table for assessing business impact
What Is ISO 27005?
ISO 27005 is an international standard that provides guidance on information security risk management. ISO 27001 requires information security to be based on an assessment of the organisation’s actual risks, but does not describe in detail how that assessment should be carried out. ISO 27005 provides that guidance.
The standard contains no requirements, so you cannot be certified against it. The current version was published in 2022.
Who Is the Guide For?
The guide is for you if you work with ISO 27001, an ISMS or compliance and need a structured approach to risk management, for example in connection with NIS2 or GDPR.
The ISO 27005 Risk Management Process
The process consists of a series of steps that are repeated on an ongoing basis:
- Establish the context. Define the scope, assign responsibility, choose a risk assessment method and set the criteria that determine whether a risk is acceptable.
- Assess risks. Identify assets, vulnerabilities, threats and existing controls. Analyse likelihood and consequence, and evaluate the risk level against your criteria so you can prioritise.
- Treat risks. Decide how each risk should be handled (see the table below).
- Accept residual risk. Management approves the risk treatment plan and deliberately accepts the risk that remains.
- Communicate and monitor. Involve the right people throughout, check that the measures work and repeat the assessment at regular intervals.
Four Ways to Treat a Risk
|
Strategy |
What it means |
|
Modify |
Introduce preventive measures that reduce likelihood, or corrective measures that limit the consequence |
|
Retain |
Live with the risk, because measures are not cost-effective and the risk is within your risk appetite |
|
Avoid |
Stop the activity that creates the risk, for example using an insecure system |
|
Share |
Share the risk with others through insurance or supplier contracts. Overall responsibility stays with you |
How ISO 27005 Relates to ISO 27001
ISO 27005 supports the requirements of ISO 27001 with guidance on risk assessment, methods for selecting risk treatment, approaches to ongoing monitoring and a framework for risk communication. The outcome of your risk treatment feeds directly into your Statement of Applicability, where you justify the controls you have selected.
In NorthGRC, risk assessment starts from your registered assets and a threat catalogue. Risk is calculated from impact and likelihood for confidentiality, integrity and availability, and each assessment can be justified, so your reasoning is documented for both auditors and management.