I85PREP
⌘ K
ISO 27005 RM study materials
ISO 27005 RM study resources

ISO 27005 RM: Information security risk management framework and processes based on ISO/IEC 27005

ISO 27005 RM · Work through your exam, one topic at a time.

All guide sections

Information security risk management framework and processes based on ISO/IEC 27005

Domain 3 - The 27005 process

This is the engine of the exam: the ISO/IEC 27005 process, structured on ISO 31000 and aligned with ISO/IEC 27001 clause 6.1. Expect questions on step order, inputs and outputs, and on what belongs in each step.

The sequence

Communication and consultation, and monitoring and review, run across the whole cycle, alongside recording and reporting. The core steps:

  1. Context establishment - external and internal context, scope, interfaces, roles and risk criteria.
  2. Risk identification - risk sources, events, causes, consequences, existing controls, and affected assets or processes.
  3. Risk analysis - determine consequences and likelihood, then level of risk, accounting for control effectiveness and uncertainty.
  4. Risk evaluation - compare levels against criteria and decide which risks need treatment.
  5. Risk treatment - choose options, select controls, produce a treatment plan, determine residual risk, obtain formal acceptance.

Specifics worth memorising

  • Identification can be asset-based, threat-based or scenario-based; scenarios linking source → event → consequence are the most defensible.
  • Treatment options follow ISO 31000: avoid the risk, remove the source, change likelihood, change consequence, share the risk, or retain it by informed decision.
  • Controls are typically selected from ISO/IEC 27002:2022 (93 controls across organisational, people, physical and technological themes), with justification captured in the Statement of Applicability.
  • Residual risk must be accepted by a risk owner with delegated authority; acceptance without authority is not acceptance.
  • Monitoring uses indicators, incident trends and context changes to trigger reassessment.

Worked example

A hospital ERP server faces ransomware. Identification: source = criminal group; event = encryption of billing data; consequence = five days without billing plus regulatory notification. Analysis: likelihood 3/5, consequence 5/5, level 15 - high. Evaluation: above the appetite of 8, so treatment is required. Treatment: immutable offline backups and endpoint detection at €30k, reducing likelihood to 2/5 and the residual level to 10, accepted by the CIO with a review date.

Traps

Jumping to controls before evaluation; omitting context and criteria; treating the register as the treatment plan; assuming one pass is enough.