Use ISO 31000 to set organization-wide risk principles, governance, and a common process. Use ISO/IEC 27005 to apply that process to information-security risk and connect it to an ISO/IEC 27001 ISMS.
The standards are complementary guidelines. ISO 31000 cannot be used for certification, and ISO/IEC 27005 is not a standalone organizational certification.
Structured answer sets in this page tree.
Cited legal and guidance references.
:2018 provides organization-wide principles, a framework, and a process for managing any type of risk. ISO/IEC 27005:2022 adapts that general process to information-security risk and supports an ISO/IEC 27001 information security management system. Most organizations should use them together: align governance, authority, appetite, terminology, reporting, and escalation under ISO 31000, then use ISO/IEC 27005 for security-specific criteria, scenarios, treatment, acceptance, records, and review.
Compare purpose, scope, method, records, review, and reuse without treating voluntary guidance as a legal or standalone certification requirement.
Guidance for managing information-security risk across context, assessment, treatment, acceptance, communication, recording, monitoring, and review.
Organization-wide principles, framework, and process guidance for managing any type of risk.
| Dimension | ISO/IEC 27005 | ISO 31000 | Operational implication |
|---|---|---|---|
| Purpose and scope | Information-security risk management in support of an ISO/IEC 27001 ISMS, using a process based on . | Any type of organizational risk, with principles, a framework, and a process that can be integrated into governance and decision-making. | Use for the common enterprise architecture and ISO/IEC 27005 for security-specific application. |
| Ownership and decision authority | Each identified security risk should have an owner with enough accountability, authority, and knowledge to decide how the risk is managed. | Leadership, accountability, authority, and resources are assigned through the organization's risk framework and integrated governance. | Map enterprise decision authority to security risk owners, treatment owners, approvers, and escalation paths. |
| When to use it | Use for planned and change-driven information-security risk decisions, including ISMS planning, operations, treatment, and review. | Use when designing, integrating, evaluating, or improving organization-wide risk governance and decision-making. | Apply the method when it improves a defined decision, not merely to produce another score or report. |
| Process | Establish context and security risk criteria; identify owners and risks; analyse and evaluate risks; select treatment and controls; approve the plan and residual risk; communicate, record, monitor, and review. | Apply principles through a framework that is integrated, designed, implemented, evaluated, and improved; run the process through communication, scope/context/criteria, assessment, treatment, monitoring/review, and recording/reporting. | Align the common process, then retain ISO/IEC 27005's security and ISMS detail. |
| Evidence and records | Context, criteria, method, scenarios, owners, analysis rationale, evaluation, treatment, necessary controls, approvals, residual-risk acceptance, communication, monitoring, and review. | Enterprise risk policy and framework, criteria, accountable roles, risk assessments, treatment decisions, reports, monitoring, and improvement records. | Reuse source evidence, but label the method, assumptions, criteria, and decision each record actually supports. |
| Review cycle | Longer strategic cycles address context changes; shorter operational cycles update scenarios and treatment, with additional reviews after material change. | Integrated into ongoing governance and decision-making, with monitoring and review responsive to organizational change. | Use planned and event-driven review rather than assuming one universal annual deadline. |
| Certification and assurance limits | Guidance, not a standalone certification. ISO/IEC 27001 is the certifiable ISMS requirements standard; adopted 27005 practices can be examined as supporting evidence. | ISO explicitly states that cannot be used for certification. It can guide internal or external audit programs and provide a benchmark. | State the source of any binding, contractual, or certification requirement separately. |
| What can be reused | Context, risk statements, evidence, owners, criteria inputs, treatment records, and monitoring can be mapped where definitions remain clear. | Reuse principles, context, criteria logic, ownership, communication, review, and reporting. Add information-security scenarios, treatment detail, and ISO/IEC 27001 records where needed. | Reuse facts and evidence; do not imply equivalence of methods, scores, or conformity claims without a documented mapping. |
| Decision rule | Use ISO/IEC 27005 for information-security risk assessment, treatment, acceptance, records, and review within an ISMS. | Use for organization-wide risk principles, governance, integration, and the common process. | Use both when an ISMS must connect cleanly to enterprise risk management; document the interface and any scale mapping. |
Information-security risk management in support of an ISO/IEC 27001 ISMS, using a process based on .
Any type of organizational risk, with principles, a framework, and a process that can be integrated into governance and decision-making.
Use for the common enterprise architecture and ISO/IEC 27005 for security-specific application.
Each identified security risk should have an owner with enough accountability, authority, and knowledge to decide how the risk is managed.
Leadership, accountability, authority, and resources are assigned through the organization's risk framework and integrated governance.
Map enterprise decision authority to security risk owners, treatment owners, approvers, and escalation paths.
Use for planned and change-driven information-security risk decisions, including ISMS planning, operations, treatment, and review.
Use when designing, integrating, evaluating, or improving organization-wide risk governance and decision-making.
