What is ISO/IEC 27005?
ISO/IEC 27001 requires an organisation to define a risk assessment process, assess its information security risks and decide how to treat them, but it says little about how. ISO/IEC 27005 fills that gap. It is guidance on managing information security risks, and its current fourth edition was published in October 2022, replacing the 2018 edition and bringing the terms and structure in line with ISO/IEC 27001:2022.
What does it cover?
The guidance follows the risk management process used across ISO standards, which is set out in ISO 31000:
- establishing the context: the criteria for accepting risk and for judging likelihood and consequences;
- risk assessment: identifying, analysing and evaluating risks;
- risk treatment: choosing options, selecting controls and preparing a treatment plan, which feeds the Statement of Applicability;
- communication, monitoring and review, so the risk picture stays current.
It describes two ways of identifying risks: an event-based approach, which starts from scenarios and threats at a strategic level, and an asset-based approach, which works through assets, threats and vulnerabilities in detail. Organisations can use either or both.
Who uses it?
Anyone running an ISO/IEC 27001 management system, and risk practitioners who want a method that auditors will recognise. It suits organisations of any size because it doesn’t prescribe a single method, scoring scale or tool.
Can you certify to it?
No. ISO/IEC 27005 is guidance. An ISO/IEC 27001 auditor will check that your risk process meets the requirements in clauses 6.1 and 8 of ISO/IEC 27001, and following ISO/IEC 27005 is a recognised way to show that.
How does it relate to other frameworks?
It sits between ISO 31000, which sets general risk management principles, and ISO/IEC 27001, which sets the requirements. Its scenarios and treatment options also work well with frameworks such as the NIST Cybersecurity Framework and NIST SP 800-30.
Sources and official references
- ISO/IEC 27005:2022 Guidance on managing information security risks — ISO (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud by your own device, in the most natural English voice it has. Nothing is sent anywhere. Pick another voice or speed if you prefer.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with ISO and IEC (ISO/IEC JTC 1/SC 27).