Guide

ISO 27001 risk assessment

The risk assessment is the engine of ISO 27001. Every control you apply, and every one you exclude, should trace back to it. Clauses 6.1.2 and 6.1.3 set out what the assessment and treatment must achieve. Here is a practical method that meets them.

• Meets clauses 6.1.2 and 6.1.3
• Links risks to Annex A and the Statement of Applicability
• Repeatable, so results are comparable year on year

What the standard requires

• Defined risk acceptance criteria and criteria for performing assessments
• Consistent, valid and comparable results when repeated
• Risks to confidentiality, integrity and availability identified, with owners
• Likelihood and consequences analysed and risk levels determined
• Risks evaluated and prioritised for treatment
• A risk treatment plan approved by risk owners, who also accept residual risk

A practical method

• List information assets or business processes in scope
• Identify threats and vulnerabilities for each
• Score likelihood and impact on a simple scale, for example 1 to 5
• Compare the score with your acceptance criteria
• Choose a treatment: modify, avoid, share or retain
• Map each treatment to the Annex A controls it uses

Common mistakes

Assessing once and never again, scoring without defined criteria, and controls in the Statement of Applicability that no risk justifies. Auditors look for the trail from risk to control to evidence.

Next steps

1. Set the criteria. Agree scoring scales and the acceptance threshold before assessing anything.
2. Assess and treat. Score risks, choose treatments and map them to controls.
3. Review on a cadence. Re-run at planned intervals and after significant change.

Frequently asked questions

Asset based or scenario based?

Either. The 2022 edition does not require an asset based approach, as long as the method is defined and repeatable.

How often should we reassess?

At planned intervals, commonly annually, and whenever significant changes occur, such as a new system or supplier.

Related guides

• ISO 27001 requirements guide, What the ISO/IEC 27001 standard requires, how Annex A works and how certification runs.
• ISO 27001 documentation, The mandatory documents and records, and the ones auditors expect in practice.

Keep risk and controls connected

The platform links each risk to its Annex A controls and evidence, so your Statement of Applicability always reflects the current assessment.