Use ISO/IEC 27005:2022 for the full information-security risk cycle in an ISMS. Use NIST SP 800-30 Rev. 1 for detailed assessment of threats, vulnerabilities, likelihood, impact, and uncertainty.
NIST SP 800-30 was written for U.S. federal information systems and organizations. A non-federal organization may adopt it, but the publication alone is not a universal legal mandate or certification.
Structured answer sets in this page tree.
Cited legal and guidance references.
ISO/IEC 27005:2022 and overlap in risk assessment but have different boundaries. ISO/IEC 27005 covers context, assessment, treatment, acceptance, communication, records, monitoring, and review in support of an ISO/IEC 27001 ISMS. NIST SP 800-30 Rev. 1, published in September 2012, gives detailed U.S. federal guidance for preparing, conducting, communicating, and maintaining risk assessments at organization, mission or business-process, and information-system levels. Use the publication expected by the governing assurance context, or map NIST's assessment detail into the ISO risk-management cycle.
Compare purpose, scope, method, records, review, and reuse without treating voluntary guidance as a legal or standalone certification requirement.
Guidance for managing information-security risk across context, assessment, treatment, acceptance, communication, recording, monitoring, and review.
September 2012 risk-assessment guidance for U.S. federal information systems and organizations; other organizations may choose to use it.
| Dimension | ISO/IEC 27005 | NIST SP 800-30 Rev. 1 | Operational implication |
|---|---|---|---|
| Purpose and scope | The full information-security risk-management cycle in support of an ISO/IEC 27001 ISMS, using a process based on ISO 31000. | Preparing for, conducting, communicating, and maintaining risk assessments at organization, mission/business-process, and information-system levels. | Choose the governing context first; scope determines criteria, roles, records, and the meaning of results. |
| Ownership and decision authority | Each security risk should have an owner with enough accountability, authority, and knowledge to decide how the risk is managed. | Stakeholders depend on the assessment tier and purpose and can include senior leaders, risk executives, authorizing officials, mission or business owners, system owners, assessors, and security staff. | Map authority by function; NIST role names do not automatically equal an ISO risk owner or residual-risk approver. |
| When to use it | Use for planned and change-driven information-security risk decisions, including ISMS planning, operations, treatment, and review. | Use for initial or updated assessments that inform risk-management, authorization, and monitoring decisions at the relevant tier. | Apply the method when it improves a defined decision, not merely to produce another score or report. |
| Process | Establish context and criteria; identify owners and risks; analyse and evaluate risks; select treatment and controls; approve the plan and residual risk; communicate, record, monitor, and review. | Prepare; identify threat sources and events, vulnerabilities, and predisposing conditions; determine likelihood, impact, and risk; communicate results; and maintain the assessment. | Use NIST's assessment detail where useful, then complete treatment, acceptance, and ISMS records in the ISO process. |
| Evidence and records | Context, criteria, method, scenarios, owners, analysis rationale, evaluation, treatment, necessary controls, approvals, residual-risk acceptance, communication, monitoring, and review. | Assessment purpose and scope, assumptions and constraints, information sources, threat and vulnerability analysis, likelihood, impact, risk determination, results, and maintenance records. | Reuse source evidence, but label the method, assumptions, criteria, and decision each record actually supports. |
| Review cycle | Longer strategic cycles address context changes; shorter operational cycles update scenarios and treatment, with additional reviews after material change. | Maintain assessments in response to monitoring and change; cadence follows the organization's risk-management and authorization strategy. | Use planned and event-driven review rather than assuming one universal annual deadline. |
| Certification and assurance limits | Guidance, not a standalone certification. ISO/IEC 27001 is the certifiable ISMS requirements standard; adopted 27005 practices can be examined as supporting evidence. | A NIST Special Publication, not a certification. It is federal guidance and becomes mandatory only when an applicable law, FIPS, OMB policy, agency rule, contract, or other requirement invokes it. | State the source of any binding, contractual, or certification requirement separately. |
| What can be reused | Context, risk statements, evidence, owners, criteria inputs, treatment records, and monitoring can be mapped where definitions remain clear. | Reuse inventories, scenarios, threats, vulnerabilities, control evidence, consequence/impact data, likelihood rationale, and risk results after mapping terminology and criteria. | Reuse facts and evidence; do not imply equivalence of methods, scores, or conformity claims without a documented mapping. |
| Decision rule | Use ISO/IEC 27005 for a complete information-security risk cycle integrated with an ISMS. | Use NIST SP 800-30 when federal or contractual context expects it, or when its assessment model fits the decision. | When both apply, map NIST assessment outputs into ISO evaluation, treatment, acceptance, communication, and review. |
The full information-security risk-management cycle in support of an ISO/IEC 27001 ISMS, using a process based on ISO 31000.
Preparing for, conducting, communicating, and maintaining risk assessments at organization, mission/business-process, and information-system levels.
Choose the governing context first; scope determines criteria, roles, records, and the meaning of results.
Each security risk should have an owner with enough accountability, authority, and knowledge to decide how the risk is managed.
Stakeholders depend on the assessment tier and purpose and can include senior leaders, risk executives, authorizing officials, mission or business owners, system owners, assessors, and security staff.
Map authority by function; NIST role names do not automatically equal an ISO risk owner or residual-risk approver.
