What the standard requires and where
- 6.1.2, risk assessment: written criteria, a method that gives comparable results when repeated, risks to confidentiality, integrity and availability, and one owner per risk.
- 6.1.3, risk treatment: choose what to do with each risk, determine the controls, compare them with the 93 in Annex A, write the Statement of Applicability and obtain the owners' approval.
- 8.2 and 8.3, operation: repeat the assessment at planned intervals and when something changes, carry out the plan and keep the results.
You choose the method. ISO/IEC 27005 is the guidance that explains how to do it; it is not certifiable.
Eight steps for an SME
- Context and scope. Which processes and services are in, and what customers, contracts and laws such as data protection law require of you.
- Criteria. Likelihood and impact scales, matrix and acceptance threshold, approved by management and dated. If they are set after scoring, the result gets bent to fit.
- Scenarios. Between 8 and 15 high-level situations that worry management: our data gets encrypted, the customer database leaks, the only person who runs the systems leaves.
- Assets, only where it matters. In the most serious scenarios, go into detail: which assets are involved, what weaknesses they have and which controls exist.
- Score. Likelihood and impact of each scenario with the criteria from step 2, and comparison with the threshold.
- Treat. One decision per risk (reduce, avoid, share or accept), the necessary controls, the comparison with Annex A and a plan with an owner and a date.
- Approve. Each owner approves their plan and accepts in writing the risk that remains. Neither the consultant nor a tool accepts risks.
- Repeat. At planned intervals and when things change: a new supplier, an incident, a new system. Every round is kept.
The minimum columns of the register
Scenario, assets involved, owner (a job title, not a department), likelihood, impact, level, whether it is within the threshold, treatment decision, Annex A controls, residual risk, who accepted it and when, and next review date. If the owner or the acceptance is missing, the row is not finished.
Scenario: “Possibility of loss of availability of the orders database through malicious encryption, exploiting backups that have never been restored”. Owner: the head of production. Existing control: daily backup (Annex A 8.13). Plan: a restore test every quarter, run by whoever administers the systems, with a record. In the Statement of Applicability, control 8.13 is marked as applicable and linked to this risk.
What the auditor checks
- That the criteria are documented and approved before the first scoring.
- That every risk has an owner and that the owner has approved the plan.
- That residual risk is formally accepted.
- That every control in the Statement of Applicability can be traced to a risk, and that exclusions are justified.
- That the assessment has been repeated and earlier results are kept.
Five mistakes that keep recurring
- Building the matrix once, for the audit, and never opening it again.
- Inventorying 500 assets before having the scenarios.
- Copying the 93 controls into the Statement of Applicability without linking them to any risk.
- Naming “IT” as owner instead of a job title with authority.
- Mixing harm to the company with harm to the people the data belongs to. The second is assessed separately and belongs to privacy.
To see one risk scored from start to finish, continue with the guide How a risk is assessed, step by step. Risk, the tool The Ark of ISO offers, keeps this register with residual risk calculated and a log of every change.