ISO 27001 Risk Assessment: The Ultimate Guide

ISO 27001 risk assessment (video guide) — concise summary

Core concept

Information security risk = impact (on confidentiality, integrity, availability) × likelihood (of a threat exploiting a vulnerability).

ISO 27001 requires a formal, repeatable risk management methodology to protect important information assets.

Risk management framework (high-level stages)

1. Establish context

   • Identify what information/assets matter.
   • Identify internal/external interested parties and your risk appetite.

2. Risk assessment

   • Identify assets, analyze threats, and identify vulnerabilities.
   • Quantify impact and likelihood for each identified risk.

3. Risk analysis & evaluation

   • Use scales (example: 1–5) for impact and likelihood.
   • Multiply impact × likelihood to get a risk value on a 5×5 matrix.
   • Compare results to the defined appetite threshold.

4. Risk treatment

   • Choose among: accept/tolerate, reduce/treat (apply controls), transfer (insurance or outsourcing — accountability remains), or avoid/terminate (remove asset/process).

5. Monitor & review

   • Iterative process: review context and controls, update the risk register.
   • Recommended minimum frequency: annually (can be done as rolling/subset assessments throughout the year).

6. Governance

   • Communicate with stakeholders.
   • Use RACI/RACY matrices.
   • Maintain a risk management policy and documented processes.

Risk identification details

• Asset identification must consider CIA (confidentiality, integrity, availability) requirements.
• Threat analysis: list applicable threats and assess probability given the environment (e.g., internet-connected Windows vs isolated mac).
• Vulnerability analysis: determine whether existing controls reduce vulnerability to those threats.

Risk treatment & controls

• Main treatment choices: accept, reduce/treat (controls), transfer, avoid.
• ISO 27001 provides 114 best-practice controls to mitigate risks; organizations may add additional controls.
• Control types:
  • Administrative / people
  • Technical / logical
  • Physical / environmental
• Tactical purposes of controls: prevent, deter, detect, recover, etc. Combine control types for defense-in-depth.

Operational recommendations

• Prioritize risks because resources are limited; use quantification to allocate mitigation efforts.
• Ensure monitoring and continuous improvement; incorporate lessons learned into subsequent iterations.
• Maintain clear roles/responsibilities and reporting for management oversight.

Products, courses, and services mentioned

• URM: information risk management consultancy and training.
• Accredited five-day Practitioner Certificate in Information Risk Management (training course).
• An information risk management module/product named (audio): “Brisker 27001” / “BRisker 27001” to support ISO 27001 risk assessment requirements.
• Contact URM for more information (email/phone referenced in the original video).

Main speakers / sources

• URM (presenter / consultancy offering the guide and training)
• ISO 27001 standard (source of the risk management requirements and the list of controls)