Use a well-defined qualitative method for efficient screening and communication. Use a quantitative method when numeric ranges can improve a material decision and the inputs support them. Combine methods when different decisions need different depth.
ISO/IEC 27005:2022 allows qualitative, quantitative, and semiquantitative analysis. The chosen method must still support consistent, valid, and comparable results.
Structured answer sets in this page tree.
Cited legal and guidance references.
ISO/IEC 27005:2022 does not require one calculation model. A qualitative method uses defined nonnumeric categories such as low, medium, and high. A quantitative method uses numbers whose units and proportional meaning are maintained, such as annual frequency, probability, money, downtime, or lives affected. A assigns numbers to ordered bins or categories without making them true measurements. Choose the least complex method that can support the decision, document it, calibrate it against a shared reference scale, and make repeated assessments consistent, valid, and comparable.
Compare what each method measures, when it helps, what evidence it needs, and how to avoid false precision under ISO/IEC 27005:2022.
Uses defined nonnumeric categories, such as low, medium, and high, with evidence and rationale for each assigned level.
Uses numeric estimates, often ranges or probability distributions, to express frequency, consequence, or risk.
| Dimension | Qualitative method | Quantitative method | Operational implication |
|---|---|---|---|
| Purpose and scope | Screening, prioritization, and communication where well-defined categories are sufficient for the decision. | Decisions needing meaningful numeric estimates, ranges, sensitivity analysis, or comparison of treatment costs and effects. | Choose from the decision and evidence needs, not from a belief that numbers are automatically more objective. |
| Ownership and decision authority | Assessors apply defined categories with input from people who understand the scenario; the risk owner remains accountable for the decision. | Analysts build and test estimates with data owners and subject-matter experts; the risk owner remains accountable for the decision. | Method complexity changes the evidence and skills needed, not the risk owner's authority. |
| When to use it | Use when category boundaries clearly separate the available decisions and rapid, consistent coverage matters. | Use when numeric ranges can change a material treatment, funding, insurance, acceptance, or prioritization decision. | Escalate selected scenarios from qualitative screening to quantitative analysis when added depth can change the decision. |
| Process | Define non-overlapping categories and examples, assess likelihood and consequence with evidence, explain each rating, combine them under a defined rule, and compare the result with criteria. | Define the scenario, time horizon, and units; gather data and elicited estimates; model uncertainty; calculate ranges; test sensitivity; validate; and compare with criteria. | Both methods need defined criteria, evidence, uncertainty, evaluation, treatment, acceptance, and review. |
| Evidence and records | Category definitions, boundary examples, evidence, rating rationale, combination rule, scale mapping, owner, evaluation, treatment, acceptance, and review. | Data provenance, units, distributions or ranges, assumptions, calculation or simulation logic, calibration, uncertainty, sensitivity, validation, and decision record. | Reuse source evidence, but label the method, assumptions, criteria, and decision each record actually supports. |
| Review cycle | Refresh when category definitions, scenario evidence, assessor interpretation, controls, criteria, or the decision changes. | Refresh when data, exposure, assumptions, model behavior, controls, uncertainty, time horizon, or the decision changes. | Use planned and event-driven review rather than assuming one universal annual deadline. |
| Certification and assurance limits | A qualitative method can support ISO/IEC 27001 when it produces consistent, valid, and comparable results under the organization's criteria. | A quantitative method is not automatically more conformant or reliable; its units, assumptions, data, uncertainty, and calculations must fit the decision. | State the source of any binding, contractual, or certification requirement separately. |
| What can be reused | Reuse the scope, scenarios, owners, evidence, criteria, treatment records, and review triggers. Preserve the rationale for each category. | Reuse the same governance and source evidence, adding measured units, data provenance, assumptions, ranges, model logic, and sensitivity where needed. | Reuse evidence and governance, but do not convert categories into quantities without a defensible measurement model. |
| Decision rule | Choose qualitative analysis when defined categories can separate the available decisions consistently and efficiently. | Choose quantitative analysis when meaningful numeric ranges can improve a decision enough to justify the data, skills, and effort. | Use the least complex method that supports a valid decision, and combine methods when selected scenarios need more depth. |
Screening, prioritization, and communication where well-defined categories are sufficient for the decision.
Decisions needing meaningful numeric estimates, ranges, sensitivity analysis, or comparison of treatment costs and effects.
Choose from the decision and evidence needs, not from a belief that numbers are automatically more objective.
Assessors apply defined categories with input from people who understand the scenario; the risk owner remains accountable for the decision.
Analysts build and test estimates with data owners and subject-matter experts; the risk owner remains accountable for the decision.
Method complexity changes the evidence and skills needed, not the risk owner's authority.
Use when category boundaries clearly separate the available decisions and rapid, consistent coverage matters.
Use when numeric ranges can change a material treatment, funding, insurance, acceptance, or prioritization decision.
Escalate selected scenarios from qualitative screening to quantitative analysis when added depth can change the decision.
Define non-overlapping categories and examples, assess likelihood and consequence with evidence, explain each rating, combine them under a defined rule, and compare the result with criteria.
