ISO 27005 risk criteria: establishing the context before any analysis

The first subclause of Clause 6 deals with organisational considerations: the organisation's objectives, its activities, its structure, what depends on the information system. This is where you decide what the assessment will cover. In an ISO 27001 project, the scope of the assessment follows that of the information security management system (ISMS); outside certification, it can be a business line, a site or an application.

• What is in scope: activities, processes, sites, systems, and what is excluded, with the reason for the exclusion.
• What has value: the information and processes the business depends on. Expressing their security needs, for example in terms of confidentiality, integrity, availability and traceability, prepares risk identification.
• The interfaces: suppliers, hosting providers, connected customers, everything that crosses the scope boundary.
• The roles: who leads the assessment, who contributes, who decides.

The second subclause asks you to identify the basic requirements of interested parties. Some security measures are not up for discussion: they follow from a law, a contract or a commitment, whatever the assessment concludes. Knowing them from the start avoids rediscovering them at treatment time.

Users of EBIOS Risk Manager will recognise the security baseline of workshop 1: the Club EBIOS links it directly to this step of the standard. The chapter ISO 27005 and EBIOS RM details the mapping.

This is the core of the step, covered by subclause 6.4 of the standard. ISO/IEC 27001 (clause 6.1.2) requires the assessment process to establish and maintain risk criteria, which include the risk acceptance criteria and the criteria for performing risk assessments. ISO/IEC 27005 follows the same division.

Criteria for performing the assessment

• A consequence scale. Each level is described in terms the business understands: production stoppage in days, financial loss, breach of a contractual or regulatory obligation, harm to people or reputation. The standard speaks of "consequences", the ISO 31000 term, where common usage often says "impact" or "severity".
• A likelihood scale. Each level relies on observable elements: frequency of comparable events, exposure, ease of execution, controls already in place.
• A rule for determining the level of risk. Most often a grid that crosses the two scales (see our article on the risk matrix), sometimes a calculation.

Acceptance criteria

They say from what level a risk must be treated, who can accept what, and under what conditions. An acceptance criterion can have several thresholds, and can provide for a risk above the threshold to be accepted at a higher level of management, for a limited period or subject to a commitment to treat it. These rules express the organisation's risk appetite: they are validated with top management, in writing.

Clause 6 ends with the choice of an appropriate method. The standard recommends none. What matters is that the method is consistent with the chosen criteria and produces reproducible results. Three questions help with the choice.

• Which identification approach? Event-based, asset-based, or both: the next chapter compares them.
• Which type of analysis? Qualitative, semi-quantitative or quantitative, depending on the data you have.
• Which existing method? In France, EBIOS Risk Manager is the most widely used, and ANSSI states that it conforms to ISO/IEC 27005:2022. An in-house method is also suitable, provided it is written down and applied in the same way everywhere.