ISO/IEC 27005 Foundation key terms

The potential for loss or harm to information and its supporting assets, expressed as a combination of the likelihood of a threat event occurring and the severity of its consequences.

Coordinated activities to direct and control an organization with regard to risk, covering identification, analysis, evaluation, treatment, communication and monitoring in an ongoing cycle.

The systematic process of identifying, analysing, evaluating and treating risks to information assets so that they stay within the organization's risk appetite, supported by communication and continual monitoring.

Anything that has value to the organization and therefore requires protection, including information, hardware, software, services, people, facilities and the organization's reputation.

Any collection of information, in any form or medium, that has value to the organization and is managed as part of its information security scope, such as databases, contracts or design documents.

The person or entity accountable for a specific asset, responsible for its classification, correct handling and for approving decisions about how it is protected.

The person or function that implements and operates the safeguards protecting an asset on behalf of its owner, for example an IT operations or system administration team.

A potential cause of an unwanted incident that may result in harm to a system, organization or asset, whether accidental, environmental or deliberate in nature.

An individual, group, organization or natural phenomenon with the capability and intent to exploit a vulnerability and cause harm, such as an insider, criminal group or flood.

An occurrence or situation in which a threat agent acts on a vulnerability and produces an unwanted effect on an asset or the organization.

A weakness in an asset, control, process or environment that can be exploited by one or more threats, thereby making a threat event more likely or more damaging.

A measure that modifies risk by preventing, detecting, correcting or reducing the effect of a threat event, including technical, organizational, physical and legal measures.

The outcome of an event affecting objectives, which for information security may include financial loss, operational disruption, legal penalty, reputational damage or harm to individuals.

The magnitude of harm that results from an unwanted event, often assessed on a scale such as negligible, minor, significant or severe, and used when calculating risk level.

The chance that a threat event will occur, considering the capability of threat agents, the exposure of vulnerabilities and the effectiveness of existing controls.

The magnitude of a risk, expressed as a combination of likelihood and consequence, or in terms of a qualitative, semi-quantitative or quantitative scale defined in the risk criteria.

A tool that maps likelihood against consequence on a grid so that risks can be compared and prioritized consistently according to the organization's risk criteria.

The terms of reference against which the significance of a risk is evaluated, covering risk appetite, thresholds, scales of likelihood and impact, and the way risk levels are combined.

The amount and type of risk an organization is willing to pursue or retain in order to achieve its objectives, guiding decisions about whether risk treatment is required.

The level of variation from the organization's risk appetite that it is prepared to accept, often expressed as a boundary or limit for specific categories of risk.

The risk that remains after controls have been applied or treatment decisions taken, and which must be evaluated, accepted by a risk owner and monitored over time.

The risk that exists before any controls or treatment are applied, useful as a baseline for understanding exposure and for comparing the value of planned safeguards.

The overall process of risk identification, risk analysis and risk evaluation, providing the basis for treatment decisions and for communicating risk to stakeholders.

The process of finding, recognizing and describing risks, including identifying assets, threats, vulnerabilities and existing controls, and recording them in a risk register.

The process of understanding the nature and level of risk, including considering uncertainties, determining consequences and likelihood, and estimating the resulting risk level.

The process of comparing the results of risk analysis with risk criteria to determine whether a risk is acceptable or requires treatment.

The process of selecting and implementing options to modify risk, such as avoiding, reducing, sharing or retaining it, and then evaluating whether residual risk is acceptable.

A treatment option that changes the likelihood or consequence of a risk, typically by introducing or improving controls to reduce exposure to an acceptable level.

A treatment option that eliminates the activity or condition that gives rise to a risk, for example discontinuing a service or declining a project that exceeds appetite.

A treatment option that distributes part of a risk to another party, such as through insurance, outsourcing or contractual arrangements, often called risk transfer.

A treatment option in which the organization keeps a risk, either deliberately after informed acceptance or inadvertently because the risk was not identified or treated.

An informed decision by an accountable risk owner to retain a risk without further treatment, made against defined criteria and documented with its justification.

The person or entity with the accountability and authority to manage a particular risk, including approving treatment plans and accepting residual risk on behalf of the organization.

A structured record of identified risks and their attributes, such as causes, existing controls, risk level, owner, treatment actions and status, used to track and report risk.

The continual and iterative process of exchanging information about risk between decision makers and stakeholders, ensuring that assessments are understood and used appropriately.

The formal provision of risk information to internal and external stakeholders, such as management dashboards or incident summaries, to support governance and decision making.

The continual activity of checking that controls work, that risk levels remain accurate, and that changes in assets, threats or business context are reflected in the risk assessment.

A metric used to provide early warning of increasing risk exposure, such as the number of unpatched systems or failed access attempts, tracked against defined thresholds.

A process that identifies critical business activities and estimates the consequences of their disruption over time, informing recovery priorities and risk treatment decisions.

A structured description of a possible threat event and its pathway to consequences, used to make risk analysis concrete and repeatable across an organization.