Demo

ISO 27005 guide · Glossary

ISO 27005 glossary: the terms of risk management

The terms used by ISO/IEC 27005:2022, explained in our own words, with their French equivalent and the chapter of the guide where each is put into practice. The official definitions are in the standard and in the public preview on the ISO platform.

Updated on · 4 min read

Guide chapters
  1. Applying ISO 27005
  2. Context and risk criteria
  3. Identify risks
  4. Analyse risks
  5. Evaluate risks
  6. Treat risks
  7. Monitor and review
  8. ISO 27001 and ISO 31000
  9. ISO 27005 and EBIOS RM
  10. Glossary

In brief

  1. Risk assessment brings together three steps: identification, analysis, evaluation. Treatment comes next.

  2. A risk is described by a source, an event and a consequence, and measured by a level that combines consequences and likelihood.

  3. Risk criteria are set before the analysis; the risk owner approves the plan and accepts the residual risk.

The steps of the process

Concept map in three groups. Describing a risk: risk source, event, primary asset and supporting asset, consequence, risk scenario. Measuring: consequences, likelihood, level of risk, risk criteria. Deciding: acceptance criteria, risk owner, treatment options, treatment plan, residual risk. At the top, a band recalls the steps: context, identification, analysis, evaluation, treatment.
The notions of ISO/IEC 27005 and how they connect: what describes a risk, what measures it, what allows a decision.
Context establishment (établissement du contexte)
First step: you define the scope, list the requirements of interested parties, set the risk criteria and choose the method. See Context and criteria.
Risk assessment (appréciation des risques)
The whole formed by risk identification, risk analysis and risk evaluation. It is what is loosely called a "risk analysis".
Risk identification (identification des risques)
Step that consists of finding, recognising and describing risks. See Identify risks.
Risk analysis (analyse des risques)
Step that assesses the consequences and likelihood of a risk and derives its level. See Analyse risks.
Risk evaluation (évaluation des risques)
Step that compares levels of risk with the criteria and ranks the risks by priority. See Evaluate risks.
Risk treatment (traitement des risques)
Process that selects and implements options to act on a risk: reduce it, avoid it, share it or retain it. See Treat risks.
Monitoring and review (surveillance et revue)
Continuous follow-up of risks, controls and context, and planned re-examination of the whole. See Monitor and review.
Communication and consultation (communication et concertation)
Exchanges with interested parties throughout the process, to gather what they know and get decisions understood.

Describing a risk

Risk (risque)
Effect of uncertainty on objectives, according to ISO 31000. In information security, it is what can harm the confidentiality, integrity or availability of information.
Risk source (source de risque)
Element which, alone or in combination with others, can give rise to risk: an attacker, an error, a failure, a natural phenomenon.
Event (événement)
What occurs or changes in a given set of circumstances. An event can have several causes and several consequences.
Consequence (conséquence)
Effect of an event on the organisation's objectives. Common usage speaks of impact; EBIOS Risk Manager, of severity.
Risk scenario (scénario de risque)
Sequence or combination of events leading from an initial cause to an unwanted consequence. A notion introduced by the 2022 edition.
Threat (menace)
Possible cause of an incident that can harm a system or the organisation.
Vulnerability (vulnérabilité)
Weakness of an asset or a control that a threat can exploit.
Primary asset and supporting asset (bien primaire, bien support)
The primary asset is what has value for the organisation: information, a process. The supporting asset is what carries it: hardware, software, network, premises, person, supplier.
Event-based approach (approche par événements)
Way of identifying risks from what the organisation fears and from risk sources, at a strategic level.
Asset-based approach (approche par actifs)
Way of identifying risks from the inventory of assets, their threats and their vulnerabilities, at a detailed level.

Measuring and deciding

Likelihood (vraisemblance)
Chance of something happening, estimated qualitatively or quantitatively.
Level of risk (niveau de risque)
Significance of a risk, expressed by combining its consequences and their likelihood.
Risk criteria (critères de risque)
References set in advance to assess the significance of a risk. They include the acceptance criteria and the criteria for performing assessments. See Context and criteria.
Risk acceptance criteria (critères d'acceptation des risques)
Rules that say which risks the organisation agrees to keep, at what level of decision and under what conditions.
Risk owner (propriétaire du risque)
Person or entity with the accountability for the risk and the authority to manage it. The owner approves the treatment plan and accepts the residual risk.
Interested party (partie intéressée)
Person or organisation that can affect a decision, be affected by it or perceive itself to be affected: customers, authorities, employees, suppliers.
Control (mesure de sécurité)
Measure that maintains or modifies risk: a rule, a procedure, a technical device, an organisational arrangement. Annex A of ISO/IEC 27001:2022 lists 93 of them.
Statement of applicability (déclaration d'applicabilité)
Document required by ISO/IEC 27001 that lists the necessary controls, justifies their inclusion, states their implementation status and justifies the Annex A exclusions.
Risk treatment plan (plan de traitement des risques)
Document that specifies, for each risk to be treated, the controls, the people responsible, the deadlines and the expected residual risk.
Residual risk (risque résiduel)
Risk remaining after treatment. See also our article Inherent risk and residual risk.
Risk acceptance (acceptation du risque)
Informed decision to take a particular risk. Since the 2022 edition, the acceptance of residual risks concludes treatment.
Documented information (information documentée)
Information the organisation has to control and retain, whatever the medium: procedure, register, plan, decision.

Frequently asked questions

What is the difference between risk assessment, risk analysis and risk evaluation?

Risk assessment is the whole: it includes identification, analysis and evaluation. Analysis assesses the consequences and likelihood of a risk and gives it a level. Evaluation compares that level with the criteria set in advance and ranks the risks.

What is the difference between threat, vulnerability and risk?

The threat is what can cause an incident; the vulnerability is the weakness it can exploit; the risk arises where they meet and is measured by its consequences for the organisation and by its likelihood.

Where can you find the official ISO 27005 definitions?

In the standard itself, sold by ISO and by national standards bodies. The clause on terms and definitions can also be read free of charge in the preview on the ISO Online Browsing Platform.

Sources

This chapter summarises and rephrases the official publications below. If in doubt, the official text prevails.

A platform and service that adapt to you

Our platform is designed for fine-tuned configuration and broad adaptability to your needs.

Request a demo