ISO/IEC 27005 Foundation cheat sheet

Risk is defined in ISO/IEC 27000 as the effect of uncertainty on objectives; in information security, it is often expressed as the potential for loss or harm resulting from a threat exploiting a vulnerability.

Information security risk management is a coordinated set of activities to direct and control an organization with regard to information security risk; it is part of overall risk management and follows the ISO 31000 principles.

Key terms: asset (anything of value to the organization), threat (potential cause of an incident), vulnerability (weakness that can be exploited), likelihood (chance of occurrence), consequence (outcome or impact), and risk level (magnitude of risk expressed as combination of likelihood and consequence).

Risk is often calculated as Risk = Likelihood × Impact; this qualitative or semi-quantitative formula helps prioritize risks, but ISO/IEC 27005 does not mandate a single formula and allows various approaches.

Risk treatment options are: risk modification (mitigation), risk retention (acceptance), risk avoidance, and risk sharing (transfer), as defined in ISO/IEC 27005 and aligned with ISO 31000.

Residual risk is the risk remaining after risk treatment; ISO/IEC 27005 requires it to be documented and accepted by risk owners.

Risk appetite is the amount and type of risk an organization is willing to pursue or retain; risk tolerance is the acceptable variation around risk appetite, and risk capacity is the maximum risk an organization can bear.

The risk management process is iterative and should be integrated into governance, decision-making, and business processes; it is not a one-time project but a continuous cycle of identification, assessment, treatment, and monitoring.

ISO/IEC 27005 provides guidelines for information security risk management and supports the requirements of ISO/IEC 27001, particularly clause 6 (planning) and clause 8 (operation) regarding risk assessment and risk treatment.

ISO/IEC 27005 describes the risk management process as a sequence of steps: context establishment, risk assessment (risk identification, risk analysis, risk evaluation), risk treatment, communication and consultation, and monitoring and review.

Context establishment defines the scope, boundaries, risk criteria (risk appetite, acceptance criteria), organizational objectives, and constraints for the risk management process.

Risk identification involves identifying assets, threats, existing controls, vulnerabilities, and consequences; it can use methods such as asset-based, threat-based, or scenario-based approaches, or a combination.

Risk analysis determines the likelihood and consequences of identified risks, considering existing controls; it can be qualitative (e.g., high/medium/low), semi-quantitative (numeric scales), or quantitative (monetary values).

Risk evaluation compares risk analysis results with risk criteria to determine which risks need treatment; risks are prioritized and decisions are made on acceptance or further action.

Risk treatment involves selecting and implementing controls (risk modification), accepting (retention), avoiding, or sharing the risk; ISO/IEC 27005 references ISO/IEC 27002 for control selection and requires a Statement of Applicability (SoA) when aligning with ISO/IEC 27001.

Communication and consultation with stakeholders should occur throughout the process to ensure risk information is shared, understood, and used in decision-making.

Monitoring and review ensure that risks, controls, and the risk management process remain effective and up to date; they include tracking changes in the environment, reviewing risk assessments, and auditing controls.

Risk assessment methodologies can be asset-based (identify assets, then threats and vulnerabilities) or process-based (focus on business processes); the choice depends on organizational context and objectives.