ISO/IEC 27005:2022 explains how to establish context and criteria, identify and assess information security risks, choose treatment, accept residual risk, and keep the process under review.
It supports the information security risk requirements in ISO/IEC 27001. ISO/IEC 27005 does not prescribe one scoring method and is not a standalone certification standard.
Use this FAQ to make and document ISO/IEC 27005:2022 risk decisions. Start each with its scope and purpose, apply approved consequence, likelihood, evaluation, and acceptance criteria, then record treatment, residual-risk acceptance, ownership, and review triggers.
Browse sub-FAQs
Choose the question set you need
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
ISO/IEC 27005:2022 covers the full information security risk management cycle. An assessment identifies risk scenarios and owners, analyses consequence and likelihood, evaluates the result against risk criteria, and prioritizes treatment. Treatment then selects options and controls, plans implementation, evaluates the remaining risk, and obtains the required approvals.
The standard supports ISO/IEC 27001:2022 requirements. ISO/IEC 27001 sets the management-system requirements; ISO/IEC 27005 supplies guidance and examples for carrying them out. ISO/IEC 27002 provides control guidance and does not decide which controls are necessary for a particular risk.
Define the scope, purpose, internal and external context, interested-party requirements, and risk criteria before assessing scenarios.
Identify a risk owner with the accountability, authority, and knowledge needed to manage each risk.
Use a method that produces consistent, valid, comparable results, while tailoring scales and criteria to the organization's context.
Keep communication, documented information, monitoring, and review active across identification, assessment, treatment, and acceptance rather than adding them only at the end.
ISO identifies the current fourth edition, published in October 2022, as guidance for managing information security risks in support of an ISO/IEC 27001-based ISMS.
ISO identifies ISO/IEC 27001:2022 as the requirements standard for an information security management system.
Information security management systems — Requirements
2
Question 2
Which records answer common review questions?
Keep enough documented information to reproduce the decision, not merely the final score. Separate the controlled process description from result records. The process description covers criteria, method, ownership, analysis, evaluation, control selection, Annex A comparison, treatment planning, and approval. Result records connect those rules to the scenario, risk owner, control evidence, analysis, evaluation, treatment, residual-risk decision, communications, and later review.
For consequence, record the affected objectives, confidentiality, integrity, or availability loss, units or scale used, assumptions, and possible cascading effects.
For likelihood, record relevant history or statistics, threat capability and motivation where applicable, vulnerabilities, exposure, existing-control effectiveness, dependencies between events, and uncertainty.
For treatment and acceptance, record the option, necessary controls, implementation owner, expected and actual residual risk, risk-owner approval, conditions, time limits, and review trigger.
ISO/IEC 27005:2022 Clauses 7, 8, and 10 explain the assessment, treatment, documented-information, communication, monitoring, and review records summarized here.
Guidance on managing information security risks
Recommended next step for ISO/IEC 27005
Document the ISO/IEC 27005 decisions
Assign risk owners, retain assessment and treatment decisions, and set planned and event-driven reviews.
Begin with the decision that is blocked. Use the relevant topic page to collect the missing evidence, then apply the organization's approved context, method, and criteria. Route the result to risk evaluation, treatment, acceptance, or review rather than treating an FAQ answer as the decision itself.
Use asset and scenario modeling to describe the risk before estimating consequence and likelihood.
Separate the risk owner's approval of a treatment plan from the later decision to accept residual risk.
Set both a planned review date and event-driven triggers, then update the assessment and treatment when those triggers occur.
ISO/IEC 27001:2022 provides the ISMS requirements that the ISO/IEC 27005 guidance supports.
Information security management systems — Requirements
4
Question 4
Which common misunderstandings should teams avoid?
Do not treat an FAQ answer, template, or heat map as a substitute for the licensed standard or the organization's defined process. ISO/IEC 27005 permits qualitative, quantitative, and semiquantitative analysis and does not prescribe a universal scoring matrix.
Do not describe ISO/IEC 27005 guidance as legislation or as a standalone certification requirement.
Do not combine unrelated scenarios only to produce one corporate score when they require different controls.
Do not assume that sharing risk through insurance or a contract removes the organization's remaining exposure or legal duties.
Do not treat accepted risk as closed; accepted risks remain subject to monitoring and review.
ISO identifies ISO/IEC 27001 as the ISMS requirements standard.
Information security management systems — Requirements
5
Question 5
When should these answers be revisited?
Revisit the applicable decision when its assumptions or evidence change, not only when a calendar date arrives. Strategic reviews address changes in organizational context, objectives, business assets, risk sources, threats, and consequences. Operational reviews update detailed scenarios and treatment on a shorter cycle determined by the risks involved.
Schedule routine assessment early enough to support budget, procurement, and treatment implementation cycles.
Trigger review after major change, an incident, new threat or vulnerability information, unexpected control testing, changed ownership or criteria, or evidence that treatment is ineffective.
Preserve the previous decision, changed inputs, new result, owner, approval, and effect on treatment or acceptance.
