ISO 27005 RM flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Information security risk

The potential for loss or harm to information assets when a threat exploits a vulnerability, expressed as a combination of the likelihood of the event and its consequences.

Risk formula

Risk is commonly computed as likelihood multiplied by impact (consequence). Likelihood reflects threat occurrence and vulnerability exposure; impact reflects harm to confidentiality, integrity, or availability.

Residual risk

The risk that remains after controls or treatment measures have been applied. It must be compared with acceptance criteria and formally approved by the accountable risk owner.

Risk appetite

The amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives. It guides whether a given risk level is acceptable.

Risk tolerance

The acceptable variation or deviation from the stated risk appetite that an organization can withstand in practice without triggering corrective action.

Risk treatment options

The standard decision set: modify or mitigate the risk with controls, retain or accept it, avoid the activity causing it, or share or transfer it to another party.

Threat and vulnerability

A threat is a potential cause of an unwanted incident; a vulnerability is a weakness that a threat can exploit. Risk requires both, plus an asset of value.

Risk owner

The individual or entity with the accountability and authority to manage a particular risk, including approving treatment plans and accepting residual risk.

Risk register

A structured record of identified risks containing identifiers, descriptions, affected assets, owners, inherent and residual ratings, treatment actions, and review dates.

Risk criteria

The reference levels and scales against which the significance of risk is evaluated. They are defined before assessment so results are consistent and comparable.

Risk matrix

A grid mapping likelihood levels against impact levels to produce a risk rating. It makes qualitative assessments repeatable and supports prioritization decisions.

Statement of Applicability

An ISO/IEC 27001 document listing selected controls, their justification, and implementation status. It draws directly on risk assessment and treatment results.

Assessment cadence

The defined frequency for repeating risk assessments, typically at least annually and whenever significant change occurs, such as new systems, mergers, or major incidents.

Establishing context

Defining the internal and external environment, scope boundaries, legal and contractual obligations, and stakeholder objectives that constrain what risk is acceptable.

Program scope definition

Specifying which business units, assets, locations, processes, and third parties the risk management program covers, and which are explicitly excluded.

Risk management integration

Embedding information security risk management into the ISMS and enterprise risk management so outputs inform control selection, management review, and business decisions.

Risk assessment stages

ISO/IEC 27005 splits risk assessment into risk identification, risk analysis, and risk evaluation. Each stage produces outputs feeding the next.

Risk identification

The process of finding, recognizing, and describing risks by identifying assets, threats, existing controls, vulnerabilities, and potential consequences.

Risk analysis

Determining the consequences and likelihood of identified risks and combining them to estimate the level of risk using qualitative, semi-quantitative, or quantitative methods.

Risk evaluation

Comparing estimated risk levels against established risk criteria to decide whether treatment is required or the risk can be accepted as-is.

Risk treatment process

Selecting appropriate controls, implementing them, assigning residual risk, and obtaining documented approval and acceptance from the risk owner.

Communication and consultation

An ongoing exchange with stakeholders about risk throughout the process, ensuring shared understanding of decisions, criteria, and treatment outcomes.

Monitoring and review

Continuous verification that controls operate effectively, that context and assumptions remain valid, and that risk assessments are updated when changes occur.

ISO/IEC 27005 status

It is guidance supporting ISO/IEC 27001 rather than a certifiable requirements standard; it describes the risk management process and references ISO/IEC 27002 controls.

Qualitative assessment

A method using ordinal scales such as low, medium, and high. It is fast and transparent but does not produce directly comparable monetary estimates.

Quantitative assessment

A method estimating monetary loss and probabilities, often using annualized loss expectancy, giving comparable figures but requiring reliable data and more effort.

Annualized loss expectancy

ALE = SLE × ARO, where SLE is single loss expectancy (asset value × exposure factor) and ARO is the annualized rate of occurrence of the event.

Semi-quantitative assessment

A method assigning numeric scores to qualitative scales, enabling ranking and aggregation of risks while keeping assessment effort moderate compared with full quantification.

FAIR method

Factor Analysis of Information Risk is a quantitative model that decomposes risk into the frequency and magnitude of loss events, expressed in financial terms.

OCTAVE method

Operationally Critical Threat, Asset, and Vulnerability Evaluation is a self-directed, asset-based approach driven by business drivers and facilitated organizational workshops.

Threat modeling

A design-level technique identifying how threats could be realized against a system, often using attack trees or frameworks such as STRIDE, complementing asset-based assessment.

ISO 31000 relationship

ISO 31000 provides generic enterprise risk management principles and process; information security risk management under ISO/IEC 27005 can operate as a specialized component within it.