ISO/IEC 27005 FAQ Asset and Scenario Modeling

ISO/IEC 27005:2022 recognizes two common starting points. The event-based approach identifies strategic scenarios by considering risk sources, events, interested parties, and consequences. It can reach a useful high-level view without first cataloguing every asset. The asset-based approach inspects primary and supporting assets, threats, and vulnerabilities to build detailed operational scenarios and identify asset-specific treatment.

The approaches differ mainly in where analysis starts. Event-based work often drills down from business exposure to contributing assets; asset-based work often builds up from assets to accumulated business consequences. Use either or both, but describe each scenario as a sequence or combination of events leading from an initial cause to an unwanted consequence.

ISO/IEC 27005 is guidance supporting ISO/IEC 27001. It does not require an event-based or asset-based format, complete inventory of every possible asset-threat-vulnerability combination, named threat-modeling technique, or universal scenario template. Another identification approach is acceptable when it produces consistent, valid, and comparable results.

A useful scenario record shows the scope and purpose, affected objectives, initial cause, risk source, events, consequence, relevant assets, threats, vulnerabilities, existing controls, and dependencies. It should also identify the evidence and assumptions used to estimate consequence and likelihood.

For asset-based work, document dependencies between primary and supporting assets so the same propagated risk is not assessed twice. For event-based work, show how the risk source can use the organization's ecosystem or business processes to reach the affected business asset.

For example, flooding, fire, power spikes, and vandalism can all affect one data centre. They may be aggregated for an enterprise exposure view, but ISO/IEC 27005 says they should remain separate for treatment when each hazard needs different controls. Likewise, a personal-data loss can be a specific instance of a broader data-loss scenario when its consequences and controls differ.

Assign each identified risk to a risk owner who can understand the business consequence and direct or escalate treatment. Analysts, architects, asset owners, process owners, suppliers, and control specialists can build the scenario, but contributing evidence does not by itself make them the risk owner. The owner must have both accountability and authority and should be assigned during the assessment, not after a treatment decision is already drafted.

Review a scenario when its path, evidence, or consequence can change. Strategic review addresses changes in objectives, business assets, risk sources, interested parties, or the wider ecosystem. Operational review updates assets, threats, vulnerabilities, dependencies, control effectiveness, and treatment. ISO/IEC 27005 sets no universal annual deadline; use planned intervals appropriate to the ISMS and additional review when significant changes are proposed or occur.