Links · ISO/IEC 27001:2022 and ISO 31000:2018
ISO 27005 and ISO 27001: who requires what, and where ISO 31000 fits
Three standards talk about risk and answer one another. ISO 31000 sets the general framework for risk management, ISO/IEC 27001 lays down requirements for information security, ISO/IEC 27005 explains how to fulfil them. Knowing which one requires what avoids two mistakes: believing ISO 27005 is mandatory, or believing you can do without it and put nothing in its place.
- Requirements
- ISO/IEC 27001:2022, clauses 6.1.2, 6.1.3, 8.2 and 8.3
- Guidance
- ISO/IEC 27005:2022
- General framework
- ISO 31000:2018, under revision
Guide chapters
In brief
-
ISO/IEC 27001 contains the requirements, and it is the one you certify against. Four clauses deal with risk: 6.1.2 (assessment), 6.1.3 (treatment), 8.2 and 8.3 (performing them over time).
-
ISO/IEC 27005 adds no requirement: it gives guidance on fulfilling these clauses. Its structure follows them, from risk criteria to the acceptance of residual risks.
-
ISO 31000 is the general risk management standard, for all types of risk. ISO/IEC 27005 takes its process and vocabulary and applies them to information security.
-
ISO/IEC 27001 imposes no method. The auditor checks that your process exists, that it is applied and that it produces consistent, valid and comparable results.
-
ISO/IEC 27002 comes afterwards: it details the Annex A controls that risk treatment leads you to adopt.
Three standards, three roles
| Standard | Nature | Subject | Certification |
|---|---|---|---|
| ISO 31000:2018 | Guidelines | Risk management, all fields | No |
| ISO/IEC 27001:2022 | Requirements | Information security management system | Yes, for the organisation |
| ISO/IEC 27005:2022 | Guidance | Managing information security risks | No |
| ISO/IEC 27002:2022 | Implementation guidance | Annex A security controls | No |
For an introduction to each, see our articles ISO 27005, ISO 31000 and ISMS.
ISO 27001 clause by clause: what ISO 27005 brings
The scope of ISO/IEC 27005 states its first objective: to assist in fulfilling the requirements of ISO/IEC 27001 concerning actions to address risks. The table below links each requirement to the part of the standard that supports it and to the chapter of this guide.
| ISO/IEC 27001 | What is required | ISO/IEC 27005 | Chapter |
|---|---|---|---|
| 6.1.2 a) | Establish and maintain risk criteria: risk acceptance criteria and criteria for performing risk assessments | Clause 6 (6.4) | Context and criteria |
| 6.1.2 b) | Repeated assessments produce consistent, valid and comparable results | Clauses 6 and 7 | Context and criteria |
| 6.1.2 c) | Identify risks associated with the loss of confidentiality, integrity and availability, and their owners | Clause 7 (7.2) | Identification |
| 6.1.2 d) | Analyse: potential consequences, realistic likelihood, levels of risk | Clause 7 (7.3) | Analysis |
| 6.1.2 e) | Evaluate: compare with the criteria and prioritise for treatment | Clause 7 (7.4) | Evaluation |
| 6.1.3 a) to d) | Select the options, determine the controls, compare them with Annex A, produce the statement of applicability | Clause 8 (8.2 to 8.5) | Treatment |
| 6.1.3 e) and f) | Formulate the treatment plan; obtain the owners' approval and their acceptance of the residual risks | Clause 8 (8.6) | Treatment |
| 8.2 | Perform assessments at planned intervals or when significant changes occur | Clause 9 | Monitoring and review |
| 8.3 | Implement the treatment plan | Clause 9 | Monitoring and review |
What an ISO 27001 auditor checks about risks
- The process is defined: a procedure describes the method, the criteria, the roles and the frequency.
- The criteria come before the results: they were validated before the assessment, not adjusted afterwards.
- The results are reproducible: ratings are justified, and two analyses of the same scope reach similar conclusions.
- Each risk has an owner who approved the plan and accepted the residual risk, with a dated record.
- The statement of applicability follows from the risks: each control adopted is tied to a risk or an obligation, each exclusion is justified.
- The assessment is up to date: it was repeated at the planned rhythm and after major changes.
