ISO 27005 risk management and requirements, built into a risk method your ISMS runs on every year.

What it is

What is ISO 27005 risk management and what is it used for?

ISO/IEC 27005 is a joint ISO and IEC standard, developed by the committee responsible for information security, cybersecurity and privacy protection, that explains how to manage information security risks. It covers the whole cycle: setting the context and the criteria for judging risk, identifying risks, analysing and evaluating them, choosing how to treat them, and keeping the results current through operation, monitoring and review. It applies the principles of ISO 31000 to information security.

Its practical job is to help an organisation meet what ISO/IEC 27001 demands of risk assessment and risk treatment. ISO/IEC 27001 says the risks must be assessed and treated in a consistent, repeatable way; ISO/IEC 27005 describes how to do that well. Security managers use it to choose a method, risk owners use it to understand the decisions they sign, and ISMS auditors often meet it as the basis of the approach they are reviewing.

This page covers the guidance standard itself. The step-by-step method for an ISO/IEC 27001 risk assessment has its own guide on the ISO/IEC 27001 hub. ISO 27001 risk assessment: the step-by-step guide

Current edition. ISO/IEC 27005:2022, the fourth edition, was published in October 2022 and replaced the 2018 edition, which is withdrawn. The 2022 text is aligned with ISO/IEC 27001:2022 and ISO 31000:2018, follows the clause layout of ISO/IEC 27001:2022, introduces risk scenarios and restructures the former annexes into a single annex. Because the standard is guidance, there is no certificate and no transition deadline; a method written against the 2018 edition should simply be refreshed.

Who it is for

Who needs ISO 27005?

No one is obliged to follow ISO/IEC 27005, yet most serious information security programmes end up using it, because the risk assessment is where ISO/IEC 27001 projects most often stall. Organisations bring it to Sterling from four directions:

• A customer or enterprise buyer questions your risk process. Security questionnaires and supplier audits increasingly ask how risks are identified and who accepts them. A method aligned with ISO/IEC 27005 gives a clear, recognised answer.
• A tender asks for ISO/IEC 27001 certification. The certificate depends on a risk assessment and treatment process an auditor can follow from criteria to controls. ISO/IEC 27005 is the fastest route to one that holds up.
• A regulator expects documented security risk management. Many financial, health, telecom and public-sector rules require risks to be assessed and treated on a defined basis. Anchoring your method to an international standard makes that basis easy to explain.
• A group company or parent wants one method. Subsidiaries score risk differently and the board cannot compare them. Common criteria and a shared process built on ISO/IEC 27005 put every entity on one scale.

The benefit comes from decisions made on real risk, not from the reference to the standard.

Requirements

What are the ISO 27005 requirements?

Strictly, ISO/IEC 27005 sets no requirements of its own: it recommends. The requirements it helps you meet sit in ISO/IEC 27001, in particular the actions on information security risk in Clauses 6.1 and 8. The guidance is organised as follows, and the activities in Clauses 7 to 10 are each described by their input, action, trigger, output and guidance.

• Clause 5 Information security risk management: the overall process and how it repeats in cycles, strategic and operational.
• Clause 6 Context establishment: organisational considerations, the needs of interested parties, how risk assessment will be applied, risk criteria and the choice of method.
• Clause 7 Information security risk assessment process: identifying, analysing and evaluating risks, using event-based or asset-based identification and risk scenarios.
• Clause 8 Information security risk treatment process: selecting treatment options, determining the necessary controls, comparing them with ISO/IEC 27001:2022 Annex A, producing the Statement of Applicability and the treatment plan.
• Clause 9 Operation: performing the assessment and treatment processes in practice, at planned times and when triggered.
• Clause 10 Leveraging related ISMS processes: context, leadership, communication and consultation, documented information, monitoring and review, management review, corrective action and continual improvement.
• Annex A (informative): examples of techniques that support the risk assessment process.

Putting it into practice

How do you implement ISO 27005 risk management?

Implementing the guidance ends in a risk process that runs and records that show it, not in a certificate. Where customers or regulators want independent confirmation, the process is audited as part of an ISO/IEC 27001 certification.

1. 01
   Establish the context and the criteria.Agree the scope, the interested parties and their requirements, the scales for likelihood and consequence, and the level at which risk is accepted.
2. 02
   Gap assessment and choice of method.We review the risk work you already have against the guidance and decide, with you, between an event-based and an asset-based approach, or a mix of both.
3. 03
   Assess the risks with the people who own them.Workshops identify, analyse and evaluate the risks, and each one is recorded with a named owner and a priority.
4. 04
   Treat the risks and link them to controls.Owners choose treatment options, the necessary controls are compared with ISO/IEC 27001 Annex A, and the treatment plan and Statement of Applicability are produced.
5. 05
   Operate, review and prove it.The assessment repeats on schedule and on triggers, internal audit and management review test it, and an accredited certification body can audit it within an ISO/IEC 27001 certification.

Check the route before you sign. A certificate issued "to ISO 27005" is not an accredited certificate, because the standard is guidance; ask what it is issued against and whether your customer accepts it. For ISO/IEC 27001, confirm that the certification body is accredited for information security by an accreditation body recognised under the Global ACI arrangement. The certification buyer's checklist

Cost

How much does ISO 27005 implementation cost?

The effort depends far more on the shape of your organisation than on the guidance. A single service with a small asset base is assessed in a few workshops; a group with many systems, suppliers and entities needs common criteria agreed first. Every Sterling proposal lists each component and states everything that is included.

Timeline

How long does ISO 27005 implementation take?

As an estimate, setting up the method and completing a first assessment and treatment cycle takes about 2 to 4 months inside an existing ISMS, and 4 to 8 months when the ISMS is built at the same time. The pace is set by risk owners' availability for workshops, the time taken to approve criteria and accept residual risk, and how much treatment work the assessment reveals. After the first cycle, the assessment repeats at planned intervals and whenever a trigger such as a new system, supplier or incident calls for it.

Your engagement

What your ISO 27005 engagement includes

Every engagement runs on Sterling OS™, and each phase has a clear risk management meaning. Sterling does not certify: where a certificate is needed, an accredited certification body audits your ISO/IEC 27001 system and makes the decision.

• Design™: guided support

  Your security lead runs the process; a Sterling consultant designs the criteria and method, trains the facilitators and reviews the register and treatment plan.

• Drive™: managed support

  The alternative to Design™ when capacity is short: Sterling facilitates the workshops, writes up the register and treatment plan with your owners and carries the work to internal audit and review.

• Sustain™: after go-live or certification

  Periodic reassessments, trigger-based reviews, internal audits and preparation for customer audits or ISO/IEC 27001 surveillance.

• Automate™: Effivity

  The risk register, treatment actions, Statement of Applicability and review schedule run in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Certification decisions remain with the independent certification body.

Often combined with

Standards organisations pair with ISO/IEC 27005

• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
• CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
• CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
• Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
• DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.