Fundamental Concepts of Information Security Risk Management
What Domain 1 tests
This domain tests the vocabulary and principles underneath ISO/IEC 27005. Candidates must distinguish a threat from a vulnerability, explain how likelihood and consequence combine into a level of risk, and state how 27005 relates to ISO/IEC 27001 and ISO 31000.
Core definitions
- Risk - the effect of uncertainty on objectives; in information security, the potential for loss or harm expressed as a combination of consequences and likelihood.
- Threat - a potential cause of an unwanted incident (ransomware operator, insider, flood).
- Vulnerability - a weakness a threat can exploit (unpatched service, missing MFA).
- Asset - anything of value to the organization, including information, processes and reputation.
- Control - a measure that modifies risk; existing controls must be identified before likelihood is estimated.
- Risk owner - the person accountable and authorised to manage a given risk.
- Residual risk - what remains after treatment.
- Risk criteria - the terms of reference used to judge whether risk is acceptable.
Principles
27005 is guidance, not a certifiable standard: ISO/IEC 27001 Clause 6.1 carries the auditable requirements, and 27005 explains how to satisfy them. It does not mandate one methodology, one scale or one tool; qualitative, semi-quantitative and quantitative approaches are all permitted. Risk management is iterative and must be reviewed at planned intervals or when significant change occurs.
Worked example
A payroll server runs an unpatched SMB service and holds salary data. Threat: ransomware; vulnerability: missing patches; existing controls: EDR and nightly backups. Likelihood 3 × consequence 5 = 15, above the acceptance threshold of 12, so treatment is mandatory. Treatment: patch cycle plus offline, tested backups; residual 8, accepted and recorded by the payroll process owner.
Traps
- Treating threat, vulnerability and risk as synonyms.
- Estimating likelihood of the threat rather than of the incident.
- Ignoring existing controls, which inflates scores.
- Claiming 27005 certification or a mandatory control list.