ISO/IEC 27005 Scenario Library

ISO/IEC 27005 describes two common starting points. An event-based approach begins with strategic events and consequences drawn from management concerns, business processes, interested-party requirements, historical data, risk sources, and expert knowledge. An asset-based approach begins with assets, threats, and vulnerabilities and can support more detailed control decisions.

Both approaches can describe the same risk scenario at different levels. Event-based work often drills down from business exposure to contributing assets and risk sources; asset-based work often traces upward from a vulnerable asset to accumulated business consequences. An organization can combine them or use another identification approach if its assessment method produces consistent, valid, and comparable results. A library can connect those views without forcing every assessment to enumerate every possible combination.

For each reusable entry, record its stable ID, purpose, event- or asset-based starting point, intended scope, risk sources, event, affected information security objectives, potential consequences, assets and dependencies, suggested evidence, assumptions, exclusions, related entries, maintainer, status, version, and review date. These are practical library fields, not a prescribed ISO/IEC 27005 record format.

Keep reusable content separate from assessment results. The library can suggest questions, evidence, and possible controls, but the assessment record should hold the actual applicability decision, current controls, consequence, likelihood, risk level, risk owner, treatment, and rationale for the specific context.

Collect candidate scenarios from internal and external incidents, management and process-owner interviews, interested-party requirements, threat and vulnerability information, asset and dependency records, suppliers, and prior assessments. Write each entry as a causal description that an assessor can test, not as a topic label such as 'ransomware' or a prefilled score. For example, replace 'ransomware' with a scoped path that identifies the initial access or other cause, affected systems and information, interruption or disclosure event, operational consequence, dependencies, and controls.

During an assessment, screen the library against the defined scope. Tailor applicable entries, add newly discovered scenarios, and record why material entries were excluded. Analyse consequence and likelihood from current evidence and controls. After review, feed durable lessons back into the reusable entry without importing organization- or system-specific facts that do not generalize.

Do not copy a library entry unchanged into a register. A generic scenario is not evidence of applicability, likelihood, consequence, current controls, ownership, or treatment in a particular context. Likewise, do not use a library as a completeness claim: an unidentified risk will not enter later analysis, so assessors still need interviews, evidence, and a way to add new scenarios.

Keep related risks separate when their controls differ. ISO/IEC 27005 illustrates this with fire affecting a head office versus fire affecting an accounts function spread across several buildings, and with independent data-centre hazards such as flood, fire, power spikes, and vandalism. Those events may be aggregated for a corporate view, but treatment still needs the distinct scenarios.

Review the library on an organization-defined schedule and after incidents or near misses, material business or technology change, new assets, new or changed threats and vulnerabilities, supplier change, changed objectives or requirements, or evidence that an entry no longer leads to useful identification or treatment decisions. ISO/IEC 27005 sets no universal library-review interval; the schedule and event triggers should match the assessment process and the rate of change in its context.

A library change does not automatically change every risk. Identify assessments that used the affected entry, then let each risk owner decide whether the new event, cause, evidence, or scope requires reassessment.