ISO/IEC 27005 Foundation common mistakes
ISO/IEC 27005 Foundation · Understand the traps and how to avoid them.
Treating ISO/IEC 27005 as a certifiable standard and expecting a list of mandatory 'shall' requirements, then answering questions about certification or audit conformity against 27005 itself.
Candidates come from ISO/IEC 27001 backgrounds where the standard is auditable and certifiable, and assume every ISO/IEC 27xxx document works the same way. 27005 is guidance, so its language is advisory ('should', 'can'), and questions probing its status get answered with 27001 logic.
What to do instead
Memorise the document's status explicitly: ISO/IEC 27005 is guidance for information security risk management that supports the risk-related requirements of ISO/IEC 27001; it is not a management system standard and organisations are not certified against it. When a question asks what 27005 'requires', check whether the correct answer is framed as guidance rather than a binding requirement.
Conflating risk with vulnerability or with threat, for example selecting 'the weakness in a control' as the definition of information security risk, or treating a threat source as the risk itself.
Everyday usage blurs these words, and candidates skim the stem looking for a familiar term rather than parsing the exact relationship being tested. The three-factor structure (threat, vulnerability, consequence/asset value) is easy to half-remember.
What to do instead
Drill the definitions until they are exact: risk is the effect of uncertainty on objectives, expressed in information security terms as the potential that a threat will exploit a vulnerability and cause harm to assets and the organisation. Write out one concrete example (e.g. ransomware exploiting an unpatched server holding customer data) and label threat, vulnerability, asset, likelihood, impact and risk in it before answering definition questions.
Mixing up risk criteria, risk appetite and risk tolerance, or treating 'risk criteria' as a synonym for the risk register thresholds.
The terms overlap in ordinary speech and appear in the same clauses of the standard. Candidates pick whichever sounds most managerial rather than the term the stem describes.
What to do instead
Anchor each to its function: risk criteria are the terms of reference against which the significance of risk is evaluated (including appetite, tolerance and the criteria for deciding whether risk is acceptable); risk appetite is the amount and type of risk an organisation is willing to pursue or retain; risk tolerance is the acceptable deviation from appetite. Rehearse a one-line distinction for each and match the stem's wording to the definition, not to intuition.
Skipping the context-establishment step and jumping straight to identification, or answering a process-order question with the sequence from memory of a different framework (e.g. starting at asset identification without stating scope and criteria).
Identification feels like the 'real work' and context establishment reads as administrative preamble. Candidates also import sequences from other risk frameworks they have studied, which order activities differently.
What to do instead
Learn the 27005 process as a named, ordered cycle: establish context (including basic criteria, scope and boundaries, and organisation for the risk management process), then risk assessment (identification, analysis, evaluation), risk treatment, acceptance, communication and consultation, and monitoring and review, with these last two running throughout. For any 'what comes next' item, locate the stem's current activity on that cycle before choosing.
Treating risk assessment as a single activity, so that identification, analysis and evaluation are used interchangeably in answers, or selecting 'evaluation' when the stem describes determining likelihood and consequence.
The three sub-processes are described in adjacent clauses and their outputs sound similar. Candidates match on keywords like 'assess' or 'determine' instead of on the output each sub-process produces.
What to do instead
Attach a distinct output to each: identification produces a list of risks with their sources, events, causes and potential consequences; analysis produces an understanding of the risk, including likelihood and consequence and the level of risk; evaluation compares analysis results against risk criteria to decide whether treatment is needed. Classify the stem by the output it describes, not by the verb.
Confusing the four treatment options and their boundaries, for example calling risk transfer 'acceptance with insurance', or describing avoidance when the organisation reduces likelihood through a new control.
Insurance is the textbook example of transfer, so candidates over-extend it to any sharing arrangement; and modification is the most common real-world action, so it feels like the default answer for anything that is not acceptance.
What to do instead
Fix the four options with a test each: modification changes likelihood or consequence (any control implementation); retention accepts the risk, whether informed or not; avoidance removes the activity giving rise to the risk; sharing transfers or distributes part of the risk to another party (insurance, outsourcing, contracts). Note that sharing does not remove accountability, and that acceptance is a decision, not a control. Match the stem's mechanism to the test.
Assuming every identified risk must be treated, or that acceptance is only valid when risk is already below appetite.
Training material emphasises controls and remediation, so candidates default to 'implement a control'. The standard's evaluation step explicitly allows risks to be accepted, and acceptance can follow treatment as well as precede it.
What to do instead
Remember the evaluation decision: if the risk falls within criteria it may be accepted without further action; if not, treatment options are considered, and after treatment the residual risk is compared against criteria and may be accepted. Also recall that acceptance should be formally recorded with accountability assigned. For scenario items, ask what the criteria say before assuming action is mandatory.
Treating residual risk as identical to the original assessed risk, or failing to distinguish inherent/assessed risk from residual risk in questions about what happens after controls are applied.
Both are called 'risk' and the standard's terminology around assessed versus residual risk is subtle. Candidates answer as if treatment eliminates risk or as if the number never changes.
What to do instead
State the relationship plainly: assessed risk is the level determined during analysis before treatment; residual risk is the risk remaining after treatment, and it must be compared with risk criteria and either accepted or treated further. Practise items where a control is applied and the correct answer involves re-evaluating and recording the changed level, not declaring the risk closed.
Answering communication-and-consultation or monitoring-and-review items as if they were one-off stages that happen at the end of the cycle, rather than continuous activities.
Linear diagrams and exam outlines list them as items, so candidates place them in sequence. The standard presents them as ongoing activities interacting with every other step.
What to do instead
Memorise the two 'continuous' clauses and what they cover: communication and consultation with stakeholders about risk, and monitoring and review of risk factors, the risk management process and its outcomes. For any item asking when these occur, the answer is throughout the process and at every iteration, not only after evaluation or at closure.
Choosing a qualitative, quantitative or semi-quantitative approach without reference to the stated decision context, or assuming quantitative is always the 'better' answer.
Candidates associate numbers with rigour, and many study sources present quantitative methods as advanced. The standard treats the choice as driven by context, available data and the purpose of the assessment.
What to do instead
Learn the trade-offs: qualitative approaches suit broad screening and limited data but depend on judgement; quantitative approaches give comparable figures but need reliable data and effort; semi-quantitative combines scales and numbers. Then answer by matching the stem's constraints (data availability, need for comparability, speed, stakeholder communication) to the approach, and expect the correct answer to be the one justified by context rather than the most numeric.