- ClassificationCategoryInformation Security Risk ManagementDomainRisk ManagementFramework FamilyISO 27000 Series
- Regulatory ContextTypeGuidanceLegal InstrumentGuidance standardSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailInternationalPublisherInternational Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), ISO/IEC JTC 1/SC 27
- VersioningVersionFourth edition (ISO/IEC 27005:2022; replaces ISO/IEC 27005:2018)Effective DateOctober 25, 2022Issue DateOctober 25, 2022 (fourth edition)
- AdoptionAdoption ModelVoluntaryImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
ISO/IEC 27005:2022 is a paid standard sold by ISO and national standards bodies, and the text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- ISO/IEC 27005:2022 provides guidance on identifying, analyzing, evaluating, and treating information security risks in support of an ISO/IEC 27001 ISMS.
- ISO/IEC JTC 1/SC 27 published the fourth edition on October 25, 2022, replacing the 2018 edition; it is not certifiable.
- The 2022 edition aligned with ISO/IEC 27001:2022 and ISO 31000:2018, introduced risk scenarios, and contrasted event-based with asset-based risk identification.
- Organizations define risk criteria, identify risk owners, select treatment options, and produce a Statement of Applicability.
- Risk owners approve the treatment plan and accept residual risk.
Overview
ISO/IEC 27005:2022 is the international guidance standard for managing information security risks, giving organizations a process for the risk assessment and risk treatment that ISO/IEC 27001 requires. ISO and IEC published this fourth edition on October 25, 2022; it was prepared by ISO/IEC JTC 1/SC 27, cancels and replaces ISO/IEC 27005:2018, and is not a certifiable standard. Its Clause 1 says it applies to all organizations regardless of type, size or sector.
The 2022 edition aligned all guidance with ISO/IEC 27001:2022 and ISO 31000:2018, aligned its terminology with ISO 31000:2018, adjusted the structure of its clauses to the layout of ISO/IEC 27001:2022, introduced risk scenario concepts, contrasted the event-based approach with the asset-based approach to risk identification, and revised and restructured its annexes into a single Annex A (Foreword). Clauses 5 to 10 cover the risk management process, context establishment, risk assessment, risk treatment, operation and the related ISMS processes.
Organizations use it to define risk criteria (6.4), identify risks and risk owners (7.2), analyze and evaluate them (7.3 and 7.4), select treatment options and determine controls (8.2 and 8.3), compare the controls with ISO/IEC 27001:2022 Annex A and produce a Statement of Applicability (8.4 and 8.5), and obtain risk owners' approval of the treatment plan and acceptance of residual risk (8.6).
Why does it matter?
ISO/IEC 27005:2022 turns the risk requirements of ISO/IEC 27001 into a repeatable method, so security investment follows assessed risk rather than assumption. The Introduction says it gives guidance on implementing the information security risk requirements of ISO/IEC 27001, on the actions that address risks (ISO/IEC 27001:2022, 6.1 and Clause 8), and on applying ISO 31000 in the context of information security.
Key benefits include:
- Follows the ISO/IEC 27001 steps
Clauses 7 and 8 follow Clauses 6.1.2 and 6.1.3 of ISO/IEC 27001:2022 step by step, including the comparison with Annex A (8.4) and the Statement of Applicability (8.5).
- Risk scenarios and two ways to identify risks
The 2022 edition introduced risk scenario concepts and contrasts the event-based approach with the asset-based approach to risk identification (Foreword and Clause 7.2).
- Prioritized security investment
Analysis and evaluation against defined criteria (7.3 and 7.4) show which risks to treat first (7.4.2).
- Informed, defensible decisions
Documented information about processes and results (10.4) and risk owners' approval and acceptance of residual risk (8.6) give management and auditors a clear rationale.
- Aligned with ISO 31000
Terminology and guidance follow ISO 31000:2018, so information security risk can feed the organization's wider risk register.
How does it work?
Clause 5 sets out the information security risk management process (5.1) and its cycles (5.2). Clause 6 establishes the context: organizational considerations (6.1), the basic requirements of interested parties (6.2), applying risk assessment (6.3), the risk criteria (6.4) and choosing an appropriate method (6.5). Clause 7 is the risk assessment process, Clause 8 the risk treatment process, Clause 9 operation, and Clause 10 the related ISMS processes. Annex A (informative) gives examples of techniques in support of the risk assessment process.
