ISO 27005 RM case studies

ISO 27005 RM · Put your knowledge to work in context.

The PECB Certified ISO/IEC 27005 Risk Manager credential is issued by PECB (the Professional Evaluation and Certification Board) to individuals who pass the associated certification exam and meet the credential requirements. It demonstrates that the holder comprehends the concepts and principles of information security risk management, and that they can develop, establish, maintain and improve a risk management framework guided by ISO/IEC 27005, drawing also on the risk management principles of ISO 31000. The ISO 27005 RM case studies are 5 cases and about 3,650 words.

Two Scales, One Register: Acceptance Authority at Northgate Hospital

Northgate Regional Hospital (620 beds, 4,100 staff) runs an ISO/IEC 27001-conformant ISMS. Its risk register uses a 5×5 likelihood-impact matrix, but the radiology department has applied a 1–3 scale inherited from a clinical safety programme, and finance scores 'impact' as direct financial loss only.

725 words, about 4 min 2

Scoping a Risk Programme Under a Certification Deadline at TransBaltic Freight

TransBaltic Freight is a 2,300-employee road and rail logistics operator that has committed to ISO/IEC 27001 certification in 14 months to keep two retail customers worth 31% of revenue. It has no formal risk management: an 1,850-line asset spreadsheet, 60 depots, a five-person security team with no dedicated risk analyst, and telematics units on 400 trucks.

732 words, about 4 min 3

Interim Controls and Residual Risk on CloudLedger's Export API

CloudLedger runs a multi-tenant accounting platform for 900 small-business customers. A penetration test found an insecure direct object reference in the data-export API: by changing a tenant identifier, an authenticated user can download another tenant's ledger data.

734 words, about 4 min 4

Answering a Board Question in Euros: Method Architecture at Meridian Insurance

Meridian Insurance Group holds a qualitative ISO/IEC 27005 register of 240 risks, scored on a 5×5 matrix by three analysts across six business units. The board has asked for 'the top ten IT risks expressed in euros' to decide whether to increase the €5m security budget, and the regulator has asked how model risk is documented and challenged.

700 words, about 4 min 5

Bringing OT into Scope After the Nordhavn Water Incident

Nordhavn Water Utility supplies 1.2 million customers using SCADA-controlled pumps, pressure zones and chemical dosing, segmented from corporate IT by a firewall installed two years ago. Last year's ISO/IEC 27005 assessment explicitly excluded operational technology on the grounds that 'plant systems are engineering assets, not information assets'.

759 words, about 4 min