ISO/IEC 27005 framework
Domain 2 - ISO/IEC 27005 framework
This domain tests what ISO/IEC 27005:2022 is, what it is not, and how its guidance supports the requirements of ISO/IEC 27001:2022. Expect questions on status, scope, terminology and the relationship between the two standards.
Core rules
- ISO/IEC 27005:2022 is guidance, not a certifiable management system standard; ISO/IEC 27001 is the certifiable requirements standard.
- It provides an information security risk management process aligned with ISO 31000:2018 and supports ISO/IEC 27001 clauses 6.1.2 (risk assessment), 6.1.3 (risk treatment), 8.2 and 8.3 (operational risk assessment and treatment).
- It is technology- and sector-neutral and does not prescribe one risk assessment methodology. Organisations may use qualitative, semi-quantitative or quantitative approaches.
- The framework links context, risk criteria, risk identification, analysis, evaluation, treatment, communication and consultation, monitoring and review, and recording and reporting.
- It can be used to build a risk process even where an organisation is not certifying an ISMS, but certification audits assess ISO/IEC 27001 requirements, not 27005 compliance.
Worked example
An organisation preparing for ISO/IEC 27001 certification already has a risk workshop and a spreadsheet. The lead mapper uses ISO/IEC 27005:2022 to define risk criteria, identify threats and vulnerabilities, analyse and evaluate risks, select treatment options, and record decisions. The ISO/IEC 27001 audit then samples the risk assessment and treatment records, the risk treatment plan and the Statement of Applicability. Reasoning: 27005 supplies the how; 27001 supplies the auditable requirements.
Traps
Calling an organisation '27005 certified'; treating 27005 guidance as mandatory text; citing it as a control catalogue (that is ISO/IEC 27002); using 2018 terminology without checking the current edition; assuming one method is prescribed.