ISO/IEC 27005:2022 Clauses 5.2, 9, and 10.8 support regular and change-driven review, strategic and operational cycles, and monitoring of criteria and treatment.
Guidance on managing information security risks
6
Question 6
Questions and answers
What is ISO/IEC 27005 for?
ISO/IEC 27005:2022 gives organizations of every type, size, and sector guidance for implementing information security risk management in an information security management system based on ISO/IEC 27001. It covers context, criteria, identification, analysis, evaluation, treatment, communication, documented information, monitoring, and review. It is guidance rather than legislation, does not require one risk matrix, and does not create a separate certification. A law, regulator, contract, or policy can create a separate obligation to use a standard or particular practice.
Who makes each ISO/IEC 27005 risk decision?
Top management sets and regularly reviews the organization's risk appetite. Authorized management approves the risk acceptance criteria and delegated authority levels. A risk owner has accountability and authority to manage an assigned risk and should understand the issue well enough to make informed decisions; that owner approves the treatment plan and decides whether to accept residual risk, subject to any higher-level approval required by the criteria. Control or action owners implement treatment and provide status and effectiveness evidence. Assessors and specialists support the analysis but should not approve a risk beyond their delegated authority.
Does ISO/IEC 27005 require a 5-by-5 risk matrix?
No. ISO/IEC 27005 allows qualitative, quantitative, and semiquantitative analysis and does not prescribe a 5-by-5 matrix, formula, category count, or universal threshold. The organization must establish and maintain risk acceptance criteria and criteria for performing assessments; its method should define how consequence, likelihood, and level of risk are determined and produce consistent, valid, and comparable results. Qualitative risk-level categories should have objective, non-overlapping descriptions; different scales should have an equivalency when results need comparison.
What is the difference between event-based and asset-based risk identification?
Event-based identification starts with strategic events and consequences, often drawn from management concerns, business processes, interested-party requirements, history, and expert knowledge. Asset-based identification starts with information or supporting assets, threats, and vulnerabilities and often produces more detailed control decisions. Both can describe the same causal risk scenario: event-based work usually drills down from business exposure, while asset-based work traces upward from an asset to business consequence. An organization can combine them or use another method if the results remain consistent, valid, and comparable.
What risk treatment options does ISO/IEC 27005 recognize?
For information security risk, treatment can avoid the activity, remove a risk source, change likelihood, change consequence, share risk through an agreement such as insurance or a contract, or retain risk by informed decision. Sharing does not erase the organization's remaining exposure and can be limited by legal or regulatory requirements. ISO/IEC 27005 excludes the general risk-management option of taking or increasing information security risk to pursue an opportunity. Treatment can also create new risks or change existing ones, so the resulting residual risk still needs assessment and acceptance.
Is approving a treatment plan the same as accepting residual risk?
No. The risk owner first approves a treatment plan that identifies the selected option, necessary controls, implementers, resources, timing, monitoring, and expected benefits. Residual-risk acceptance is a separate informed decision based on a follow-up consequence and likelihood assessment, expected or measured control effectiveness, and the approved acceptance criteria. If treatment is not yet implemented, label the remaining level as forecast or target residual risk. If the result is unacceptable, revise treatment or reassess instead of closing the risk.
What should a good ISO/IEC 27005 risk record include?
A useful ISO/IEC 27005 record should identify the assessment's stable ID, scope, purpose, date, method and criteria version; the risk scenario and owner; sources, assumptions and uncertainty; existing controls and their implementation and effectiveness; consequence and likelihood evidence; level of risk; evaluation against every applicable acceptance rule; treatment priority; necessary controls and plan; forecast and achieved residual risk; approvals, conditions and authority; and review history. ISO/IEC 27005 does not prescribe one form, but the record should let another reviewer reproduce how the decision was reached.
When should an ISO/IEC 27005 be updated?
ISO/IEC 27005 sets no universal annual deadline. Perform risk assessments at intervals appropriate to the information security management system and when significant changes are proposed or occur. Longer strategic cycles address changes in organizational context, objectives, business assets, risk sources, threats, and consequences; shorter operational cycles update detailed scenarios and treatment. Incidents or near misses, new threats or vulnerabilities, unexpected control-test results, changed laws or contracts, new assets, revised criteria or risk appetite, or an ineffective treatment plan can trigger an earlier review.
Official listing for ISO/IEC 27005:2022, edition 4, published October 2022, which provides guidance on the full information security risk management cycle.
ISO identifies the current fourth edition, published in October 2022, as guidance for managing information security risks in support of an ISO/IEC 27001-based ISMS.
ISO/IEC 27005:2022 Clauses 7, 8, and 10 explain the assessment, treatment, documented-information, communication, monitoring, and review records summarized here.
Show 3 more
ISO describes ISO/IEC 27005 as covering assessment, treatment, communication, monitoring, and review across the risk management cycle.
ISO identifies ISO/IEC 27005 as guidance, while the standard itself allows different assessment techniques and organization-specific criteria.
ISO/IEC 27005:2022 Clauses 5.2, 9, and 10.8 support regular and change-driven review, strategic and operational cycles, and monitoring of criteria and treatment.