In October 2022, the new edition of ISO/IEC 27005, Information security, cybersecurity and privacy protection — Guidance on managing information security risks, was published.
ISO/IEC 27005:2022 is the fourth edition of the standard and cancels and replaces ISO/IEC 27005:2018. The new edition has been technically revised and provides updated guidance on managing information security risks.
Its publication follows the new edition of ISO/IEC 27001:2022, which specifies requirements for information security management systems (ISMS).

What Is ISO/IEC 27005:2022?
ISO/IEC 27005:2022 provides guidance on managing information security risks.
The document supports organizations in:

• fulfilling the requirements of ISO/IEC 27001 concerning actions to address information security risks;
• performing information security risk management activities, in particular risk assessment and risk treatment.

The standard is applicable to all organizations, regardless of type, size or sector.
ISO/IEC 27005 does not replace ISO/IEC 27001. The two standards have different roles – ISO/IEC 27001 specifies the requirements for an ISMS, while ISO/IEC 27005 provides more detailed guidance on managing information security risks.

What Are the Main Changes in ISO/IEC 27005:2022?
ISO/IEC 27005:2022 is a technical revision of the 2018 edition.
The main changes are:

• the guidance has been aligned with ISO/IEC 27001:2022 and ISO 31000:2018;
• the terminology has been aligned with that of ISO 31000:2018;
• the clause structure has been aligned with ISO/IEC 27001:2022;
• the concept of risk scenarios has been introduced;
• the event-based approach to risk identification has been compared with the asset-based approach;
• the content of the annexes has been revised and restructured into a single annex.

These changes are explicitly identified in the Foreword to the new edition.

Closer Alignment with ISO/IEC 27001:2022
One of the key features of the new edition is its alignment with ISO/IEC 27001:2022.
ISO/IEC 27001 requires an organization to define and apply an information security risk assessment process. This includes establishing and maintaining risk criteria, identifying risks, analysing them and evaluating them.
The organization must also define and apply an information security risk treatment process.
ISO/IEC 27005:2022 provides more detailed guidance on the practical implementation of these processes. Its structure covers context establishment, risk assessment, risk treatment and subsequent activities, including communication and consultation, documented information, monitoring and review, and continual improvement.

Context Establishment as the Starting Point
Risk management does not begin simply by drawing up a list of threats or selecting controls.
ISO/IEC 27005:2022 gives particular attention to context establishment, including aspects of the organization and the identification of the basic requirements of interested parties.
As part of establishing the context, information security risk criteria are established and maintained. These include risk acceptance criteria and criteria for performing information security risk assessments.
In this way, the organization establishes the basis against which it will subsequently identify, analyse and evaluate specific risks.

Risk Assessment – Identification, Analysis and Evaluation
The information security risk assessment process consists of three main stages:

• risk identification;
• risk analysis;
• risk evaluation.

During risk identification, the organization identifies and describes information security risks and their risk owners.
During risk analysis, the potential consequences and likelihood of the relevant scenarios are assessed and the level of risk is determined.
During risk evaluation, the results of the analysis are compared with the established risk criteria and priorities are determined for treating the analysed risks.

Risk Scenarios – an Important Element of the New Edition
One of the significant changes in ISO/IEC 27005:2022 is the introduction of the concept of risk scenarios.
The standard defines a risk scenario as a sequence or combination of events leading from an initial cause to a consequence.
Risk scenarios help structure risk information and make it possible to examine the relationships between risk sources, events, affected assets and potential consequences.
Annex A provides practical examples and techniques for developing and using such scenarios in risk assessment.

Event-Based and Asset-Based Approaches
ISO/IEC 27005:2022 addresses two approaches that can be used when identifying information security risks:

• the event-based approach;
• the asset-based approach.

Under the event-based approach, strategic scenarios are identified by considering risk sources and how they may lead to consequences for the organization.
Under the asset-based approach, operational scenarios are identified in greater detail in relation to assets, threats and vulnerabilities.
The two approaches should not be regarded as mutually exclusive. The standard allows an appropriate approach or combination of approaches to be used depending on the organization’s context and needs.
This represents a development from ISO/IEC 27005:2018, which was based on an asset, threat and vulnerability method of risk identification, while also allowing other approaches to be used.

From Risk Assessment to Risk Treatment
Following risk assessment, the organization needs to determine how the identified risks should be treated.
ISO/IEC 27005:2022 considers various risk treatment options, including:

• avoiding the risk by deciding not to start or continue the activity that gives rise to the risk;
• modifying the risk;
• retaining the risk;
• sharing the risk with other parties.

Based on the selected risk treatment options, the necessary controls are determined.
The standard also establishes a clear link with ISO/IEC 27001:2022: the controls determined should be compared with those in Annex A of ISO/IEC 27001 to verify that no necessary control has been omitted.

Statement of Applicability and the Risk Treatment Plan
ISO/IEC 27005:2022 also provides detailed guidance on the steps that follow the selection of controls.
These include:

• comparing the identified controls with Annex A of ISO/IEC 27001:2022;
• preparing the Statement of Applicability (SoA);
• developing a risk treatment plan;
• obtaining approval of the plan from the risk owners;
• acceptance of residual risks.

Risk assessment is therefore directly linked to decisions concerning controls and to documenting how the organization manages the identified risks.

Monitoring and Review Remain an Essential Part of the Process
Information security risks are not static.
Changes in technologies, processes, assets, threats, vulnerabilities, legal and regulatory requirements, or the organization’s activities can affect both the likelihood of an event and its potential consequences.
ISO/IEC 27005:2022 therefore addresses the monitoring and review of both the factors influencing risks and the risk management process itself.
The standard also addresses management review, corrective action and continual improvement.

A Single Annex with Practical Techniques
A significant structural change compared with the 2018 edition is the restructuring of the annexes.
ISO/IEC 27005:2022 contains a single informative Annex A, “Examples of techniques supporting the risk assessment process.”
It includes practical examples and guidance relating to:

• criteria related to risk assessment;
• qualitative and quantitative approaches;
• consequence and likelihood scales;
• determining the level of risk;
• information security risk components;
• assets;
• risk sources and undesirable end states;
• the event-based approach;
• the asset-based approach;
• risk scenarios;
• monitoring of risk-related events.

In this way, the annex provides practical techniques that can support organizations in developing or improving their approach to risk assessment.

What Does ISO/IEC 27005:2022 Mean for Organizations?
The new edition does not mean that all organizations need to use the same methodology or the same risk assessment matrix.
ISO/IEC 27005:2022 provides a framework and practical guidance that allow the approach to be adapted to the context, objectives and needs of each organization.
For organizations implementing ISO/IEC 27001:2022, the new edition of ISO/IEC 27005 provides an opportunity to review their existing risk management process and assess whether:

• risk criteria are clearly defined;
• risk identification covers scenarios that are significant to the organization;
• consequences and likelihood are assessed consistently;
• the results of risk assessment enable clear priorities to be established;
• risk treatment decisions are linked to appropriate controls;
• residual risks are accepted by the designated responsible persons;
• risks and the factors influencing them are periodically monitored and reviewed.

ISO/IEC 27005:2022 places risk management at the heart of information security decision-making. The objective is not simply to create a risk register, but to ensure that the organization has a consistent process for identifying, assessing, treating, monitoring and reviewing risks that supports the operation and continual improvement of its information security management system.