ISO/IEC 27005.

What ISO/IEC 27005 is for

ISO/IEC 27005 is the guidance standard for managing information security risk. It does not certify anything and it does not replace ISO/IEC 27001. Instead it gives you a method to perform the risk assessment and risk treatment that Clause 6 of ISO 27001 requires but deliberately leaves open. ISO 27001 tells you that you must identify, analyse, evaluate and treat information security risks; ISO 27005 shows you a defensible way to do it. That division of labour is the single most important thing to understand about the standard.

The method follows a recognisable arc: establish the context, identify the risks, analyse them, evaluate them against your criteria, and then treat them. Treatment ends in a decision and a record, not just a control list. Two outputs matter to auditors above all others. The first is your set of risk acceptance criteria, agreed before you start scoring so the results cannot be reverse-engineered to a convenient answer. The second is the documented sign-off when a residual risk is accepted by the right owner. Those artefacts are what turn a spreadsheet of scores into a managed process.

The 2022 revision and the link to ISO 31000

The current revision aligns the vocabulary and structure with ISO 31000, the organisation-wide risk management standard, so that information security risk speaks the same language as enterprise risk. It also sharpens the relationship with ISO 27001 by mapping its activities onto the 27001 clauses rather than describing a parallel universe. Where older thinking leaned heavily on enumerating assets, threats and vulnerabilities, the revision accommodates both that event-based view and a scenario-based view, giving teams room to assess risk in the way that actually fits their environment.

ISO 27005 next to EBIOS RM

Practitioners in France constantly weigh ISO 27005 against EBIOS Risk Manager, the method maintained by ANSSI. They are not rivals so much as different instruments. ISO 27005 is less prescriptive, internationally recognised and the lingua franca with certification auditors, which makes it the natural fit when your goal is an ISO 27001 certificate that travels. EBIOS RM is more structured and scenario-driven, built around strategic and operational attack scenarios and explicit risk origins, which suits high-stakes or regulated French contexts. Many organisations run EBIOS RM for the analysis and then express the results in ISO 27005 terms for the ISMS.

What practitioners actually do

Using ISO 27005 well, rather than producing a one-time document, looks like this in practice:

1. Set the context first: scope, the criteria for impact and likelihood, and the risk acceptance thresholds, all agreed before any scoring begins.
2. Identify risks in the way that fits the environment, whether asset-threat-vulnerability chains or end-to-end scenarios, and avoid mixing methods inconsistently across the same assessment.
3. Analyse and evaluate against the pre-agreed criteria so the priority list is reproducible, then choose a treatment option: modify, retain, avoid or share.
4. Record residual risk and obtain explicit acceptance from the named risk owner, because that sign-off is what links the assessment back to ISO 27001 leadership accountability.
5. Revisit the assessment on a defined cadence and after significant change, so the risk picture stays current rather than ageing quietly between certification cycles.