I85PREP
⌘ K
ISO 27005 RM study materials
ISO 27005 RM study resources

ISO 27005 RM: Other information security risk assessment methods

ISO 27005 RM · Work through your exam, one topic at a time.

All guide sections

Other information security risk assessment methods

Domain 4 - Other assessment methods

ISO/IEC 27005 is deliberately method-agnostic: it states what a sound risk process must contain, not which calculation to use. This domain tests whether you can distinguish assessment methods and frameworks, and choose one defensibly.

Categories

  • Qualitative: descriptive scales (rare/unlikely/likely) and risk matrices. Fast and inclusive, good for screening; weak for aggregation and cost-benefit.
  • Semi-quantitative: numeric scales that are not money; useful for ranking, vulnerable to false precision.
  • Quantitative: monetary or frequency estimates, often with Monte Carlo simulation. Supports cost-benefit and portfolio comparison; demands data and effort.

Frameworks and techniques

  • NIST SP 800-30 Rev. 1: threat source × vulnerability × impact, covering adversarial and non-adversarial threats, in a nine-step process.
  • OCTAVE Allegro: asset-centred, eight steps, scoping information assets and their containers; suited to business-unit self-assessment.
  • CRAMM, EBIOS Risk Manager, MEHARI, CORAS: national and industry methodologies with their own workshop structures and scales.
  • FAIR (Open Group): decomposes risk into loss event frequency and loss magnitude, often simulated; strong for financial cyber quantification.
  • ISO/IEC 31010: catalogue of techniques - brainstorming, Delphi, structured what-if, HAZOP, FMEA, bow-tie analysis, Monte Carlo, decision trees, Bayesian networks.
  • Classic formulas: SLE = asset value × exposure factor; ALE = SLE × annualised rate of occurrence.

Worked example

An asset worth $200,000 has an exposure factor of 40%, so SLE = $80,000. It is hit twice a decade, so ARO = 0.2 and ALE = $16,000. A $6,000-per-year control cuts the ARO to 0.05, giving an ALE of $4,000 - a net annual benefit of $6,000, which justifies the spend.

Traps

Mixing qualitative and monetary outputs in one ranking; using ALE alone where safety, legal or reputational loss dominates; assuming 27005 mandates a single technique; presenting false precision from a small sample.