ISO 27005 RM cheat sheet

Risk is the effect of uncertainty on objectives; information security risk combines likelihood of a threat exploiting a vulnerability with the resulting impact on information assets.

ISO/IEC 27005 expresses risk qualitatively or quantitatively; the common formula is Risk = Likelihood × Impact (or consequence), with likelihood derived from threat likelihood and vulnerability exposure.

Asset, threat, vulnerability, control, consequence, and likelihood are the core risk components; risk is only meaningful when tied to an asset or business process that has value.

Residual risk is the risk remaining after controls are applied; it must be compared against the risk acceptance criteria before sign-off.

Risk appetite is the amount and type of risk an organization is willing to pursue or retain; risk tolerance is the acceptable deviation from that appetite in practice.

Risk treatment options are: mitigate (modify), retain (accept), avoid, and share (transfer); ISO/IEC 27005 treats these as the standard decision set.

Risk can be expressed as a combination of consequences and their likelihood; consequence may be measured in financial, operational, legal, or reputational terms.

Communication and consultation with stakeholders, plus continual monitoring and review, are cross-cutting principles that apply at every stage of the risk process.

Program scope must be defined first: which business units, information assets, locations, and third parties are in scope, and which are explicitly excluded.

Establish context before assessment: identify legal, regulatory, contractual, and business objectives that constrain acceptable risk.

Assign clear roles: risk owner (accountable for a specific risk), asset owner, risk assessor, and management approving the risk treatment plan.

Define risk criteria and a risk matrix (likelihood × impact scales) before assessing, so results are comparable and repeatable across assessments.

Integrate risk management with the ISMS (ISO/IEC 27001) and with enterprise risk management; risk results feed the Statement of Applicability and management review.

Set an assessment cadence: at least annually, plus on major change (new system, merger, new threat, incident) to keep the risk register current.

Maintain a risk register recording risk ID, description, asset, owner, inherent and residual rating, treatment, and review date.

Monitor and review through KPIs such as number of risks above appetite, overdue treatments, and recurring incident causes; feed results back into the cycle.

The ISO/IEC 27005 process follows: establish context → risk assessment (identification, analysis, evaluation) → risk treatment → acceptance → communication/consultation and monitoring/review throughout.

Risk identification covers assets, threats, existing controls, vulnerabilities, and consequences; outputs feed directly into risk analysis.

Risk analysis determines consequences and likelihood, then estimates the level of risk; methods may be qualitative, semi-quantitative, or quantitative.

Risk evaluation compares estimated risk against risk criteria to decide whether treatment is required or the risk can be accepted.

Risk treatment selects and implements controls, assigns residual risk, and requires risk owner approval and documented acceptance.

ISO/IEC 27005 is guidance that supports ISO/IEC 27001; it does not itself specify certifiable requirements and uses the 27001 control set (Annex A / ISO/IEC 27002) for treatment options.

Risk communication and consultation is an ongoing exchange with stakeholders, not a one-time report; it runs in parallel with all other process steps.

Monitoring and review includes verifying controls operate effectively, tracking changes in context, and updating risk assessments when assumptions change.

Qualitative methods use ordinal scales (e.g., low/medium/high) and are fast and transparent but not directly comparable in monetary terms.

Quantitative methods estimate monetary loss and annualized loss expectancy: ALE = SLE × ARO, where SLE = asset value × exposure factor.

Semi-quantitative methods assign numeric scores to qualitative scales, allowing ranking and aggregation while keeping assessment effort moderate.

FAIR (Factor Analysis of Information Risk) is a quantitative model decomposing risk into frequency and magnitude of loss events.

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a self-directed, asset-based method emphasizing business drivers and organizational workshops.

CRAMM and similar methods are asset/threat/vulnerability-driven approaches historically used in UK government contexts.

COSO ERM and ISO 31000 provide enterprise-level risk frameworks that can host information security risk assessment as a component.

Scenario-based and threat-modeling approaches (e.g., attack trees, STRIDE for design-level threats) complement asset-based assessment by focusing on how threats are realized.