Links · ANSSI, EBIOS Risk Manager version 1.5

ISO 27005 and EBIOS RM: a standard for the framework, a method to do it

ISO/IEC 27005 says which steps to carry out and leaves the choice of method open. EBIOS Risk Manager, the method published by ANSSI, the French national cybersecurity agency, says how to carry them out, workshop by workshop. The two are not competitors: the second is a way of applying the first. This chapter shows where each workshop sits in the process of the standard, and what needs to be added.

Updated on 15 November 2026 · 7 min read

Method: EBIOS Risk Manager, ANSSI guide, version 1.5
Conformity: Stated by ANSSI to conform to ISO/IEC 27005:2022
Structure: Five workshops, two cycles

Guide chapters

In brief

ISO/IEC 27005 is a guidance standard; EBIOS Risk Manager is a method, published by the Agence nationale de la sécurité des systèmes d'information (ANSSI). A method is used to apply a standard.
ANSSI states that version 1.5 of the method fully conforms to ISO/IEC 27005:2022.
The strategic scenarios of EBIOS RM correspond to the event-based approach of the standard, the operational scenarios to the approach based on supporting assets: this is the core of their compatibility, according to the Club EBIOS.
The security baseline of workshop 1 addresses the identification of the requirements of interested parties, within context establishment.
Two points to add in an ISO 27001 setting: unintentional risks, which the method leaves to the baseline, and the documents specific to certification, such as the statement of applicability.

A standard and a method do not play the same role

The confusion comes from the fact that both deal with managing digital risks. But ISO/IEC 27005 describes a process that holds whatever the method: establish the context, assess, treat, monitor. EBIOS Risk Manager describes an operating procedure: five workshops, participants, deliverables, suggested scales, practical sheets. The Club EBIOS sums it up as follows: the method is not a standard, it provides the practical techniques that allow the model in the standard to be applied.

Standard and method compared
	ISO/IEC 27005:2022	EBIOS Risk Manager 1.5
Nature	International guidance standard	Risk analysis method
Published by	ISO and IEC	ANSSI, with the support of the Club EBIOS
Access	Paid; public preview of the contents and terms	Guide and sheets freely available (in French)
Says	Which steps to carry out	How to carry them out, with whom and with which supports
Scales	Examples in an annex, to adapt	Suggested severity and likelihood scales
Risk sources	Intentional and unintentional	Scenarios focused on intentional sources; the rest goes through the baseline
Covers	The whole process, up to monitoring and the links with the ISMS	Assessment and treatment, with risk follow-up

ENISA makes the same observation in its analysis of risk management standards: it describes EBIOS Risk Manager as a method aligned with ISO/IEC 27005, which helps meet the requirements of ISO/IEC 27001.

Where each workshop sits in the ISO 27005 process

Mapping diagram between EBIOS Risk Manager and ISO/IEC 27005:2022. On the left, the five workshops; on the right, the steps of the standard. Workshop 1, scope and security baseline, linked to context establishment and the requirements of interested parties. Workshop 2, risk sources, and workshop 3, strategic scenarios, linked to risk identification through the event-based approach and to the assessment of consequences. Workshop 4, operational scenarios, linked to the approach based on supporting assets and to the assessment of likelihood. Workshop 5, risk treatment, linked to evaluation, treatment and the acceptance of residual risks. A note recalls two additions: unintentional risks and the statement of applicability. — The five workshops of EBIOS Risk Manager placed on the steps of ISO/IEC 27005:2022.

Mapping of workshops and steps
EBIOS RM workshop	What it produces	ISO/IEC 27005 step	Guide chapter
1. Scope and security baseline	Scope, business assets, feared events and their severity, security baseline	Context establishment, requirements of interested parties; start of the assessment of consequences	Context
2. Risk sources	Risk sources and target objectives kept	Risk identification: risk sources	Identification
3. Strategic scenarios	Ecosystem map, strategic scenarios, severity	Event-based identification; assessment of consequences	Identification
4. Operational scenarios	Operational scenarios, likelihood	Identification based on supporting assets; assessment of likelihood	Analysis
5. Risk treatment	Risk summary, treatment strategy, treatment plan, residual risks	Level of risk, evaluation, treatment, acceptance	Evaluation and treatment

The method also organises its workshops in two cycles, one strategic, one operational, which echoes the two cycles of the standard presented in the introduction. Our EBIOS RM guide details each workshop (in French).

Translating the vocabulary

The words differ more than the ideas. The Club EBIOS has published a table of equivalences, summarised here. It helps when an ISO 27001 auditor reads an EBIOS RM report, or when a foreign subsidiary needs to understand a French analysis.

