Search every question across sub-FAQs

Review likelihood whenever the scenario, time horizon, risk source, threat environment, exposure, vulnerability, control effectiveness, or likelihood criteria changes. Review can be strategic, operational, scheduled, or triggered by an event.

The strategic cycle covers changes in the overall context: business assets, objectives, risk sources, threats, and consequences. It should run on a longer time basis or when major changes occur and can lead to an overall update or a new assessment.

The operational cycle updates detailed assessments, scenarios, criteria, and related treatment. Its interval should be shorter and should depend on how quickly the identified risks, controls, and treatment can change. Different assessments can therefore have different review intervals.

Keep a review schedule that identifies the assessment or risk, scope, risk owner, last decision date, next planned date, trigger events, evidence owners, treatment milestones, and escalation path. The schedule should show why the interval fits the risk rather than applying one date to every entry.

The risk owner should ensure the risk is reviewed and the resulting decision is made or escalated. The ISMS or risk function can maintain the calendar and collect triggers, while evidence owners report changes and treatment owners report implementation and effectiveness.

Change the cadence when the current interval no longer detects material change before the next decision. A faster-changing threat environment, unstable controls, short treatment deadlines, frequent incidents, or time-limited acceptance can justify shorter intervals. Stable context can support a longer strategic interval if event triggers still operate.

Risk evaluation compares analysis results with risk criteria to determine whether a risk is acceptable or tolerable and whether treatment is needed. During treatment, risk acceptance criteria help determine whether the proposed treatment is sufficient or further treatment is required.

Acceptance criteria can use several thresholds, different authority levels, different classes of risk, cost-benefit considerations, and absolute or conditional rules. They can also permit short-term retention above the normal threshold when an authorized decision commits the organization to specified controls within a defined period.

The acceptance record should identify the scenario and scope, current or residual risk, applicable criteria and threshold, supporting evidence, controls considered, uncertainty, risk owner, delegated authority, rationale, decision date, conditions, expiry or review date, and event triggers.

Under ISO/IEC 27001:2022, risk owners approve treatment plans and accept residual risks. The organization should identify delegated authority for each acceptance threshold or risk class. Higher management can need to endorse a decision outside normal criteria or beyond the owner's authority.

Accepted risk is not closed. Review it at the stated date or expiry and earlier when context, objectives, scope, threat or vulnerability information, control effectiveness, incidents, ownership, evidence, treatment status, or acceptance criteria changes.

ISO/IEC 27005:2022 defines a risk owner as a person or entity with accountability and authority to manage a risk. The owner should understand the issue and be able to make informed decisions about treatment. The person's position should allow that authority to be exercised in practice.

Possible owners include top management, a security committee, process owners, functional owners, department managers, and asset owners. These are examples, not automatic assignments. Choose the owner from the risk's business consequence, organizational location, and level, then define escalation where the exposure exceeds that owner's authority.

The risk record should identify the risk, owner, organizational role, assignment date, authority, acceptance threshold or risk class, required approvals, delegated treatment powers, contributors, treatment owners, escalation route, and review trigger. Record why this owner can understand and manage the specific exposure.

The risk owner manages the assigned risk, approves the treatment plan, and decides whether residual risk is acceptable within delegated authority. Analysts can prepare assessments and treatment owners can implement controls, but those tasks do not transfer the owner's accountability.

Review ownership when personnel, organizational boundaries, process or asset ownership, risk level, scope, or delegated authority changes. Also review it when the owner cannot direct treatment, obtain resources, or make the required decision.

Information security treatment can avoid the risk by not starting or continuing the activity, remove the risk source, change likelihood, change consequences, share the risk through agreed arrangements, or retain the risk by informed decision. General risk management can also take or increase risk to pursue an opportunity, but ISO/IEC 27005 states that this is not an information security risk treatment option.

An option can create new risks or modify existing ones. Risk sharing through insurance or a contract depends on the reliability and clarity of the arrangement and can be limited, prohibited, or required by law or regulation. Risk retention still requires an informed acceptance decision.

The treatment record should identify the evaluated risk, selected option and rationale, necessary controls, control owners, resources, priorities, target dates, expected effect on likelihood or consequence, expected residual risk, dependencies, implementation status, effectiveness measures, and approvals.