Information security risks are constantly changing. Cyberattacks, unauthorized access, human error, system failures, data breaches, and third-party vulnerabilities can all affect an organization’s information assets.
ISO/IEC 27001:2022 requires organizations to establish a systematic approach for identifying, analysing, evaluating, and treating information security risks.
In this step-by-step guide, we explain the ISO 27001 risk assessment process, including how to identify information security risks, assess likelihood and impact, use a risk matrix, select appropriate risk treatment options, evaluate residual risk, and connect the process with the Statement of Applicability.
Watch: ISO 27001 Risk Assessment Step-by-Step
Watch our practical video guide below to understand the ISO 27001 risk assessment process.
What Is an ISO 27001 Risk Assessment?
An ISO 27001 risk assessment is a structured process used to identify, analyse, evaluate, and manage information security risks that could affect an organization’s information assets.
The purpose of the risk assessment is to understand what could go wrong, how likely it is to happen, what the potential impact could be, and what actions are required to reduce the risk to an acceptable level.
A typical information security risk assessment considers:
Assets → Threats → Vulnerabilities → Risks → Controls → Residual Risks
The objective is not necessarily to eliminate every risk. Instead, the organization should understand its risks, determine which risks are acceptable, and implement appropriate treatment measures for risks that require action.
ISO 27001 Risk Assessment Requirements
1. Establish Risk Criteria
Define how information security risks will be assessed and establish criteria for determining whether a risk can be accepted.
2. Identify Information Security Risks
Identify risks associated with the loss of confidentiality, integrity, and availability of information within the scope of the Information Security Management System (ISMS).
3. Identify Risk Owners
Identify appropriate risk owners who are responsible for the identified information security risks.
4. Analyse the Risks
Assess the potential consequences and likelihood of identified risks and determine their level of risk.
5. Evaluate the Risks
Compare the analysed risks against the organization’s established risk criteria and prioritize risks that require treatment.
Assets, Threats and Vulnerabilities in ISO 27001 Risk Assessment
An effective ISO 27001 risk assessment starts by understanding the relationship between information assets, threats, and vulnerabilities. These elements help an organization identify realistic information security risk scenarios.
Information Assets
An asset is anything that has value to the organization and needs appropriate protection. Examples include customer information, employee data, servers, laptops, applications, cloud systems, networks, databases, intellectual property, and business-critical information.
Threats
A threat is an event or circumstance that could cause harm to an information asset. Examples include cyberattacks, malware, phishing, unauthorized access, equipment failure, human error, theft, and natural disasters.
Vulnerabilities
A vulnerability is a weakness that could potentially be exploited by a threat. Examples include weak passwords, missing security patches, inadequate access controls, incorrect system configurations, insufficient employee awareness, and outdated software.
A simple way to understand the relationship is:
Asset + Threat + Vulnerability = Information Security Risk
How to Analyse Risk Using Likelihood and Impact
After information security risks have been identified, the organization needs to analyse them consistently. A commonly used approach is to evaluate two factors: likelihood and impact.
Likelihood considers how likely it is that a particular risk event will occur. Impact considers how serious the consequences could be if the event occurs.
Example Likelihood Scale
1 – Rare
2 – Unlikely
3 – Possible
4 – Likely
5 – Almost Certain
Example Impact Scale
1 – Insignificant
2 – Minor
3 – Moderate
4 – Major
5 – Severe
A simple method of calculating a risk score is:
Risk Score = Likelihood × Impact
Using a 5×5 Risk Matrix
A 5×5 risk matrix provides a visual method for evaluating and prioritizing information security risks. The likelihood score and impact score are combined to determine the overall risk level.
Depending on the organization’s established risk criteria, the resulting risk may be categorized as Low, Medium, High, or Critical. Organizations should define their own risk acceptance criteria and determine which risk levels require treatment.
ISO 27001 Risk Treatment Process
Once information security risks have been identified, analysed, and evaluated, the next step is to determine how unacceptable risks will be treated. Risk treatment involves selecting appropriate actions and controls to reduce risks to an acceptable level.
Risk Treatment Options
Organizations can consider the following risk treatment options:
- Modify the Risk: Implement appropriate controls to reduce the likelihood or impact of the risk.
- Avoid the Risk: Stop or change the activity that creates the risk.
- Share the Risk: Share or transfer part of the risk through contracts, insurance, outsourcing, or other arrangements.
- Retain the Risk: Accept the risk when it meets the organization’s established risk acceptance criteria.
Risk Treatment Plan
The selected treatment actions should be documented in a risk treatment plan. The plan may include the identified risk, proposed treatment, responsible risk owner, selected controls, target completion date, and implementation status.
Residual Risk
Residual risk is the level of risk remaining after risk treatment measures have been implemented. The organization should reassess the likelihood and impact of the risk and determine whether the remaining risk is acceptable.
If the residual risk remains above the organization’s risk acceptance criteria, additional controls or treatment actions may be required.
Statement of Applicability and Risk Assessment
The ISO 27001 risk treatment process is closely connected with the Statement of Applicability (SoA). Organizations determine the controls necessary to treat identified risks, compare those controls with Annex A of ISO/IEC 27001:2022, and document whether relevant controls are applicable.
Monitor and Review Information Security Risks
ISO 27001 Risk Assessment Templates
Preparing an ISO 27001 risk assessment from scratch can take considerable time. Using structured templates can help organizations document risks consistently and maintain the records required for their Information Security Management System (ISMS).
ISOEHS provides a comprehensive ISO 27001:2022 Documentation Templates Package designed to support organizations implementing and maintaining an Information Security Management System.
The package includes editable documents, procedures, registers, checklists, risk assessment tools, and other supporting templates that can be customized to suit your organization.
Looking for ready-to-use ISO 27001 documentation?
View ISO 27001:2022 Documentation Templates →
Conclusion
ISO 27001 risk assessment is a fundamental part of an effective Information Security Management System. A structured approach helps organizations identify information assets, understand threats and vulnerabilities, analyse likelihood and impact, evaluate risks, select appropriate treatments, and monitor residual risks.
Risk assessment should also be treated as an ongoing process. Organizations should regularly review their risk environment and update their assessments when technologies, business processes, suppliers, regulatory requirements, or security threats change.
By maintaining an effective risk assessment and risk treatment process, organizations can make better security decisions, protect important information assets, and support continual improvement of their ISMS.
Risk assessment is not a one-time activity. Organizations should monitor and review information security risks regularly and whenever significant changes occur, such as new technologies, new suppliers, security incidents, organizational changes, or emerging cyber threats.
