ISO/IEC 27005 Risk Criteria Setup Workflow

ISO/IEC 27001:2022 clause 6.1.2 requires the organization to establish and maintain both risk acceptance criteria and criteria for performing information security risk assessments. ISO/IEC 27005:2022 explains that assessment criteria determine consequence, likelihood, and level, while acceptance criteria support decisions about whether risk is acceptable or needs further treatment.

These are international standards, not legislation. ISO/IEC 27001 states ISMS requirements and can be used for certification; ISO/IEC 27005 is supporting guidance. A law, regulator, contract, customer requirement, or internal policy can still make particular criteria or approval limits binding for the organization, so record that controlling source separately.

Keep the criteria with the method that applies them. Record scope, objectives, source requirements, scale definitions, time horizon, data and evidence rules, treatment and acceptance thresholds, delegated authority, conditional-acceptance rules, calibration cases, approval, version, effective date, review owner, and change history.

The published method should let an assessor reproduce the branch for a specific risk: determine consequence and likelihood from evidence, calculate or assign the level under the stated rule, test separate overrides and cumulative effects, compare the result with the acceptance criteria, and route the result to the named authority.

Gather the internal and external context first, including objectives, interested parties, applicable laws, regulations, contracts, policies, supplier relationships, technology, operations, and financial constraints. Draft the consequence, likelihood, level, and acceptance rules, then calibrate them with people who own the affected business and technical risks.

Use test cases that expose boundary conditions. For example, a frequently recurring low-consequence event may need evaluation as a cumulative exposure, while a risk involving legal non-compliance may require a separate rule even when its combined matrix score is below the ordinary treatment threshold. ISO/IEC 27005 also allows temporary retention above a normal threshold when authorized criteria permit it, the organization commits to treatment, and the permitted period is defined.

Do not copy a generic matrix without testing it against the organization's objectives and risk classes. Avoid labels such as "unlikely" or "major" without definitions, arithmetic that hides extreme consequences, and a single threshold that ignores duration, cumulative loss, legal or contractual constraints, or decision authority.

Review on the planned governance cycle and after changes to the ISMS scope, objectives, risk appetite, laws, regulations, contracts, suppliers, technology, operations, or threat environment. ISO/IEC 27005 sets no universal annual deadline; the organization chooses intervals appropriate to its ISMS and performs additional assessment when significant changes are proposed or occur. Recalibrate after material incidents, recurring near misses, repeated assessor disagreement, or evidence that ratings no longer match observed outcomes.