An organization first sets its risk criteria: risk acceptance criteria (6.4.2) and the criteria for performing information security risk assessments (6.4.3). It then identifies and describes risks and identifies risk owners (7.2), analyzes consequences, likelihood and levels of risk (7.3.2 to 7.3.4), and evaluates the results against the criteria and prioritizes risks for treatment (7.4). Defined terms include risk scenario, risk source (human, environmental or technical), risk owner, risk criteria and risk appetite (3.1).
Treatment follows in Clause 8: select treatment options (8.2), determine all necessary controls (8.3), compare them with ISO/IEC 27001:2022 Annex A (8.4), produce a Statement of Applicability (8.5) and a risk treatment plan with approval by risk owners and acceptance of the residual risks (8.6). Clause 9 covers performing the assessment (9.1) and the treatment (9.2) in operation, and Clause 10 ties the process to the context of the organization, leadership, communication, documented information, monitoring and review, management review, corrective action and continual improvement.
Key Elements
- Context establishment (Clause 6)
Organizational considerations, the requirements of interested parties, and the risk criteria: risk acceptance criteria (6.4.2) and criteria for performing assessments (6.4.3).
- Risk identification (Clause 7.2)
Identifies and describes information security risks, using the event-based approach (risk sources and events), the asset-based approach (assets, threats and vulnerabilities), or both, and identifies risk owners (7.2.2).
- Risk analysis (Clause 7.3)
Assesses potential consequences (7.3.2) and likelihood (7.3.3) and determines the levels of risk (7.3.4).
- Risk evaluation (Clause 7.4)
Compares the results of risk analysis with the risk criteria (7.4.1) and prioritizes the analyzed risks for treatment (7.4.2).
- Risk treatment (Clause 8)
Treatment options (8.2), necessary controls (8.3), comparison with ISO/IEC 27001:2022 Annex A (8.4), Statement of Applicability (8.5), treatment plan, approval by risk owners and acceptance of residual risk (8.6).
- Operation (Clause 9)
Performing the information security risk assessment process (9.1) and the risk treatment process (9.2).
- Related ISMS processes (Clause 10)
Context of the organization, leadership and commitment, communication and consultation, documented information, monitoring and review, management review, corrective action and continual improvement (10.1 to 10.8).
- Techniques (Annex A, informative)
Examples of techniques in support of the risk assessment process.
What does it cover?
Clause 1 says the document provides guidance to help organizations fulfill the requirements of ISO/IEC 27001 concerning actions to address information security risks, and to perform information security risk management activities, specifically risk assessment and treatment. It applies to all organizations, regardless of type, size or sector. The Introduction names its intended users: organizations that intend to establish and implement an ISMS in accordance with ISO/IEC 27001, persons who perform or are involved in information security risk management (such as ISMS professionals and risk owners), and organizations that intend to improve their risk management process. Clause 6.5 deals with choosing an appropriate method, and Annex A gives examples of techniques.
What are its objectives?
The Introduction lists what the document provides guidance on:
Implementation of the information security risk requirements specified in ISO/IEC 27001.
Essential references within the standards developed by ISO/IEC JTC 1/SC 27 to support information security risk management activities.
Actions that address risks related to information security (ISO/IEC 27001:2022, 6.1 and Clause 8).
Implementation of the risk management guidance in ISO 31000 in the context of information security.
Detailed guidance on risk management that supplements the guidance in ISO/IEC 27003.
Framework in Context
ISO/IEC 27005:2022 is the risk management guidance in the ISO/IEC 27000 family. ISO/IEC 27000 supplies the terms and definitions (its only normative reference, Clause 2), ISO/IEC 27001:2022 sets the certifiable ISMS requirements that Clauses 7 and 8 follow, and ISO/IEC 27002:2022 is the control set that treatment plans draw on and refers to this document for risk treatment guidance (0.4). Its Foreword and Introduction tie the text to ISO 31000:2018, and the Introduction says it supplements ISO/IEC 27003. The fourth edition replaced the 2018 edition; ISO lists no amendment, corrigendum or revision under development.
