Summary of "ISO 27001 Risk Assessment: The Ultimate Guide"

ISO 27001 risk assessment (video guide) — concise summary

Information security risk = impact (on confidentiality, integrity, availability) × likelihood (of a threat exploiting a vulnerability).

ISO 27001 requires a formal, repeatable risk management methodology to protect important information assets.

Establish context
- Identify what information/assets matter.
- Identify internal/external interested parties and your risk appetite.
Risk assessment
- Identify assets, analyze threats, and identify vulnerabilities.
- Quantify impact and likelihood for each identified risk.
Risk analysis & evaluation
- Use scales (example: 1–5) for impact and likelihood.
- Multiply impact × likelihood to get a risk value on a 5×5 matrix.
- Compare results to the defined appetite threshold.
Risk treatment
- Choose among: accept/tolerate, reduce/treat (apply controls), transfer (insurance or outsourcing — accountability remains), or avoid/terminate (remove asset/process).
Monitor & review
- Iterative process: review context and controls, update the risk register.
- Recommended minimum frequency: annually (can be done as rolling/subset assessments throughout the year).
Governance
- Communicate with stakeholders.
- Use RACI/RACY matrices.
- Maintain a risk management policy and documented processes.

Asset identification must consider CIA (confidentiality, integrity, availability) requirements.
Threat analysis: list applicable threats and assess probability given the environment (e.g., internet-connected Windows vs isolated mac).
Vulnerability analysis: determine whether existing controls reduce vulnerability to those threats.

Main treatment choices: accept, reduce/treat (controls), transfer, avoid.
ISO 27001 provides 114 best-practice controls to mitigate risks; organizations may add additional controls.
Control types:
- Administrative / people
- Technical / logical
- Physical / environmental
Tactical purposes of controls: prevent, deter, detect, recover, etc. Combine control types for defense-in-depth.

Prioritize risks because resources are limited; use quantification to allocate mitigation efforts.
Ensure monitoring and continuous improvement; incorporate lessons learned into subsequent iterations.
Maintain clear roles/responsibilities and reporting for management oversight.

URM: information risk management consultancy and training.
Accredited five-day Practitioner Certificate in Information Risk Management (training course).
An information risk management module/product named (audio): “Brisker 27001” / “BRisker 27001” to support ISO 27001 risk assessment requirements.
Contact URM for more information (email/phone referenced in the original video).