ISO 27005 RM key terms

The potential for loss or harm to an organization's information and related assets, expressed as a combination of the likelihood of a threat event and its consequences. It frames risk as uncertainty of outcome affecting confidentiality, integrity, and availability objectives.

Coordinated activities to direct and control an organization with regard to risk. It covers establishing context, assessing, treating, communicating, monitoring, and reviewing risk so that decisions about information security are deliberate rather than reactive.

The overall process of risk identification, risk analysis, and risk evaluation. It produces an understanding of what could happen, how likely and severe it would be, and whether the resulting level is acceptable against defined criteria.

The process of finding, recognizing, and describing risks: identifying assets, threats, existing controls, vulnerabilities, and the events that could exploit weaknesses. Its output is a documented list of risk sources and potential consequences to feed analysis.

The process of comprehending the nature of a risk and determining its level. It examines consequences, likelihood, and any existing controls, using qualitative, semi-quantitative, or quantitative techniques to assign a comparable value to each risk.

The process of comparing analysis results with established risk criteria to decide whether a risk is acceptable or needs treatment. It prioritizes risks and determines which require action, escalation, or formal acceptance by management.

The process of selecting and implementing measures to modify risk. Options include avoiding, reducing, sharing, or retaining the risk, and the chosen option is documented in a treatment plan with owners, resources, and target dates.

The risk that remains after controls and treatment measures have been applied. It must be compared with risk acceptance criteria and formally accepted by an accountable owner, since it can never realistically be reduced to zero.

The person or entity with the accountability and authority to manage a particular risk. The owner approves treatment decisions, accepts residual risk within delegated limits, and ensures monitoring and reporting occur throughout the risk's life.

The terms of reference against which the significance of a risk is evaluated. They define scales, thresholds, appetite, and acceptance levels, and should be established before assessment begins so results are consistent and defensible.

The amount and type of risk an organization is willing to pursue or retain in order to meet its objectives. It guides decisions and should be expressed in a statement approved by top management and translated into practical thresholds.

The practical deviation from risk appetite that an organization is willing to accept in a specific area or situation. It converts broad appetite statements into measurable limits used in evaluation and monitoring.

The magnitude of a risk expressed as the combination of consequences and their likelihood. Levels are usually ranked on a scale such as low, medium, or high so that risks can be compared, prioritized, and reported consistently.

The chance that a threat event or vulnerability exploitation will occur. It considers threat capability, motivation, exposure, and the effectiveness of existing controls, and is often estimated on a defined scale during risk analysis.

The outcome or impact of an event affecting objectives, such as financial loss, operational disruption, legal penalty, or reputational damage. Consequences may be expressed qualitatively or in monetary terms and can cascade across assets and stakeholders.

The adverse effect of an event on an organization's assets or objectives, often used interchangeably with consequence in practice. It is assessed against criteria such as safety, finances, compliance, and service delivery to determine severity.

A potential cause of an unwanted incident that may result in harm to a system or organization. Threats may be natural, accidental, or deliberate, and are characterized by their source, capability, and motivation.

An individual, group, or natural force with the potential to exploit a vulnerability and cause harm. Understanding its capability, intent, and resources helps estimate the likelihood component of risk.

A weakness in an asset, control, or process that can be exploited by a threat. Vulnerabilities may be technical, procedural, or human, and are usually identified through reviews, testing, and incident analysis.

Anything that has value to the organization, including information, systems, services, people, and facilities. Assets are identified and valued because their loss or compromise gives meaning to risk and drives protection priorities.

The person accountable for the confidentiality, integrity, and availability of a specific asset, including its classification and appropriate handling. Asset owners support risk assessment by confirming asset value and acceptable use.

A measure that modifies risk by preventing, detecting, reducing, or correcting unwanted events. Controls may be technical, administrative, or physical, and their effectiveness and cost are weighed during treatment selection.

A structured record of identified risks and their attributes, such as owner, cause, controls, level, treatment status, and review dates. It is the central tool for tracking and reporting risk across the management cycle.

A documented plan specifying selected treatment options, responsibilities, resources, timelines, and expected outcomes for each risk. It is approved by risk owners and tracked to completion, with residual risk then reassessed.

An informed decision to retain a risk without further treatment, within agreed criteria. It requires an accountable owner, documented justification, and periodic review, since acceptance is valid only for a stated period and context.

The treatment option of reducing the likelihood, consequence, or both by applying controls. It is the most common option and should be proportional to the risk level and aligned with the organization's criteria.

The treatment option of eliminating the activity or condition that gives rise to a risk, for example by discontinuing a service. It removes the risk but may forfeit business benefit or create new risks elsewhere.

The treatment option of transferring part of a risk to another party, such as through insurance, outsourcing, or contractual arrangements. Accountability for the risk generally remains with the original owner even after transfer.

The treatment option of keeping a risk, either deliberately after analysis or inadvertently because the risk was not identified. Deliberate retention should be documented and consistent with acceptance criteria.

The continual and iterative process of sharing risk information with stakeholders to support informed decisions. It is two-way, ensuring that concerns, context, and expectations flow between technical teams and decision makers.

The ongoing activity of tracking risk levels, control effectiveness, and treatment progress, and verifying that assumptions remain valid. It triggers reassessment when changes occur and feeds continual improvement of the risk process.

A metric used to signal changes in an organization's risk exposure before incidents occur. Good indicators are measurable, tied to specific risks, and reviewed regularly to prompt timely management action.

The structured provision of risk information to stakeholders at defined intervals and formats. It communicates levels, trends, treatment status, and emerging risks so that governance bodies can exercise oversight and allocate resources.

A tool that plots likelihood against consequence on defined scales to derive a risk level for each scenario. It supports consistent qualitative comparison and prioritization, though its scales must be clearly defined to avoid ambiguity.

An approach that describes risk using descriptive scales such as low, medium, and high rather than precise numbers. It is fast and useful for screening and communication, but depends heavily on expert judgment and consistent scale definitions.

An approach that assigns numeric values, often monetary, to likelihood and consequence, frequently using annualized loss expectancy. It supports cost-benefit comparison of controls but requires reliable data and transparent assumptions.

The expected yearly financial loss from a risk, calculated as single loss expectancy multiplied by annualized rate of occurrence. It is a core quantitative measure used to justify security investment and compare treatment options.

The estimated monetary loss from a single occurrence of an event, combining asset value with an exposure factor. It is a building block of annualized loss expectancy in quantitative risk analysis.

A document listing the information security controls an organization has selected, with justification for inclusion or exclusion. It links risk treatment decisions to the implemented control set and supports audit and certification evidence.

The recurring activity of enhancing the risk management process and its outcomes, using monitoring results and lessons learned. It keeps the framework relevant as threats, business objectives, and technology change over time.