Use for planned and change-driven information-security risk decisions, including ISMS planning, operations, treatment, and review.
Use for initial or updated assessments that inform risk-management, authorization, and monitoring decisions at the relevant tier.
Apply the method when it improves a defined decision, not merely to produce another score or report.
Establish context and criteria; identify owners and risks; analyse and evaluate risks; select treatment and controls; approve the plan and residual risk; communicate, record, monitor, and review.
Prepare; identify threat sources and events, vulnerabilities, and predisposing conditions; determine likelihood, impact, and risk; communicate results; and maintain the assessment.
Use NIST's assessment detail where useful, then complete treatment, acceptance, and ISMS records in the ISO process.
Context, criteria, method, scenarios, owners, analysis rationale, evaluation, treatment, necessary controls, approvals, residual-risk acceptance, communication, monitoring, and review.
Assessment purpose and scope, assumptions and constraints, information sources, threat and vulnerability analysis, likelihood, impact, risk determination, results, and maintenance records.
Reuse source evidence, but label the method, assumptions, criteria, and decision each record actually supports.
Longer strategic cycles address context changes; shorter operational cycles update scenarios and treatment, with additional reviews after material change.
Maintain assessments in response to monitoring and change; cadence follows the organization's risk-management and authorization strategy.
Use planned and event-driven review rather than assuming one universal annual deadline.
Guidance, not a standalone certification. ISO/IEC 27001 is the certifiable ISMS requirements standard; adopted 27005 practices can be examined as supporting evidence.
A NIST Special Publication, not a certification. It is federal guidance and becomes mandatory only when an applicable law, FIPS, OMB policy, agency rule, contract, or other requirement invokes it.
State the source of any binding, contractual, or certification requirement separately.
Context, risk statements, evidence, owners, criteria inputs, treatment records, and monitoring can be mapped where definitions remain clear.
Reuse inventories, scenarios, threats, vulnerabilities, control evidence, consequence/impact data, likelihood rationale, and risk results after mapping terminology and criteria.
Reuse facts and evidence; do not imply equivalence of methods, scores, or conformity claims without a documented mapping.
Use ISO/IEC 27005 for a complete information-security risk cycle integrated with an ISMS.
Use NIST SP 800-30 when federal or contractual context expects it, or when its assessment model fits the decision.
When both apply, map NIST assessment outputs into ISO evaluation, treatment, acceptance, communication, and review.
ISO/IEC 27005:2022 supplies information-security risk-management guidance for organizations using or improving an ISO/IEC 27001 ISMS. It carries the result beyond assessment into treatment options, necessary controls, a treatment plan, owner approval, residual-risk acceptance, communication, recording, monitoring, and review.
concentrates on risk assessment within the U.S. federal risk-management framework. It prepares the assessment, identifies threat sources and events, identifies vulnerabilities and predisposing conditions, determines likelihood and impact, determines risk, communicates results, and maintains the assessment. It applies those tasks at Tier 1 for the organization, Tier 2 for mission or business processes, and Tier 3 for information systems. It does not replace the separate risk-response and authorization processes in the wider NIST framework.
Keep the assessment purpose, scope, assumptions, constraints, time frame, information sources, risk model, analysis approach, and decision recipients. For NIST-style analysis, record relevant threat sources and events, vulnerabilities and predisposing conditions, existing controls, likelihood of initiation or occurrence, likelihood of impact, impact rationale, risk determination, and uncertainty.
Map those records to the ISO/IEC 27005 risk statement, criteria, owner, evaluation, treatment options, necessary controls, plan approval, residual-risk acceptance, communication, and review trigger. Preserve the original terminology when a concept is not equivalent.
Document the terminology, scale, evidence, treatment, residual-risk authority, and review mapping.
Assign the assessment evidence, method mapping, treatment records, owner decision, and review checkpoints.
Review your current scope, evidence gaps, and next implementation steps.
Set the ISO/IEC 27005 scope, purpose, criteria, and risk owner, then use NIST SP 800-30 tasks to structure the assessment. NIST's threat-event, vulnerability, predisposing-condition, likelihood, impact, and uncertainty analysis can supply evidence for ISO risk identification and analysis.
Evaluate the result against the organization's ISO risk criteria. Then select treatment options and necessary controls, approve the treatment plan, obtain the authorized residual-risk decision, and define communication and monitoring. Record any differences in scales, time horizons, and risk models.
Do not present either publication as a universal legal mandate. NIST SP 800-30 is a Special Publication written for federal information systems and organizations; whether it is mandatory depends on the applicable federal policy or other requirement. A private organization may adopt it voluntarily.
Do not claim that a completed NIST assessment establishes ISO/IEC 27001 conformity, or that ISO terminology proves a federal authorization requirement was met. Do not hide uncertainty inside a single score: NIST allows qualitative, quantitative, and semiquantitative approaches and calls for assumptions and uncertainty to be explicit.
Maintain the assessment when monitoring reveals new threats, vulnerabilities, predisposing conditions, control changes, impacts, or uncertainty that could change the result. Also review the mapping when the organizational scope, assessment tier, risk model, assessment method, criteria, evidence sources, authorization strategy, ISMS, or assurance commitments change. Neither publication imposes one universal annual deadline.
"Information security management systems — Requirements"
"Guidance on managing information security risks"
"Guide for Conducting Risk Assessments"