ISO 27001 Risk Assessment: From Scenarios to Priorities

What clause 6.1.2 requires in practice

Clause 6.1.2 requires a defined and applied risk assessment process with several features. It sets and maintains risk criteria covering both what level of risk is acceptable and how assessments are carried out. It must give consistent, valid and comparable results when repeated.

The process then does four things. It identifies risks that could compromise the confidentiality, integrity or availability of information inside the ISMS scope, and names a risk owner for each. It analyses those risks by considering the consequences if they happened, how likely they realistically are and what level of risk results. It evaluates them by comparing results with the criteria, and it ranks the analysed risks for treatment.

The organisation must keep documented information about the process itself. The standard does not require a particular scale, matrix or tool. Its output is a method that two competent people could follow and reach similar answers.

Set the decision rules before assigning scores

Risk criteria include acceptance criteria and the criteria for performing assessments. A useful method explains what a consequence level means and how likelihood is considered. Without shared definitions, one assessor's “high” can represent another assessor's “moderate,” making comparisons unreliable.

ISO 27001 does not prescribe a universal numerical matrix. Qualitative, quantitative or combined approaches can be appropriate if they meet the required characteristics. Avoid numerical precision unsupported by evidence. A score of 12 instead of 10 is not inherently more meaningful than a well-explained judgement based on service exposure, credible events and consequences.

Why a repeatable risk method matters

A risk assessment is only useful if leaders trust it enough to act on it. Inconsistent scoring, borrowed scenarios and unclear ownership lead to disputes about priorities, and decisions revert to whoever argues loudest. A defined method gives managers a common language, makes year-to-year comparison possible and lets the organisation show customers why certain controls were chosen. It also keeps effort proportionate, because low-ranked items can be accepted knowingly instead of being quietly ignored. When incidents occur, a documented method helps explain whether the risk had been considered, which matters for both learning and accountability.

How to implement clause 6.1.2

Choose a method simple enough for your teams to apply consistently. One approach Sterling teams use is to test the method on a single service before rolling it out.

1. Decide what counts as acceptable risk and how consequence and likelihood will be described in your business.
2. Write down the steps of the method, so someone else can repeat it.
3. Select the information, services and assets within scope, and brainstorm scenarios that threaten confidentiality, integrity or availability.
4. Assign each risk to an owner who has authority over the affected area.
5. Analyse consequence and likelihood, determine levels and compare them with the criteria to rank priorities.
6. Test consistency by having two assessors score the same scenarios, then refine the method and keep the records.
7. Review the method after the first full cycle, asking owners whether the criteria and scales helped them decide, and simplify any step that produced effort without improving the quality of decisions.

Evidence an auditor expects for clause 6.1.2

Auditors look for proof that the method exists and is applied, not only for a completed register.

• Records describing the risk criteria and how acceptance is decided.
• Assessment records showing identified risks, owners, analysis and priorities.
• Interviews with risk owners who can explain their risks and why they are rated as they are.
• Observation of consistency, such as similar risks scored similarly across teams.
• Evidence that the assessment is revisited when circumstances change.

A walkthrough of one scenario, from identification to evaluation, usually shows quickly whether the described method is real.

Common nonconformities with clause 6.1.2

Risk assessment findings usually come from method, ownership or coverage gaps.

Assessors tend to trace a single risk from identification to priority, so gaps in the chain are found quickly.

• Criteria missing or never applied, so scores cannot be justified.
• Risks recorded without owners, or owners who are unaware of them.
• Assessment that covers technology but ignores information held in paper, people or supplier arrangements within scope.
• Results that cannot be reproduced because the method is unwritten.
• Priorities that do not drive any treatment decision.

Example: a BPO customer export

Example: manufacturing production data integrity

A manufacturer receives approved product settings from engineering and transfers them into production equipment. An outdated file could lead to the wrong settings being used. The information security issue includes integrity and availability, even when the data is not especially confidential.

Assessment can examine how versions move, who authorises changes, what happens during network interruption and how operators verify the current setting. Consequences may include rejected output, interrupted production and customer failure. A method centred only on stolen personal data would miss this important information-dependent process.

This example does not mean every production problem belongs in the ISMS. The organisation should connect the scenario with its scope and information security objectives, while coordinating with other operational risk arrangements.

Analyse, evaluate and prioritise transparently

Clause 6.1.2 separates understanding consequences and realistic likelihood from comparing the resulting risk against criteria and prioritising treatment. Keep that reasoning visible. Existing controls can affect the assessment, but assumptions about them should be supported. A recovery capability that has never been exercised should not receive the same confidence as one with relevant evidence.

Acceptance criteria do not override applicable legal or contractual requirements. Nor should an attractive average score hide a consequence that requires separate attention. Explain uncertainty, especially where a new service lacks operating history. That allows decision-makers to request evidence or apply precautionary measures proportionately.

Retain the method and connect reassessment to operation

Clause 6.1.2 requires documented information about the process. Clause 8.2 requires assessments at planned intervals and when significant changes are proposed or occur, with retained results. Together, these establish a repeatable method and its operational use. A practical comparison between assessments should explain changed assumptions as well as changed scores.

An auditor may follow one risk from the business scenario through the criteria, analysis, owner and treatment priority. Common weaknesses include unexplained scores, duplicate risks with inconsistent ownership and registers that do not change after major service changes.