Define the scenario, time horizon, and units; gather data and elicited estimates; model uncertainty; calculate ranges; test sensitivity; validate; and compare with criteria.
Both methods need defined criteria, evidence, uncertainty, evaluation, treatment, acceptance, and review.
Category definitions, boundary examples, evidence, rating rationale, combination rule, scale mapping, owner, evaluation, treatment, acceptance, and review.
Data provenance, units, distributions or ranges, assumptions, calculation or simulation logic, calibration, uncertainty, sensitivity, validation, and decision record.
Reuse source evidence, but label the method, assumptions, criteria, and decision each record actually supports.
Refresh when category definitions, scenario evidence, assessor interpretation, controls, criteria, or the decision changes.
Refresh when data, exposure, assumptions, model behavior, controls, uncertainty, time horizon, or the decision changes.
Use planned and event-driven review rather than assuming one universal annual deadline.
A qualitative method can support ISO/IEC 27001 when it produces consistent, valid, and comparable results under the organization's criteria.
A quantitative method is not automatically more conformant or reliable; its units, assumptions, data, uncertainty, and calculations must fit the decision.
State the source of any binding, contractual, or certification requirement separately.
Reuse the scope, scenarios, owners, evidence, criteria, treatment records, and review triggers. Preserve the rationale for each category.
Reuse the same governance and source evidence, adding measured units, data provenance, assumptions, ranges, model logic, and sensitivity where needed.
Reuse evidence and governance, but do not convert categories into quantities without a defensible measurement model.
Choose qualitative analysis when defined categories can separate the available decisions consistently and efficiently.
Choose quantitative analysis when meaningful numeric ranges can improve a decision enough to justify the data, skills, and effort.
Use the least complex method that supports a valid decision, and combine methods when selected scenarios need more depth.
ISO/IEC 27005:2022 permits qualitative analysis using defined attributes, quantitative analysis using numerical values, and semiquantitative analysis using qualitative scales with assigned values. It does not make one approach inherently more conformant. The organization documents the chosen approach and uses criteria detailed enough to produce repeatable, valid, and comparable results.
Risk levels can be qualitative, such as very high, high, medium, and low, or quantitative, such as expected monetary loss, loss of life, or market share over a stated period. Both need a reference scale understood by interested parties and periodic calibration. Qualitative levels should be unambiguous, non-overlapping, and expressed in objective language.
ISO/IEC 27005 is guidance, while ISO/IEC 27001 contains the certifiable ISMS requirements. ISO/IEC 27001 requires consistent, valid, and comparable results but does not mandate a heat map, 1-to-5 matrix, Monte Carlo simulation, or financial risk model.
For any method, record the purpose, scope, scenario, owner, time horizon, risk criteria, source evidence, assumptions, uncertainty, result, treatment decision, approval, and review trigger. Define every category, threshold, unit, and combination rule so another competent assessor can reproduce the reasoning.
For quantitative work, also retain data provenance, elicited estimates, ranges or distributions, model logic, calculation or simulation settings, sensitivity, validation, and known limitations. For qualitative work, retain the rationale and evidence behind each rating, examples anchoring the categories, and any equivalence used across different scales.
Record the scale or units, source evidence, assumptions, uncertainty, owner decision, and review triggers.
Assign the evidence, method record, treatment decision, owner approval, and review checkpoints.
Review your current scope, evidence gaps, and next implementation steps.
Start with the decision. Qualitative analysis is often enough for broad inventories, rapid screening, or communication where clear categories separate treatment priorities. Quantitative analysis is useful when the decision depends on the size and distribution of possible loss, a cost-benefit comparison, a treatment budget, or the difference between close options.
Use a combined approach when it reduces effort without hiding material risk. For example, screen a large inventory with calibrated qualitative criteria, then quantify the scenarios near an acceptance threshold or those tied to large investment decisions. Evaluate every result against approved criteria and keep the accountable risk owner separate from the analyst.
Apply an explicit branch. If well-defined categories clearly separate accept, treat, and escalate outcomes, use the qualitative method. If two options remain close, the exposure crosses a material threshold, or cost and benefit depend on the range of possible loss, quantify the selected scenario. If data are sparse, use ranges and record expert judgment and uncertainty instead of manufacturing a precise point estimate.
Numbers do not make weak evidence objective, and labels do not excuse vague reasoning. Do not multiply or average ordinal 1-to-5 ratings as if the intervals and ratios were measured quantities. Do not compare a 'high' rating from one scale with a 'high' rating from another until their definitions and thresholds are mapped.
Avoid a single-point estimate when a range would show material uncertainty. Do not buy extra precision that cannot change the decision. A rough but traceable estimate can be sufficient, while a detailed model can still be misleading when subjective judgments or unknown dependencies are hidden.
Review the method and the affected assessments when the decision, scope, criteria, data, threat conditions, controls, assumptions, time horizon, or acceptance thresholds change. Also review it when independent assessors cannot reproduce the result, when similar risks produce incomparable results, or when the model's precision does not improve the decision. ISO/IEC 27005 sets no universal annual method-review deadline; use a planned cadence and change-driven triggers appropriate to the ISMS.
"Information security management systems — Requirements"
"Guidance on managing information security risks"