Step 6 · ISO/IEC 27005:2022, Clauses 9 and 10

ISO 27005 risk monitoring and review: keeping the assessment alive

A risk assessment starts ageing the moment it is validated: systems change, so do threats, and not all planned controls are delivered on time. Clauses 9 and 10 of the standard deal with what happens afterwards: repeating the assessment at the right time, carrying out the plan, keeping records, communicating, monitoring.

Updated on 15 November 2026 · 6 min read

Clauses: 9, Operation; 10, Leveraging related ISMS processes
Participants: CISO, risk owners, management, internal audit
Deliverables: Up-to-date assessments, evidence, indicators, review minutes

Guide chapters

In brief

Clause 9 deals with operation: performing risk assessment and risk treatment over time. It addresses clauses 8.2 and 8.3 of ISO/IEC 27001.
ISO/IEC 27001 requires the assessment to be repeated at planned intervals and when significant changes are proposed or occur.
Clause 10 connects risk management with the other processes of the management system: context, leadership, communication and consultation (10.3), documented information (10.4), monitoring and review, management review, corrective action, continual improvement.
Monitoring means tracking three things: progress of the plan, effectiveness of controls and signals that change a risk.
Without a written record, a decision does not exist for the auditor: criteria, assessment results, plan and acceptances are retained.

When to repeat the risk assessment

ISO/IEC 27001 (clause 8.2) requires risk assessments to be performed at planned intervals, or when significant changes are proposed or occur, taking account of the established criteria. The standard sets no frequency: planning it is up to you. A widespread practice is a full review once a year, aligned with the management review, with targeted updates in between.

Diagram of risk monitoring and review. In the centre, a loop: assess, treat, monitor, review. On the left, the triggers for an update: new system or project, change of supplier, incident or near miss, new threat in the sector, new obligation, reorganisation. On the right, what is tracked: progress of the treatment plan, effectiveness of controls, signals related to the scenarios. At the bottom, the records to keep: criteria, assessment results, treatment plan, acceptances of residual risks. — Two rhythms and a set of triggers: the planned review, the event-driven update, and what you watch in between.

Triggers for an off-schedule update
Change	Example	What to review
New system, new project	An online tool goes live, a new connected machine	Identification and analysis on the scope concerned
Change at a third party	New supplier, change of hosting provider	Scenarios that go through that third party, contractual requirements
Incident or near miss	Intrusion attempt detected, error narrowly avoided	Likelihood of neighbouring scenarios, effectiveness of controls
Change in the threat	Wave of attacks targeting the sector	Likelihood, treatment priorities
New obligation	New regulation, new contract	Requirements of interested parties, consequence scale
Organisational change	Merger, new site, departure of a risk owner	Scope, owners, sometimes the criteria

This is where the two cycles presented in the introduction come back: the strategic cycle reviews the context and the criteria, the operational cycle updates the scenarios and the levels.

Carry out the plan and check that controls work

ISO/IEC 27001 (clause 8.3) requires the treatment plan to be implemented and its results retained. A risk does not go down on the day the plan is approved, but on the day the control is in place and working.

Track progress. Each action has a person responsible, a deadline and a status. Delays go up to the risk owner, who decides: chase, reallocate resources or temporarily accept the risk at its initial level.
Check effectiveness. A backup is tested by a restore, network separation by an attempt to cross it, awareness by an exercise. A recurring check turns this verification into routine.
Update the level of risk. Once the control has been verified, the risk moves from its initial level to the expected residual level, and not before.
Watch the signals. Logs, alerts, incident reports, agency bulletins: these are what tell you a scenario is becoming more likely.

Document: what to retain

Subclause 10.4 of the standard deals with documented information. ISO/IEC 27001 requires documented information to be retained about the assessment process (6.1.2), about the treatment process (6.1.3), about the results of assessments (8.2) and about the results of treatment (8.3).

The records expected
Document	Content	ISO/IEC 27001 requirement
Risk management procedure	Method, criteria, scales, roles, frequency	6.1.2 and 6.1.3
Risk register	Scenarios, owners, levels, justification of ratings	8.2
Statement of applicability	Controls adopted, justification, implementation status, exclusions	6.1.3 d)
Treatment plan	Actions, people responsible, deadlines, expected residual risks	6.1.3 e), 8.3
Acceptance decisions	Who accepted which residual risk, when, for how long	6.1.3 f)

Communicate and consult

Subclause 10.3 deals with communication and consultation. In ISO 31000, this is an activity that accompanies every step of the process, not a final debrief. It has two functions: gathering what those who live with the risks know, and getting the decisions understood by those who will have to apply them.

With the business, during identification and analysis: they are the ones who know the real consequences.
With management, at evaluation and acceptance: it arbitrates and takes responsibility.
With technical teams, during treatment: they say what is feasible and how long it takes.
With third parties, when a risk goes through them: suppliers, customers, sometimes authorities.

Clause 10 also ties risk management to the rest of the management system: management review, handling of nonconformities, continual improvement. If you are building an ISMS, our article on the information security management system shows how these pieces fit together.

Running example: one year later at Mécanique Vauclair

Running example · fictitious

The first annual review

Progress: on-request remote maintenance access and multi-factor authentication have been in place for six months. Network separation, planned for the third quarter, is four months late.
Effectiveness: the quarterly restore test succeeded. A trial run by the CIO shows that an office workstation can still reach two machines in the workshop.
Consequence for R1: the residual level of 6 has not been reached. The executive committee keeps R1 at an intermediate level, relaunches the project with a new deadline and asks for a monthly update.
Trigger event: Vauclair replaced its IT maintenance supplier during the year. The CISO updated the scenarios that go through this third party without waiting for the annual review.
New risk: the workshop is getting a machine controlled from the manufacturer's online service. A fifth scenario enters the register, with the production director as owner.

Frequently asked questions

How often should the risk assessment be repeated?

Neither ISO/IEC 27005 nor ISO/IEC 27001 sets a frequency. ISO/IEC 27001 requires assessments to be performed at planned intervals and when significant changes are proposed or occur. A full annual review, supplemented by updates when a system, a supplier or the threat changes, is a widespread practice.

Which documents will an ISO 27001 auditor ask for about risks?

The description of the assessment and treatment process with its criteria, the results of the assessments, the statement of applicability, the treatment plan and the evidence that the risk owners approved the plan and accepted the residual risks. ISO/IEC 27001 requires documented information on each of these points.

What should you do when a control in the plan is late?

Tell the risk owner. Until the control is in place, the risk stays at its initial level. The owner then decides to reallocate resources, put a temporary control in place or temporarily accept the risk, and that decision is recorded.

What is the difference between monitoring and review?

Monitoring is continuous: you track the progress of the plan, the effectiveness of controls and the signals that change a risk. Review is a planned appointment: you re-examine the context, the criteria, the risks and the acceptance decisions, and decide on adjustments.

Sources

This chapter summarises and rephrases the official publications below. If in doubt, the official text prevails.

ISO/IEC 27005:2022, Information security, cybersecurity and privacy protection: guidance on managing information security risks (4th edition), ISO, October 2022.
ISO/IEC 27005:2022, public preview: scope, terms and definitions, table of contents, ISO, Online Browsing Platform.
ISO/IEC 27001:2022, Information security management systems: requirements, ISO, October 2022.
ISO 31000:2018, Risk management: guidelines, ISO, February 2018.

A platform and service that adapt to you

Our platform is designed for fine-tuned configuration and broad adaptability to your needs.

Request a demo