Common Framework Mappings
ISO/IEC 27005:2022 is commonly mapped to ISMS, risk management and control frameworks so that one risk assessment can serve several certification and regulatory programs.
Mapped frameworks include:
ISO 27001:2022
ISO 27002:2022
ISO 27000
ISO 31000:2018
ISO 31010:2009
NIST SP 800-39
NIST 800-37 Rev.2
NIST CSF 2.0
NIST 800-53 Rev.5
ISO 27017
ISO 27018
ISO 27701
COSO ERM 2017
CIS Controls v8.1
NIST SP 800-30 Rev. 1
Open FAIR
How SmartSuite Supports ISO 27005
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Cyber & IT Risk for the information security risk register, risk criteria and treatment plans, Compliance Management to hold the controls and the Statement of Applicability linked to ISO/IEC 27001 requirements, and Internal Audit Management to test whether controls operate as intended.
Information Security Risk Register
Use Cyber & IT Risk to record risks with sources, events, assets, risk owners and levels using the consequence and likelihood scales you define (Clauses 6.4 and 7).
Risk Criteria and Owners
Keep the risk acceptance criteria and assessment criteria with owners, and schedule reassessments with reminders (Clauses 6.4.2, 6.4.3 and 7.2.2).
Evaluation and Residual Risk
Record the evaluation results, the treatment choices and the risk owners' acceptance of residual risk with timestamps and approvers (Clauses 7.4 and 8.6.3).
Treatment Plans and Control Testing
Link each treatment to the controls determined, track implementation, and test that the controls operate as intended (Clauses 8.3 and 8.6.1).
Statement of Applicability
Hold the comparison with ISO/IEC 27001:2022 Annex A and the Statement of Applicability in Compliance Management (Clauses 8.4 and 8.5).
Risk Reporting
Report risk levels, treatment progress and acceptance status to management and to certification auditors (Clauses 10.4 to 10.6).
Related frameworks
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
ISO/IEC 27000:2026 is the overview of the ISMS standards family: the concepts and principles of information security management and how ISO/IEC 27001 and related documents fit together.
ISO 31000:2018 gives guidelines on managing risk through eight principles, a framework and a process for any organization. It is not certifiable. ISO published it on February 14, 2018.
IEC 31010:2019 gives guidance on selecting and applying risk assessment techniques, and replaced the 2009 first edition in June 2019.
NIST SP 800-39 is the NIST guideline for an organization-wide information security risk program: frame, assess, respond and monitor across the organization, mission and system tiers.
Frequently Asked Questions For ISO 27005
It gives guidance on managing information security risks, specifically risk assessment and risk treatment, to help organizations fulfill the requirements of ISO/IEC 27001 for actions that address risks (Clause 1). Clause 5 sets out the process, Clauses 6 to 8 the context, assessment and treatment, and Clauses 9 and 10 operation and related ISMS processes.
No. It is a guidance document, not a set of certifiable requirements. Certification applies to the ISMS under ISO/IEC 27001, whose risk assessment and treatment requirements are in Clauses 6.1.2, 6.1.3, 8.2 and 8.3; ISO/IEC 27005 explains how to meet them.
The 2022 edition adjusted its structure to the layout of ISO/IEC 27001:2022. Clauses 7.2 to 7.4 follow the identification, analysis and evaluation steps of 27001 Clause 6.1.2, and Clauses 8.2 to 8.6 follow the treatment steps of 6.1.3: options, necessary controls, comparison with Annex A, the Statement of Applicability, the treatment plan, and approval and acceptance of residual risk by risk owners.
The 2022 edition contrasts the two approaches to risk identification (Foreword). The event-based approach starts from events and the risk sources behind them, and the asset-based approach starts from assets and their threats and vulnerabilities; the guidance is in Clause 7.2, and the 2022 edition also introduced the risk scenario concept, defined in 3.1.4 as a sequence or combination of events leading from the initial cause to the unwanted consequence.
The Foreword lists six main changes: all guidance aligned with ISO/IEC 27001:2022 and ISO 31000:2018, terminology aligned with ISO 31000:2018, the clause structure adjusted to the layout of ISO/IEC 27001:2022, risk scenario concepts introduced, the event-based approach contrasted with the asset-based approach, and the annexes revised and restructured into a single Annex A.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.