ISO 27005 Risk Management Guide

Purpose

This guide is the ISO/IEC 27005 view of the vault. It will grow as you provide more risk-management material.

Use it to connect:

• information security risk context;
• risk identification;
• risk analysis;
• risk evaluation;
• risk treatment;
• risk acceptance;
• communication and consultation;
• monitoring and review;
• ISO/IEC 27001 Statement of Applicability;
• ISO/IEC 27002 control guidance.

Starting notes

• ISO 27005 Knowledge Base MOC
• ISO 27005 Risk Process Notes
• ISO 27001 Implementer Auditor ISO 27005 Mapping
• A.5 Controls Implementation Audit Risk Mapping
• Asset Threat Vulnerability Risk Control Evidence Data Model
• Risk Assessment
• Risk and Control Mapping Table
• Statement of Applicability Support Table

Practical mentor view

ISO/IEC 27005 should make the risk logic behind the ISMS defensible. It is not a separate paperwork universe. It should explain why a control exists, why it is enough, why residual risk is acceptable, and why management should fund or accept the decision.

Research basis

ISO describes ISO/IEC 27005:2022 as guidance on managing information security risks that supports an ISO/IEC 27001-based ISMS. ISO also states that it covers the risk management cycle beyond risk assessment, including treatment, communication, monitoring, and review.

External references

• ISO/IEC 27005:2022 overview
• ISO/IEC 27001:2022 overview