RISK-0002 Incident Escalation Failure Due to Unclear Ownership
Because incident ownership, escalation criteria, and communication paths are not prepared or rehearsed, a serious security incident may be handled slowly or inconsistently.
Risk scenarios
ISO27005 domain with 15 resources grouped for implementation and audit work.
Domain guide
What this domain covers
Risk knowledge-base entries, GRC data-model notes, and scenario-driven control/evidence relationships.
15 resources
Guide + resources
Grouped resources
Risk notes
Risk-management notes, scenarios, and GRC relationship material.
RISK-0003 Security Event Misclassification Delays Incident Response
Because reported security events are not assessed with clear criteria, a material incident may be dismissed, delayed, or escalated without the evidence needed for response.
RISK-0004 Uncoordinated Incident Response Allows Compromise to Spread
Because confirmed incidents are handled without a documented response record and authority model, containment may be delayed or inconsistent across teams.
RISK-0005 Repeat Incidents Due to Missing Lessons Learned
Because incident knowledge is not converted into corrective actions, the same failure mode may recur and leave the organization exposed to preventable incidents.
RISK-0006 Evidence Integrity Loss Due to Weak Chain of Custody
Because incident evidence is collected or stored without integrity controls, investigation, legal, regulatory, disciplinary, or audit conclusions may not be defensible.
RISK-0007 Excessive Access to Sensitive Assets Due to Weak Access Rules
Because access rules are not clearly defined, approved, and reviewed, users may have more access than their role requires across sensitive systems, data, repositories, or locations.
RISK-0008 Orphaned Identities After Role or Employment Change
Because identities are not managed through a controlled lifecycle, inactive, duplicate, stale, or shared identities may remain usable after users change roles or leave.
RISK-0009 Compromised Authentication Information Due to Weak Credential Handling
Because secret authentication information is not issued, reset, stored, and protected through controlled procedures, credentials may be exposed, reused, guessed, or misused.
RISK-0010 Stale Access Rights After Business Change
Because access rights are not reviewed, modified, and removed after role, employment, supplier, or system changes, users may retain access that is no longer justified.
RISK-0011 Unmanaged Supplier Security Exposure Due to Incomplete Supplier Inventory
Because suppliers, products, and services are not inventoried, owned, risk-tiered, and periodically reviewed, the organization may accept security exposure without knowing who is accountable or what controls apply.
RISK-0012 Supplier Access Before Security Requirements Are Agreed
Because supplier security requirements are not formally agreed before information sharing or access begins, the organization may rely on informal expectations that cannot be enforced during incidents, disputes, audits, or termination.
RISK-0013 Inherited ICT Supply Chain Compromise Through Unreviewed Dependencies
Because ICT supplier dependencies, subcontractors, hosting platforms, software components, and support parties are not identified or reviewed, a compromise or control failure outside the direct supplier may affect the organization.
RISK-0014 Supplier Service Change Without Risk Review
Because supplier service reports, security practices, incidents, and material changes are not actively reviewed, supplier risk may increase after onboarding without triggering control updates or management decisions.
RISK-0015 Cloud Governance and Exit Failure Due to Weak Cloud Service Controls
Because cloud services are not governed from acquisition through use, monitoring, change, and exit, the organization may misunderstand shared responsibility, misconfigure security controls, lose data location visibility, or fail to exit safely.
RISK-0001 Customer Data Compromise Due to Ransomware Campaign
Because of ransomware actors exploiting an unpatched VPN and weak monitoring affecting the customer database, customer data compromise and operational disruption may occur.
Deep links
Link to this domain with /research/iso27005/risk-scenarios/ . Link directly to exact notes from any resource card above.