What ISO 27005 takes from ISO 31000
ISO 31000:2018 provides guidelines on managing risk in any organisation and for any type of risk: financial, legal, industrial, digital. It is organised in three parts: principles, a framework that anchors risk management in governance, and a process. It defines risk as the effect of uncertainty on objectives.
| ISO 31000:2018 | ISO/IEC 27005:2022 |
|---|---|
| Scope, context and criteria | Context establishment (Clause 6) |
| Risk assessment: identification, analysis, evaluation | Information security risk assessment (Clause 7) |
| Risk treatment | Treatment, with the steps specific to ISO/IEC 27001: Annex A, statement of applicability (Clause 8) |
| Communication and consultation | Communication and consultation (Clause 10) |
| Monitoring and review | Monitoring and review (Clause 10) |
| Recording and reporting | Documented information (Clause 10) |
What ISO/IEC 27005 adds comes from the field: risks are expressed as a loss of confidentiality, integrity and availability, identification is event-based or asset-based, and treatment leads to the documents ISO/IEC 27001 requires. The practical benefit of this lineage is speaking the same language as enterprise risk management: same words, same steps, and scales that can be reconciled. Our article on the risk manager role shows how the two functions work together.
And outside the ISO family?
The ISO/IEC 27005 process does not stand alone. ENISA, in its analysis of risk management standards, identifies ISO 31000 and ISO/IEC 27005 as the most relevant, and its interoperable EU framework maps national methods onto the identification, analysis, evaluation and treatment steps of ISO/IEC 27005. In the United States, NIST SP 800-30 organises risk assessment in four stages: prepare, conduct, communicate results, maintain. The words differ; the logic is the same.
European legislation does not name ISO/IEC 27005, but it asks for what the standard helps you produce. The NIS 2 Directive requires measures based on an all-hazards approach, including policies on risk analysis. The DORA Regulation requires financial entities to have an ICT risk management framework that is documented and reviewed at least once a year. A written process, validated criteria and planned reassessment meet these expectations, without amounting to compliance on their own.
In France, the reference method is EBIOS Risk Manager. The next chapter shows how it fits within ISO/IEC 27005.
Frequently asked questions
Is ISO 27005 mandatory for ISO 27001 certification?
No. ISO/IEC 27001 requires a risk assessment and treatment process, but imposes no method. ISO/IEC 27005 gives guidance on fulfilling these requirements. You can use another method, for example EBIOS Risk Manager, as long as the process meets clauses 6.1.2, 6.1.3, 8.2 and 8.3.
Which ISO 27001 clauses deal with risk management?
Clause 6.1.2 (risk assessment: criteria, identification, analysis, evaluation), clause 6.1.3 (treatment: options, controls, comparison with Annex A, statement of applicability, plan, approval and acceptance), clause 8.2 (performing assessments over time) and clause 8.3 (implementing the treatment plan).
What is the difference between ISO 27005 and ISO 31000?
ISO 31000 provides guidelines on managing all of an organisation's risks: principles, framework and process. ISO/IEC 27005 takes this process and vocabulary and applies them to information security risks, with guidance specific to the field and the link with ISO/IEC 27001.
Do you need to apply ISO 31000 before ISO 27005?
No. ISO/IEC 27005 is sufficient on its own for information security. If the organisation already applies ISO 31000 to its other risks, the benefit is to reuse the same vocabulary and reconcile the scales, so that digital risks can be read alongside the others.
Sources
This chapter summarises and rephrases the official publications below. If in doubt, the official text prevails.
- ISO/IEC 27005:2022, Information security, cybersecurity and privacy protection: guidance on managing information security risks (4th edition), ISO, October 2022.
- ISO/IEC 27005:2022, public preview: scope, terms and definitions, table of contents, ISO, Online Browsing Platform.
- ISO/IEC 27001:2022, Information security management systems: requirements, ISO, October 2022.
- ISO/IEC 27002:2022, Information security controls, ISO, February 2022.
- ISO 31000:2018, Risk management: guidelines, ISO, February 2018.
- ISO/CD 31000, draft new edition of ISO 31000 (under development), ISO.
- Risk Management Standards, ENISA.
- Interoperable EU Risk Management Framework, ENISA.
- NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments, NIST, September 2012.
- Directive (EU) 2022/2555 of 14 December 2022 (NIS 2), Article 21, EUR-Lex, 27 December 2022.
- Regulation (EU) 2022/2554 of 14 December 2022 (DORA), Article 6, EUR-Lex, 27 December 2022.
A platform and service that adapt to you
Our platform is designed for fine-tuned configuration and broad adaptability to your needs.