ISO 27005 risk assessment explained simply

This guide explains the approach in six steps, with scales, a matrix and a worked example from industry. All figures in it are invented.

What ISO 27005 is and is not

Guidance. The standard gives advice and sets no requirements. There is no certification to ISO/IEC 27005; risk management is examined in the ISO/IEC 27001 audit.
The current edition. The fourth edition appeared in October 2022. It is aligned with ISO/IEC 27001:2022 and ISO 31000:2018.
Not mandatory. ISO/IEC 27001 requires a method that produces consistent and comparable results. Which one is up to you.

The key terms

Term	Meaning
Risk scenario	Sequence from the initial cause to the unwanted consequence
Risk owner	Person who decides on treatment and answers for the residual risk
Likelihood	How probable the scenario is
Consequence	How severe the damage would be
Acceptance criterion	Rule for when a risk is tolerable
Residual risk	Risk that remains after the controls

Six steps to your risk assessment

Set the context and criteria. Define the scope, scales and acceptance criteria, and put the method in writing. Top management approves the acceptance criteria.
Identify risks. Describe scenarios that threaten confidentiality, integrity or availability. Each risk gets a risk owner, usually a department head and not IT.
Analyse risks. Estimate likelihood and consequence, based on the controls that are actually in place today. Note a short justification for each value.
Evaluate risks. Compare the result with the acceptance criteria and set the order of priority.
Treat risks. Decide on the option and the controls for each risk, compare them with Annex A of ISO/IEC 27001 and draw up the risk treatment plan.
Approve the residual risk and repeat. The risk owners approve the plan and accept the residual risk. After that, you repeat the assessment at planned intervals and after significant changes.

Two ways to find risks

ISO 27005 describes two approaches, which you can use separately or together.

Event-based. You start from scenarios and the threat landscape, for example "ransomware reaches the production network". This is a strategic view and often the faster way in.
Asset-based. You start from individual assets, such as the control network of one hall, and look for their threats and vulnerabilities. This is a detailed view for operations.

For mid-sized companies we recommend starting with scenarios at the level of processes and asset groups. Workshops with the departments, past incidents and the BSI's elementary threats provide the material.

Scales everyone reads the same way

A method is good when two people reach the same result. For that the levels need concrete descriptions, and in industry they also need production downtime and safety. The table is an invented example for you to adapt.

Level	Likelihood	Consequence
1	Rare: less often than every five years	Minor: downtime under one hour
2	Possible: about every two to five years	Noticeable: downtime up to eight hours
3	Likely: about once a year	Severe: downtime up to 24 hours, contract penalty possible
4	Frequent: several times a year	Very severe: downtime over 24 hours or danger to people

The risk matrix

The product of the two levels is the risk value, and the value gives the class. A 4×4 matrix with well-described levels is often enough in practice.

Likelihood	Consequence 1	Consequence 2	Consequence 3	Consequence 4
4 Frequent	4 medium	8 high	12 very high	16 very high
3 Likely	3 low	6 medium	9 high	12 very high
2 Possible	2 low	4 medium	6 medium	8 high
1 Rare	1 low	2 low	3 low	4 medium

The acceptance criteria set who may carry what. In this example the risk owner accepts up to "medium", and from "high" upwards top management decides.

Four options for treatment

For every risk above the threshold you make a conscious decision. ISO/IEC 27001 does not list the options; these four are common:

Reduce. You implement controls that lower likelihood or consequence.
Avoid. You end the activity or the cause, such as a permanently open remote access.
Transfer. You share the risk, for example through insurance or a service provider. Responsibility stays with you.
Accept. The risk owner carries the risk consciously and with a justification.

Example: remote maintenance on the assembly line

This example is invented. An automotive supplier has only one line for a product, and the machine supplier maintains it through a permanently active access without MFA.

Scenario. Ransomware enters the control network through remote maintenance, and the line stops.
Analysis. Likelihood 3, because the access is permanently open and protected only by a password. Consequence 4, because downtime of over 24 hours triggers contract penalties.
Evaluation. The value 12 falls in the class "very high", above the threshold. Top management decides.
Treatment. Reduce: access only after approval, MFA and separation of office and production networks. The tasks get owners and due dates.
Residual risk. After implementation the new assessment gives likelihood 2 and consequence 3, so the value 6. The head of production accepts this residual risk with a justification.

Typical mistakes

Everything sits in the middle. This points to unclear scales or a reluctance to make clear statements.
Assessing the plan. Controls count once implemented, not while planned.
IT assesses alone. IT often underestimates the effect on production, and production often underestimates the likelihood of attack.
Figures without a justification. A year later nobody remembers why there is a 3.
Too many individual risks. A few well-worded scenarios achieve more than hundreds of single items.

Checklist

The method is in writing.
Scales and acceptance criteria are described and approved by top management.
The method has been tested on three to five sample risks.
Every risk has a risk owner.
Every assessment has a short justification.
Risks have been compared with the criteria and prioritised.
The risk treatment plan names controls, owners and due dates.
The risk owners have approved the plan and the residual risks.
The cycle and the triggers for repeating the assessment are set.

Risk assessment in Complass

A spreadsheet works well for a first register. History, reminders and the link to controls are where it gets laborious. In Complass the register is connected to everything you document anyway:

Method of your choice. You start from a template per ISO/IEC 27005, BSI Standard 200-3 or, with the IEC 62443 module, IEC 62443-3-2 and adapt the matrix, levels, classes and acceptance criteria. Every save is a new version.
Capture scenarios faster. The risk library holds the BSI's elementary threats and ready-made scenarios. From an asset, a vulnerability finding or an incident you create a pre-filled risk.
Three assessments. Inherent risk, residual risk with the implemented measures and target risk after all planned measures, as levels, in euros or combined.
Treatment with context. You link entries of the Statement of Applicability and create tasks in the action plan, whose progress shows on the risk.
Acceptance with rules. An authorised person approves with a justification and an expiry date. From the class you set, and always above the risk appetite, a second person agrees.
Evidence. You export the risk treatment plan and the risk assessment report directly. At the review date the portal reminds the risk owner by email.

Risk register of the demo company with key figures, risk appetite and filters — Risk register with key figures and risk appetite utilisation.

The texts of the standards are not included, because standards are protected by copyright.

Frequently asked questions

Is ISO 27005 mandatory for ISO 27001 certification?

No. The audit checks the requirements of ISO/IEC 27001, and you choose the method yourself. ISO/IEC 27005 is widely used guidance for meeting those requirements.

What is the difference between risk assessment and risk evaluation?

In the language of the standards, risk assessment covers identification, analysis and evaluation. Risk evaluation is only the last part, the comparison with the criteria. In everyday speech the terms are often used loosely for the whole process.

Qualitative or quantitative assessment?

Both are permissible. ISO 27005 covers qualitative, semi-quantitative and quantitative techniques. Many companies start with a matrix and additionally assess important risks in euros.

How often do we have to repeat the risk assessment?

ISO/IEC 27001 requires it at planned intervals and after significant changes (clause 8.2). The standard names no fixed cycle, and once a year is common. Triggers include new machines, new suppliers or an incident.

Does the method also work for NIS2?

In Germany the BSI leaves the method open and recommends orientation towards existing standards, for example BSI Standard 200-3. The results must be documented and updated regularly. In the BSI's view the BSI Act rules out blanket risk acceptance.

In a demo we show you how method, register and controls come together in Complass.

Request a demo Try it for 14 days

Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The wording of your licensed copy of the standard is authoritative.