Protecting corporate information, whether commercially sensitive information or customers’ personal data, is increasingly becoming a key focus for organizations. New legislation, such as the General Data Protection Regulation (GDPR), places additional pressure on businesses to ensure an appropriate level of information security.
However, even appropriate technologies and well-designed processes are not sufficient if information security risks are not systematically identified, assessed, and managed.
The revised standard ISO/IEC 27005:2018 “Information technology — Security techniques — Information security risk management” provides guidance to organizations on managing risks that may affect information security.
ISO/IEC 27005:2018 supports the general concepts specified in ISO/IEC 27001 and is designed to assist the implementation of information security based on a risk management approach. The standard does not provide direct guidance on the implementation of the Information Security Management System (ISMS) requirements specified in ISO/IEC 27001.

The main changes compared with the previous edition are as follows:

• all direct references to ISO/IEC 27001:2005 have been removed;
• a clear statement has been added that the document does not provide direct guidance on the implementation of the ISMS requirements specified in ISO/IEC 27001;
• ISO/IEC 27001:2005 has been removed from Clause 2;
• ISO/IEC 27001 has been added to the Bibliography;
• Annex G and all references to it have been removed;
• corresponding editorial changes have been made.

Below are several ways in which ISO/IEC 27005:2018 can support managers, information security professionals, auditors, and other interested parties within an organization.
1. A Systematic Approach to Risk Management
ISO/IEC 27005:2018 emphasizes the need for a systematic approach to information security risk management. The standard treats risk management as a continuous process that includes context establishment, risk assessment, risk treatment, risk acceptance, risk communication and consultation, as well as risk monitoring and review.
Risk management should be an integral part of information security management activities and should be applied both during the implementation and the ongoing operation of the ISMS.
2. Applying a Consistent Structure
The main risk management activities in the standard are organized around four consistent elements:

• Input – the information required to perform the relevant activity;
• Action – a description of the activity itself;
• Implementation guidance – additional guidance on carrying out the activity;
• Output – the information expected to be produced upon completion of the activity.

This structure supports the consistent application of the process and provides a clearer understanding of the required input information, the activities to be performed, and the expected results.
3. Risk Identification and Assessment
The risk management process should support the organization in identifying risks, assessing their potential consequences and likelihood, and establishing priorities for risk treatment.
Risk assessment includes risk identification, risk analysis, and risk evaluation. Where necessary, the process may be performed through several iterations – initially at a higher level and subsequently in greater depth for risks requiring further analysis.
The standard allows organizations to select their own approach to risk assessment depending on their objectives, scope, and the required level of detail.
4. Appropriate Risk Treatment and Acceptance
Following risk assessment, the organization should determine appropriate options for risk treatment.
ISO/IEC 27005:2018 considers four main options:

• risk modification;
• risk retention;
• risk avoidance;
• risk sharing.

Once the risk treatment plan has been defined, residual risks should be assessed. Where they are accepted, the decision and accountability for it should be formally recorded. The standard emphasizes the need for residual risks to be explicitly accepted by the relevant managers of the organization.
5. Continuous Monitoring and Improvement
Risks are not static. Threats, vulnerabilities, likelihood, and consequences may change over time.
ISO/IEC 27005:2018 therefore requires risks and their related factors to be regularly monitored and reviewed. The organization should take into account new assets, changes in asset values, new threats and vulnerabilities, changes in consequences, and security incidents.
The risk management process itself should also be continuously monitored, reviewed, and improved to ensure that it remains appropriate to changing business objectives and circumstances.
6. A Flexible and Adaptive Approach
ISO/IEC 27005:2018 does not specify a single method for information security risk management. Each organization determines its own approach depending on the scope of the ISMS, the risk management context, the industry sector, and other specific factors. A number of existing methodologies may be used within the framework described by the standard.
Through a structured, systematic, and continuous risk management process, an organization can align its information security decisions with its objectives, priorities, and changing environment.
ISO/IEC 27005:2018 is applicable to all types of organizations – including commercial enterprises, government agencies, and non-profit organizations – that intend to manage risks which could compromise the security of their information.