ISO 27001 Risk Assessments

Speak to an expert

One of our qualified ISO 27001 lead implementers are ready to offer you practical advice about the best approach to take for implementing an ISO 27001 project and discuss different options to suit your budget and business needs.

ISO 27001 and ISO 27002 2022 updates

ISO/IEC 27001:2022 – the newest version of ISO 27001 – was published in October 2022.

Organisations that are certified to ISO/IEC 27001:2013 have a three-year transition period to make the necessary changes to their ISMS (information security management system).

For more information about ISO 27001:2022 and its companion standard, ISO 27002:2022, and what they mean for your organisation, please visit ISO 27001 and ISO 27002: 2022 updates

Download your copy of ISO 27001:2022 here

Download your copy of ISO 27002:2022 here

The assessment and management of information security risks is at the core of ISO 27001

Section 6.1.2 of the ISO/IEC 27001 standard states the ISO 27001 risk assessment procedure must:

Establish and maintain specific information security risk criteria.
Ensure that repeated risk assessments “produce consistent, valid and comparable results”.
Identify risks associated with the loss of confidentiality, integrity and availability of information within the information security management system’s scope.
Identify the owners of those risks.
Analyse and evaluate information security risks according to specific criteria.

Conduct error-free and compliant risk assessments with vsRisk

vsRisk is the leading ISO 27001 risk assessment software from Vigilant Software. Vigilant Software is a sister company of IT Governance.

Find out more

Speak to an ISO 27001 expert

Speak to one of our experts for more information on implementing an ISO 27001 risk assessment. Our team of experts are on hand to offer specialist advice and can help you find the best solution for your requirements. Call 01474556685 or request a call back using the form below.

Five simple steps to an effective ISO 27001 risk assessment

A risk assessment process that meets the requirements of ISO 27001:2013 should have five steps:

Establish a risk management framework

These are the rules governing how you intend to identify risks, to whom you will assign risk ownership, how the risks impact the confidentiality, integrity and availability of the information and the method of calculating the estimated impact and likelihood of the risk occurring. A formal risk assessment methodology needs to address four issues and should be approved by top management:

Baseline security criteria
Risk scale
Risk appetite
Scenario- or asset-based risk assessment

Identify risks

Identifying the risks that can affect the confidentiality, integrity and availability of information is the most time-consuming part of the risk assessment process. IT Governance recommends following an asset-based risk assessment process. Developing a list of information assets is a good place to start. It will be easiest to work from an existing list of information assets that includes hard copies of information, electronic files, removable media, mobile devices and intangibles, such as intellectual property.

Analyse risks

Identify the threats and vulnerabilities that apply to each asset. For instance, the threat could be ‘theft of mobile device’, and the vulnerability could be ‘lack of formal policy for mobile devices’. Assign impact and likelihood values based on your risk criteria.

Evaluate risks

You need to weigh each risk against your predetermined levels of acceptable risk and prioritise which risks need to be addressed in which order.

Select risk treatment options

There are four suggested ways to treat risks:

‘Avoid’ the risk by eliminating it.
‘Modify’ the risk by applying security controls.
‘Share’ the risk to a third party (through insurance or outsourced).
‘Retain’ the risk (if the risk falls within established risk acceptance criteria).

Download our free guide to risk assessments and ISO 27001

Discover the challenges you may face in the risk assessment process and learn how to produce robust and reliable results.

Download now

Applying information security controls in the risk assessment

Compiling risk reports based on the risk assessment

ISO 27001 requires the organisation to produce reports based on the risk assessment for audit and certification purposes. The following two reports are the most important:

Statement of Applicability (SoA)

The SoA should create a list of all controls as recommended by Annex A of ISO/IEC 27001:2013, together with a statement of whether or not the control has been applied and a justification for its inclusion or exclusion.
Risk treatment plan (RTP)

The RTP describes how the organisation plans to deal with the risks identified in the risk assessment.

Review, monitor and audit to continually improve the ISMS

ISO 27001 requires the organisation to continually review, update and improve the information security management system (ISMS) to ensure it is functioning optimally and adjusting to the constantly changing threat environment.

One aspect of reviewing and testing is an internal audit. This requires the ISMS manager to produce a set of reports that provide evidence that risks are being adequately treated.

An even more effective way for the organisation to obtain the assurance that its ISMS is working as intended is by obtaining accredited certification.

Find out more about our internal audit service

How an ISO 27001 risk assessment works

An ISMS is based on the outcomes of a risk assessment. Businesses need to produce a set of controls to minimise identified risks.

Controls recommended by ISO 27001 are not only technological solutions but also cover people and organisational processes. There are 114 controls in Annex A covering the breadth of information security management, including physical access control, firewall policies, security staff awareness programmes, procedures for monitoring threats, incident management processes and encryption.

Controls from Annex A fall into 14 categories:

A.5 Information security policies.
A.6 Organisation of information security.
A.7 Human resources security.
A.8 Asset management.
A.9 Access control.
A.10 Cryptography.
A.11 Physical and environmental security.
A.12 Operational security.
A.13 Communications security.
A.14 System acquisition, development and maintenance.
A.15 Supplier relationships.
A.16 Information security incident management.
A.17 Information security aspects of business continuity management.
A.18 Compliance.

Risk assessments are conducted across the whole organisation. They cover all the possible risks to which information could be exposed, balanced against the likelihood of those risks materialising and their potential impact. Once the risk assessment has been conducted, the organisation needs to decide how to manage and mitigate those risks, based on allocated resources and budget.