What is an ISO 27001 risk assessment and how should you document the process?

An ISO 27001 risk assessment helps organisations identify, analyse and evaluate weaknesses in their information security processes.

It’s a core part of ISO 27001, the international standard that describes best practice for implementing and maintaining an ISMS (information security management system)

The risk assessment is essential to that process, helping organisations:

  • Understand the specific scenarios in which their data could be compromised; 
  • Assess the damage each scenario could cause; and 
  • Determine how likely it is that these scenarios will occur. 

Want to know how to get your ISO 27001 risk assessment process right? Let’s take a look at five things you can do to get started on the right foot, then review the steps you should take next.

Five steps to an effective ISO 27001 risk assessment

The stakes involved in the ISO 27001 risk assessment process can make it a daunting task. Mistakes here will ripple throughout your organisation, potentially exposing security vulnerabilities.

You can make sure you avoid costly mistakes by following these steps.

1. Establish a risk management framework

One of the key elements is having conditions for performing a risk assessment – e.g. annually and whenever there is a significant change. 

This includes how you will identify risks; who you assign risk ownership to; how the risks affect the confidentiality, integrity and availability of the information; and the method of calculating the estimated damage of each scenario and the likelihood of it occurring. 

A formal risk assessment methodology needs to address four issues: 

  1. Your organisation’s core security requirements 
  2. Risk scale 
  3. Risk appetite 
  4. Methodology: scenario- or asset-based risk assessment 

2. Identify risks

Identifying the risks that can affect the confidentiality, integrity and availability of information is the most time-consuming part of the risk assessment process. 

We recommend following an asset-based approach. Developing a list of information assets is a good place to start, but if your organisation has an existing list, most of the work will already be done. 

3. Analyse risks 

You must identify the threats and vulnerabilities that apply to each asset. 

For example, if the threat is ‘theft of mobile device’, the vulnerability might be ‘a lack of formal policy for mobile devices’. 

4. Evaluate risks

Now it’s time to assess how significant each risk is. It’s wasteful to implement measures in response to every risk you face, so you should use a risk assessment matrix to help you identify which risks are worth treating and prioritise them. 

Risk assessment matrix

Most risk assessment matrices look like this, with one axis representing the probability of a risk scenario occurring and the other representing the damage it will cause. In the middle, you have scores based on their combined totals.

You should use the matrix to score each risk and weigh the totals against your predetermined levels of acceptable risk (i.e. your risk appetite). The scores will determine how you address the risk, which is the final step in the process.

5. Select risk treatment options

There are four ways you can treat a risk:

  1. Avoid the risk by eliminating it entirely
  2. Modify the risk by applying security controls
  3. Share the risk with a third party (through insurance or by outsourcing it)
  4. Retain the risk (if the risk falls within established risk acceptance criteria)

The method you choose will depend on your circumstances. Avoiding the risk is obviously the most effective way of preventing a security incident, but doing so will probably be expensive if not impossible.

For example, many risks are introduced into an organisation by human error, and you won’t often be able to remove the human element from the equation.

You’ll therefore be required to modify most risks. This involves selecting the relevant controls, which are outlined in Annex A of ISO 27001.

Risk assessment reports

Getting the risk assessment process right is obviously important, but you must remember that it’s only the first step towards effective security. Once you’ve completed the assessment, you must report on your findings and implement a plan of action.

You must produce several reports based on your risk assessment for audit and certification processes. The following two are the most important:

  • SoA (Statement of Applicability)

An SoA documents the relevance of each of ISO 27001’s controls to your organisations. It should contain a list of controls that you will or won’t implement, along with an explanation of why they have or haven’t been selected. (Remember, you only need to apply a control if it will mitigate a risk that you’ve identified.)

You should also state your level of progress in implementing the control. This could be a simple ‘done/not done’ checkbox, or you could go into more detail, explaining whether you have a plan, are waiting for further guidance, have begun work, and so on.

Lastly, you must explain why any omitted controls were deemed irrelevant.

  • RTP (risk treatment plan)

An RTP provides a summary of each identified risk, the responses that have been designed to deal with the risk, the parties responsible for those risks and the target date for applying the risk treatment.

Dealing with risk doesn’t necessarily mean eliminating it. Depending on the circumstance, you might be better off modifying the risk by applying security controls, sharing the risk with a third party (whether that’s an insurer or another third party) or retaining the risk (if you decide that the likelihood or severity of the risk doesn’t justify the cost of implementing the relevant controls).

What else should you document?

Additional documents will help when auditing your SoA and RTP. You should consider producing:

  • A risk assessment report, providing an overview of the assessment, including relevant assets, the treatment applied, and the estimated impact and probability of each risk;
  • A risk summary report, detailing the residual risk, i.e. the risks that remain after risk treatment; and
  • A comments report, attached to your risk assessment, to explain your decisions in more detail.

Looking for more guidance?

ISO 27001 ISMS Documentation ToolkitIT Governance’s ISO 27001 ISMS Documentation Toolkit includes templates of every document you need to comply with the Standard, including comprehensive coverage of the risk assessment process.

This toolkit is ideal for anyone who wants help documenting their:

  • Risk assessment procedure;
  • Risk management framework; and
  • Risk treatment plan.

Designed and developed by information security experts, and improved by more than ten years of customer feedback, our ISO 27001 toolkit gives you the guidance you need for a hassle-free compliance process.


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.