Apply the method when it improves a defined decision, not merely to produce another score or report.
Establish context and security risk criteria; identify owners and risks; analyse and evaluate risks; select treatment and controls; approve the plan and residual risk; communicate, record, monitor, and review.
Apply principles through a framework that is integrated, designed, implemented, evaluated, and improved; run the process through communication, scope/context/criteria, assessment, treatment, monitoring/review, and recording/reporting.
Align the common process, then retain ISO/IEC 27005's security and ISMS detail.
Context, criteria, method, scenarios, owners, analysis rationale, evaluation, treatment, necessary controls, approvals, residual-risk acceptance, communication, monitoring, and review.
Enterprise risk policy and framework, criteria, accountable roles, risk assessments, treatment decisions, reports, monitoring, and improvement records.
Reuse source evidence, but label the method, assumptions, criteria, and decision each record actually supports.
Longer strategic cycles address context changes; shorter operational cycles update scenarios and treatment, with additional reviews after material change.
Integrated into ongoing governance and decision-making, with monitoring and review responsive to organizational change.
Use planned and event-driven review rather than assuming one universal annual deadline.
Guidance, not a standalone certification. ISO/IEC 27001 is the certifiable ISMS requirements standard; adopted 27005 practices can be examined as supporting evidence.
ISO explicitly states that cannot be used for certification. It can guide internal or external audit programs and provide a benchmark.
State the source of any binding, contractual, or certification requirement separately.
Context, risk statements, evidence, owners, criteria inputs, treatment records, and monitoring can be mapped where definitions remain clear.
Reuse principles, context, criteria logic, ownership, communication, review, and reporting. Add information-security scenarios, treatment detail, and ISO/IEC 27001 records where needed.
Reuse facts and evidence; do not imply equivalence of methods, scores, or conformity claims without a documented mapping.
Use ISO/IEC 27005 for information-security risk assessment, treatment, acceptance, records, and review within an ISMS.
Use for organization-wide risk principles, governance, integration, and the common process.
Use both when an ISMS must connect cleanly to enterprise risk management; document the interface and any scale mapping.
:2018 is broad guidance for integrating risk management into governance, strategy, planning, reporting, policies, values, and culture. It can be used by any organization and for any type of risk. ISO/IEC 27005:2022 has a narrower subject: managing risks to the confidentiality, integrity, and availability of information in an ISMS context.
ISO/IEC 27005 follows the general process but adds information-security implementation detail. It covers security risk criteria and assessment methods, risk owners, event- and asset-based identification, treatment controls, residual-risk acceptance, documented information, communication, monitoring, and review.
ISO lists :2018 as the current second edition, confirmed in 2023, and also shows it at the revision stage with a replacement under development. Until a replacement is published and adopted for the organization's use, mappings should name the 2018 edition rather than referring only to "ISO 31000."
Maintain a short mapping between enterprise and information-security governance. It should identify the common risk vocabulary, objectives, appetite or acceptance criteria, decision authority, escalation thresholds, aggregation rules, reporting route, and review cycle. Record justified differences where information-security analysis needs more detail.
For each security risk, retain the scope, purpose, scenario, owner, assessment method, source evidence, uncertainty, evaluation, treatment decision, necessary controls, residual-risk acceptance, communication, and review trigger. A consolidated enterprise report should remain traceable to those underlying records.
Document shared criteria, decision authority, reporting, scale mappings, security records, and review triggers.
Assign the governance mapping, evidence requests, security decisions, escalation route, and review checkpoints.
Review your current scope, evidence gaps, and next implementation steps.
Start with the organization's -aligned objectives, governance, authority, and reporting model. Translate those into information-security risk criteria and assessment rules that satisfy the ISMS context. ISO/IEC 27005 says the security approach should align with organizational risk management so security risks can be compared with other organizational risks rather than considered in isolation.
Escalate a security risk into enterprise reporting with its scenario, time horizon, assumptions, and uncertainty intact. If enterprise and security scales differ, document an equivalence or mapping; a label such as 'high' is not automatically comparable across domains.
Do not present the standards as competing certifications. ISO states that cannot be used for certification. ISO/IEC 27005 is guidance supporting ISO/IEC 27001; following it can support an ISMS, but it does not by itself establish ISO/IEC 27001 conformity.
Do not copy an enterprise heat map into the ISMS without checking definitions, thresholds, consequence types, likelihood periods, and acceptance authority. Shared colors or numbers can conceal different meanings.
Review the mapping on a planned cycle and when enterprise governance, objectives, ISMS scope, risk appetite, acceptance authority, criteria, reporting, or either standard changes. ISO/IEC 27005 also distinguishes longer strategic updates from shorter operational updates driven by changed scenarios, threats, controls, or treatment. There is no universal annual deadline; choose a cadence appropriate to the governance and ISMS cycles and add change-driven review.
"Risk management — Guidelines"
"Information security management systems — Requirements"
"Guidance on managing information security risks"