Scoping a Risk Programme Under a Certification Deadline at TransBaltic Freight
TransBaltic Freight is a 2,300-employee road and rail logistics operator that has committed to ISO/IEC 27001 certification in 14 months to keep two retail customers worth 31% of revenue. It has no formal risk management: an 1,850-line asset spreadsheet, 60 depots, a five-person security team with no dedicated risk analyst, and telematics units on 400 trucks. A consultancy proposes a full asset-based ISO/IEC 27005 assessment of every asset with quantitative annualised loss expectancy modelling: €340,000 and 11 months. The CFO has approved €90,000. The operations director wants to start with the 12 customer-facing systems that generate 80% of revenue. The security manager insists the telematics and depot control systems must be included because a dispatch outage stops deliveries. The certification body will expect risk assessment and risk treatment outputs and a Statement of Applicability by month 10, with internal audit in month 11.
1. Evaluate the consultancy proposal. What is wrong with it under ISO/IEC 27005 and ISO/IEC 27001, and what would you propose instead within the budget and timeline?
Read the worked answer
The proposal sells coverage where ISO/IEC 27005 asks for sufficiency. It fails on four counts.
- Proportionality and iteration. The 27005 process is iterative: assess at the level of detail needed to support treatment decisions, then refine. Nothing requires all 1,850 assets to be analysed. The 12 revenue-critical systems plus telematics and depot control plausibly carry most of the consequence; the rest of the spreadsheet is largely commodity laptops and printers.
- Quantified loss expectancy without data. Annualised loss expectancy is asset value × exposure factor × annualised rate of occurrence. TransBaltic has no loss history, no incident cost data and no actuarial support, so the numbers would be structured guesswork presented as money - inviting false confidence and later challenge from the CFO who approved one third of the fee.
- The timeline does not close. Eleven months of assessment leaves three months for risk treatment, the Statement of Applicability, internal audit and management review. The month 10 deliverables would rest on an unfinished register.
- Capability is not transferred. A consultant-owned register leaves a five-person team unable to maintain the process after certification, which is precisely what the ongoing clause 6.1 requirements demand.
A defensible alternative: weeks 1–4 on context, scope and management-approved risk criteria; weeks 4–12 on scenario-based assessment of 40–60 risks anchored on the 12 revenue-critical systems, the telematics fleet and depot control, on a 5×5 scale with defined impact dimensions (revenue, contractual penalties, safety, regulatory, reputation), using customer audit findings and incident tickets as evidence. Allocate roughly €30,000–40,000 to method design and facilitation, €15,000–20,000 to a register tool, and the remainder to internal training and a second assessment cycle so the method survives the consultants leaving. Target the Statement of Applicability by month 8 and internal audit at month 11.
2. How should the programme be sequenced over the 14 months, and how can excluding some assets be justified to a certification body?
Read the worked answer
Sequence the work so every certification requirement is met by evidence rather than by volume of assessments.
Months 1–2: context and criteria. Management approves the ISMS scope statement (clause 4.3), identifies interested parties including the two key customers, and approves risk criteria: impact and likelihood definitions, the 5×5 combination rule, acceptance thresholds and an authority matrix.
Months 2–4: identification and analysis. Assess the prioritised scenarios and record them in one register with unique IDs, a named risk owner, existing controls, and a confidence note where evidence is weak - telematics firmware inventory, for example.
Months 4–8: treatment. Each entry gets an option (modify, retain, avoid, share), an owner, a deadline and an expected residual risk compared against the criteria. The Statement of Applicability then follows from treatment: all 93 Annex A controls listed with included or excluded and a justification referencing risk IDs. The SoA is a report of treatment decisions, not a separate exercise.
Months 9–12: operate, monitor, internal audit, management review.
Excluding assets is legitimate only when it is a decision rather than an omission. Write an asset scope statement: which systems, depots and information are in scope; which are out - depot printers, personal devices - with the criterion used (no material information processing, no dependency for an in-scope service) and management approval. Keep the excluded list under review and plan a phase-2 widening after the first surveillance audit. Never delete rows silently; an auditor will ask why the inventory shrank between versions.