Vocabulary equivalences, based on the Club EBIOS and the ANSSI guide
EBIOS Risk Manager (French term)	ISO/IEC 27005
Business asset (valeur métier)	Primary asset
Supporting asset (bien support)	Supporting asset
Feared event (événement redouté)	Consequence
Risk source (source de risque)	Risk source
Strategic scenario (scénario stratégique)	Risk scenario, event-based approach
Operational scenario (scénario opérationnel)	Risk scenario, asset-based approach
Security baseline (socle de sécurité)	Basic requirements of interested parties
Risk treatment plan (plan de traitement du risque)	Risk treatment plan

What to add in an ISO 27001 setting

Unintentional risks. EBIOS RM scenarios target sources that act deliberately. Error, failure and natural events fall under the security baseline. The Club EBIOS points this out: the standard, for its part, explicitly includes unintentional sources. Check that your baseline covers them, or add the missing scenarios.
Acceptance criteria. The method suggests scales and a treatment strategy; make sure your acceptance criteria are written down and validated by management before workshop 5, as clause 6.1.2 of ISO/IEC 27001 requires.
Risk owners. For each scenario kept, name the person who will approve the plan and accept the residual risk.
The comparison with Annex A and the statement of applicability. They are specific to ISO/IEC 27001: they are added after workshop 5, from the controls in the treatment plan.
Monitoring. The method provides for risk follow-up; certification also requires planned reassessment and records, described in the chapter Monitor and review.

Running example: what if Mécanique Vauclair had used EBIOS RM?

Running example · fictitious

The same risk, in the terms of the method

Workshop 1: the business asset is the manufacture of parts; the feared event is the workshop stopping for more than ten days, rated at the highest level of severity. The security baseline lists the main customer's clauses.
Workshop 2: the risk source kept is a cybercriminal group, with extortion as its target objective.
Workshop 3: the ecosystem map brings out the machine manufacturers and their remote maintenance access. The strategic scenario goes through one of them.
Workshop 4: the operational scenario details the path, from the shared remote maintenance account to the workshop servers, and its likelihood.
Workshop 5: the scenario is placed on the risk map, the treatment strategy and the plan are decided, the residual risk is documented.
ISO 27001 additions: risk R3, an administration error, does not come out of these workshops. Vauclair handles it through the security baseline and enters it in its register; it adds the comparison with Annex A and the statement of applicability.

Frequently asked questions

What is the difference between ISO 27005 and EBIOS RM?

ISO/IEC 27005 is an international guidance standard: it describes the process for managing information security risks without imposing a method. EBIOS Risk Manager is a method published by ANSSI, the French national cybersecurity agency, organised in five workshops, which says concretely how to carry out the analysis. ANSSI states that version 1.5 of the method conforms to ISO/IEC 27005:2022.

Does EBIOS RM conform to ISO 27005?

Yes, according to ANSSI: version 1.5 of the method was updated to conform fully to ISO/IEC 27005:2022, with additions and an alignment of vocabulary. The Club EBIOS has published a table linking the notions of the method to those of the standard.

Can EBIOS RM be used for ISO 27001 certification?

Yes. ISO/IEC 27001 does not impose a risk assessment method. An EBIOS RM analysis is suitable, provided you add what certification also requires: validated acceptance criteria, risk owners, coverage of unintentional risks, comparison with Annex A and a statement of applicability.

Is the event-based approach of ISO 27005 the same thing as strategic scenarios?

They correspond. The Club EBIOS associates the strategic scenarios of EBIOS RM with the event-based approach of ISO/IEC 27005, and the operational scenarios with the approach based on supporting assets. It sees this as the central point of compatibility between the method and the standard.

Sources

This chapter summarises and rephrases the official publications below. If in doubt, the official text prevails.

ISO/IEC 27005:2022, Information security, cybersecurity and privacy protection: guidance on managing information security risks (4th edition), ISO, October 2022.
EBIOS Risk Manager, the guide (version 1.5, in French), ANSSI.
The EBIOS Risk Manager method (in French), ANSSI.
ANSSI updates the EBIOS Risk Manager method (version 1.5, conforming to ISO 27005:2022, in French), ANSSI, March 2024.
What is the link between EBIOS RM and ISO 27005?, Club EBIOS, October 2022.
Risk Management Standards, ENISA.
ISO/IEC 27001:2022, Information security management systems: requirements, ISO, October 2022.

A platform and service that adapt to you

Our platform is designed for fine-tuned configuration and broad adaptability to your needs.

Request a demo