ISO 27001 risk assessment

What is information security risk management? 

Risk management is one of the most challenging aspects of ISO 27001 implementation. At the same time, it's also the most important step of any information security project, as it lays the groundwork for information security in your organisation. 

Risk management means identifying, analysing, and responding to threats to your organisation’s assets’ confidentiality, integrity, and availability. The objective is to address risks according to the overall risk tolerance of your organisation. Rather than aiming to eliminate all risks, the goal is to determine and maintain an acceptable risk threshold for your organisation.

Information security risk assessment and its importance 

A risk assessment identifies security gaps and vulnerabilities. Afterwards, you can apply appropriate security measures to mitigate them. The complexity depends on various factors, including an organisation's size, growth rate, resources, and asset portfolio. 

The risk assessment results form the basis of an organisation's ISMS, allowing management to make more informed decisions regarding resource allocation, tools, and implementation of security measures.  

Once the risk assessment has been conducted, your organisation needs to decide how to manage risks based on allocated resources and budget. This involves weighing all information security risks, their likelihood of occurrence, and their potential impact.

How does continuously reviewing and monitoring your ISMS help you prepare for a risk assessment? 

ISO 27001 requires the ISMS to be regularly reviewed, updated, and improved to ensure it works appropriately and adapts to a changing environment. An internal audit is one way to validate your ISMS. 

Many tools lack the flexibility to keep up with changing frameworks, making it essential to have a tool that allows for easy updates to your risk assessment process as standards evolve. 

What does ISO 27001 require when conducting a risk assessment?

According to ISO 27001 (section 6.1.2), your risk assessment methodology must be documented. This is often challenging for organisations that start risk assessment without an established methodology. 

You need a clear plan and instructions to set up your organisation for success. As a starting point, here is what section 6.1.2 requires: 

• Define how to spot the threats that might compromise your data's confidentiality, integrity, and availability 

• Establish a method for identifying the risk owners 

• Define the criteria for evaluating repercussions and determining the risk's likelihood 

• Define the method for calculating risk 

• Define the risk-acceptance criteria 

In short, you need to identify these five aspects to achieve ISO 27001 compliance. Use this as a foundation for your plan. 

ISO 27001's approach to treating risks 

A risk treatment plan (RTP) is an essential aspect of the ISO 27001 implementation process that outlines how your organisation will respond to recognised threats. Organisations can modify the risk by using the following treatment options: 

• Implementing a control to reduce the likelihood of it occurring 

• Avoiding the risk by ceasing any activity that causes it 

• Obtaining cyber insurance and transferring the risk to a third party 

• Retaining the risk by accepting it if the cost of potential damage will be less than the cost of preventing it 

The seven steps to an effective ISO 27001 risk assessment

A risk assessment process that meets the requirements of ISO 27001 should have seven steps:

1. Establish an ISO 27001 risk assessment framework

It’s important for your organisation to handle risk assessment consistently. Therefore, you need to develop guidelines that outline the process for all areas of your organisation. 

You should define across the organisation what level of risk is acceptable, and whether you want to carry out a qualitative or quantitative risk assessment. A qualitative approach evaluates risks based on professional judgement and descriptive factors, while a quantitative approach uses numerical data and statistical models to measure risk levels and probabilities. 

Several aspects must be addressed in a formal risk assessment methodology: 

• The most important security criteria for your organisation 

• The scale of risk 

• Appetite for risk 

Methodology: Risk assessment based on assets or risks

2. Create a list of your organisation's potential risk scenarios

There are two different approaches to this step. The first method is scenario-based. Here, your organisation focuses primarily on scenarios that could pose a threat, such as a ransomware attack or a distributed denial-of-service (DDoS) attack. In this report, users are more likely to recognise risk circumstances, frequently speeding up risk identification. 

The second method is asset-based, focusing on risks related to the organisation's information assets. With this approach, it typically takes longer to identify risks. 

3. Identify risks

Now, you can start identifying which potential problems may affect you. Use our library of risk scenarios on our platform, or add your own.

4. Evaluate risk impact

Some risks are more severe than others, so you need to figure out which risks should be treated as a priority. That’s why it’s critical to rank risks according to their likelihood of occurrence and the potential damage they can inflict.

5. Create a Statement of Applicability

The Statement of Applicability (SoA) depicts your organisation’s security profile. You must identify all the controls you have installed, why you have implemented them, and how you have implemented them based on the risk assessment results in ISO 27001. 

This document is crucial since it will be used as the audit's central guideline by the certification auditor to achieve ISO 27001 certification.

6. Create a risk treatment plan

According to ISO 27001, you must identify risk owners for all risks. They are in charge of approving any risk mitigation strategies and accepting the residual risk level. 

Human error introduces numerous risks to an organisation, and you can rarely eliminate them entirely. As a result, most risks will have to be modified. This entails implementing controls described in ISO 27001 Annex A as part of the mitigation strategy.

7. Review, monitor, and conduct an internal audit

To guarantee that you have accounted for changes in how your organisation functions and the evolving threat environment, you have to repeat the assessment process every year. 

Mitigation techniques, responsibilities, budget, and timeline should all be included in the risk assessment strategy. 

You should also take advantage of this chance to improve your ISMS. This might include moving to a new risk treatment option or adopting a different control to handle risks.

Learn more about how to run an internal audit in this article.