4.1 The Risk Management Process
Key Takeaways
- ISO/IEC 27001 Clause 6.1.2 requires a defined, documented information security risk assessment process; ISO/IEC 27005 is the companion standard that supplies detailed methodology
- Risk is expressed as the combination of an asset, a threat, and a vulnerability — often called the risk triplet — measured against confidentiality, integrity, and availability
- Risk assessment has three sequential sub-steps: identification, analysis, and evaluation; risk treatment is the separate follow-on activity that selects and applies controls
- Qualitative analysis uses labels such as low/medium/high on a likelihood × impact matrix; quantitative analysis uses monetary values and probabilities (ALE = SLE × ARO)
- Risk evaluation compares the analysed level against risk criteria and produces a decision: accept the risk or treat it — risks that fall within acceptance criteria need no further action
Risk management is the engine of an Information Security Management System (ISMS). ISO/IEC 27001 does not let an organisation simply pick a generic list of controls; it requires the organisation to identify what could go wrong, analyse how bad it would be, and only then choose controls that respond to the actual risk. Clause 6.1.2 — "Information security risk assessment" — makes this obligation explicit, and most of Annex A is interpreted through the lens of risk. If you understand the risk process, you understand why the standard is structured the way it is.
Where 27001 Meets 27005
ISO/IEC 27001 states that risk assessment must happen and what the outputs must feed (the risk treatment plan and the Statement of Applicability). ISO/IEC 27005 — "Information security risk management" — is the companion standard that describes how to do it in detail: methodologies, scales, asset valuation, threat modelling. The Foundation exam expects you to know that 27005 is the risk-specific guidance standard in the 27xxx family, not a controls catalogue and not a requirements standard. 27001 is certifiable; 27005 is not.
The Risk Triplet: Asset, Threat, Vulnerability
A risk statement is built from three ingredients:
| Ingredient | Definition | Example |
|---|---|---|
| Asset | Anything that has value to the organisation and supports a business objective | Customer database, web server, an employee's credentials |
| Threat | A potential cause of an unwanted incident that harms one or more assets | Ransomware operator, insider, power outage, fire |
| Vulnerability | A weakness in an asset or control that a threat can exploit to cause harm | Unpatched software, weak password policy, missing backup test |
A risk exists only when all three are present. A threat without a vulnerable asset is not a risk; a vulnerability with no threat actor who could exploit it is theoretical. The exam often phrases this as: "A risk is the combination of the probability that a threat exploits a vulnerability and the impact on the asset."
Impacts Are Measured Against CIA
Impact is assessed against the three security objectives — confidentiality, integrity, and availability — and, in 27005:2022, also the extended objectives of authenticity, non-repudiation, and reliability. A ransomware event primarily hits availability (systems are encrypted) and integrity (data is altered), while a data exfiltration hits confidentiality.
The Three Sub-Steps of Risk Assessment
Clause 6.1.2 expects a continuous, repeatable process. ISO/IEC 27005 breaks it into three sequential sub-steps.
1. Risk Identification
The organisation builds an inventory of risks by walking through each business process, identifying the assets that support it, the threats that could harm those assets, and the vulnerabilities that make harm plausible. Each combination becomes a risk scenario — a short statement such as: "An external attacker (threat) exploits an unpatched VPN vulnerability (vulnerability) to compromise the customer database (asset), breaching confidentiality and integrity."
Identification also captures existing controls. A risk that is already well controlled is still a risk; it is just one with lower residual likelihood or impact.
2. Risk Analysis
Analysis assigns values to likelihood and impact and combines them into a risk level. There are two families of method:
| Method | What It Uses | Output | When Preferred |
|---|---|---|---|
| Qualitative | Descriptive scales (e.g., 1–5 or Low/Medium/High) | A level on a risk matrix | Most ISMS implementations; fast, comparable |
| Quantitative | Monetary values and probabilities | Numbers such as ALE = SLE × ARO | Safety-critical or financially mature organisations |
For quantitative analysis, the exam recognises the classic formulas:
- SLE (Single Loss Expectancy) = Asset Value × Exposure Factor
- ALE (Annualised Loss Expectancy) = SLE × ARO (Annualised Rate of Occurrence)
Example: an asset worth $200,000 with a 30% exposure factor per incident and 2 incidents per year gives SLE = $60,000 and ALE = $120,000. That figure can then be compared with the cost of a control to decide whether the control is cost-justified.
Qualitative analysis is far more common in 27001-certified organisations because it is faster and works even when reliable monetary data is unavailable. The output is plotted on a risk matrix — a grid where one axis is likelihood and the other is impact. Each cell maps to a risk level such as Low, Medium, High, or Critical.
3. Risk Evaluation
Evaluation compares each analysed risk level against the organisation's risk criteria — the thresholds defined during context establishment (Clause 4) and approved by top management. The output is a decision:
- Risk is within acceptance criteria → no treatment required; record and monitor.
- Risk exceeds acceptance criteria → send to risk treatment (Section 4.2).
Risk criteria must be consistent with the organisation's risk appetite and legal, regulatory, and contractual obligations. They cannot be invented after the analysis just to make a risk "pass" — that defeats the purpose of the ISMS.
The Risk Matrix in Practice
A common 5×5 qualitative matrix uses these axes:
| Likelihood ↓ / Impact → | Insignificant (1) | Minor (2) | Moderate (3) | Major (4) | Severe (5) |
|---|---|---|---|---|---|
| Rare (1) | Low | Low | Low | Medium | Medium |
| Unlikely (2) | Low | Low | Medium | Medium | High |
| Possible (3) | Low | Medium | Medium | High | High |
| Likely (4) | Medium | Medium | High | High | Critical |
| Almost Certain (5) | Medium | High | High | Critical | Critical |
Anything in the High or Critical bands typically exceeds risk acceptance criteria and must be treated; anything in Low is usually accepted.
Exam Traps to Watch For
- "Risk assessment" vs "risk management." Risk assessment is identification + analysis + evaluation. Risk management is the broader cycle that also includes risk treatment, acceptance, communication, and monitoring.
- "Residual risk" vs "inherent risk." Inherent risk is the level before controls; residual risk is what remains after controls are applied. The exam uses both terms.
- "ISO/IEC 27005 is optional." It is not mandatory for certification, but the 27001 process is so closely aligned to 27005 that treating 27005 as the methodology reference is correct.
- Thinking Clause 6.1.2 only applies once. Risk assessment must be repeated at planned intervals or when significant changes occur — it is a continuous process, not a one-off project.
Linking Forward
The outputs of evaluation feed directly into Clause 6.1.3 — risk treatment — which produces a Risk Treatment Plan and the Statement of Applicability. Those are the subject of Sections 4.2 and 4.3.
Which ISO/IEC standard provides the detailed methodology for information security risk management that supports Clause 6.1.2 of ISO/IEC 27001?
An organisation values a database at $400,000. A successful breach is expected to expose 25% of the asset's value per incident and to occur 4 times per year. What is the Annualised Loss Expectancy (ALE)?
Which sequence correctly orders the three sub-steps of information security risk assessment?