Demo

Step 4 · ISO/IEC 27005:2022, Clause 7

ISO 27005 risk evaluation: comparing with the criteria and prioritising

Evaluation is the shortest step in the process and the one most often confused with analysis. It no longer measures anything: it compares the levels obtained with the criteria set at the start, ranks the risks and prepares the decision. This is where the analysis becomes an order of priority that management can read.

Updated on · 5 min read

Clause
7, Risk assessment: evaluation
Participants
CISO, risk owners, management
Deliverable
Ranked list of risks, with those that must be treated
Guide chapters
  1. Applying ISO 27005
  2. Context and risk criteria
  3. Identify risks
  4. Analyse risks
  5. Evaluate risks
  6. Treat risks
  7. Monitor and review
  8. ISO 27001 and ISO 31000
  9. ISO 27005 and EBIOS RM
  10. Glossary

In brief

  1. Evaluation does two things: compare the results of risk analysis with the risk criteria (7.4.1 of the standard), then prioritise the analysed risks for treatment.

  2. This is clause 6.1.2 e) of ISO/IEC 27001: compare with the established criteria and prioritise.

  3. It does not yet choose the controls: it says which risks exceed what the organisation accepts, and in what order to take them.

  4. It ends with a decision point: is the assessment sufficient to decide? If not, you go back to the context, the identification or the analysis.

  5. Its result is presented to management in a readable form: risk grid, ranked list, risks above the threshold.

Analysis and evaluation: two distinct steps

In everyday language, "evaluating a risk" means giving it a rating. In the vocabulary of ISO 31000, adopted by ISO/IEC 27005 and ISO/IEC 27001, giving a level is analysis; evaluation comes afterwards and consists of comparing that level with the criteria in order to decide. The distinction has a practical consequence: a level is not adjusted during evaluation. If the result looks wrong, you go back to the analysis.

What each step of the assessment does
StepQuestionResult
IdentificationWhat can happen, and who owns the risk?Described risks, owners
AnalysisWhat consequences, what likelihood, what level?Level of each risk, justified
EvaluationIs this level acceptable, and where do we start?Ranked risks, risks to be treated

Compare the levels with the acceptance criteria

You take the acceptance criteria validated with the context and check each risk against them. Three situations arise.

  • The risk is below the acceptance threshold. It can be kept as it is. It is still entered in the register, with its owner: it will be reviewed at the next iteration.
  • The risk exceeds the threshold. It goes to treatment. Evaluation does not say how, only that it must.
  • The risk is in an intermediate zone, if your criteria provide for one. The decision then falls to the body named in the criteria, which chooses between treating and accepting, and gives its reasons.
Diagram of the evaluation of the four risks in the example. The risks arrive with their level: R1 ransomware 12, R2 theft of drawings 8, R3 administration error 6, R4 theft of a laptop 3. They are compared with two thresholds: above 8, high risk, to be treated; from 4 to 8, medium risk, to be treated or accepted by a reasoned decision; up to 3, low risk, accepted by its owner. Result: R1 to be treated as priority 1, R2 to be treated as priority 2, R3 to be treated as priority 3, R4 accepted. A decision point concludes: is the assessment sufficient to decide? Yes, move on to treatment.
Evaluation: each analysed risk is checked against the acceptance thresholds, then the risks to be treated are ranked.

Rank the risks for treatment

The level of risk gives a first ranking. It is not always enough: two risks at the same level do not call for the same urgency. A few tie-break criteria, set in advance, avoid endless discussions.

  • Consequences first. At equal level, the risk with the heaviest consequences goes first: an unlikely critical consequence deserves more attention than a frequent inconvenience.
  • Obligations. A risk tied to a legal or contractual requirement cannot wait.
  • Common causes. Several risks that rest on the same weakness (an unsegmented network, a shared account) are treated together, and move up the ranking.
  • The trend. A threat that is intensifying in your sector justifies moving a risk up.

For management, the result comes in two complementary forms: a grid on which the risks are placed, and a ranked list that says which ones will be treated. Our articles on the risk matrix and risk mapping detail these representations.

The decision point: is the assessment sufficient?

Before moving on to treatment, you check that the assessment really allows a decision. If an important scenario is missing, if a rating rests on an unverified assumption, if two business lines do not read the scale in the same way, it is better to redo the step concerned. That is precisely why the process is iterative.

  • Do the risks kept cover the whole scope set with the context?
  • Does each risk have an owner who took part in rating it?
  • Is each rating justified in writing?
  • Are the requirements of interested parties all reflected in the consequences?

Running example: evaluation at Mécanique Vauclair

Risk evaluation (fictitious example, criteria from the "Context" chapter)
Ref.LevelComparison with the criteriaDecisionPriority
R1 Ransomware through remote maintenance12, highAbove the threshold: treatment mandatoryTo be treated1
R2 Theft of a customer's drawings8, mediumIntermediate zone; level 4 consequences and a contractual requirementTo be treated2
R3 Administration error on the ERP6, mediumIntermediate zoneTo be treated3
R4 Theft of a laptop3, lowBelow the thresholdAccepted by the CIONone

Frequently asked questions

What is the difference between risk analysis and risk evaluation?

Analysis assesses the consequences and likelihood of a risk and derives a level from them. Evaluation compares that level with the risk criteria set in advance and ranks the risks by priority for treatment. Together with identification, they make up risk assessment as defined by ISO 31000, ISO/IEC 27001 and ISO/IEC 27005.

What do you do with a risk below the acceptance threshold?

It can be kept without further treatment. It stays in the register with its owner and is re-examined in later assessments, because its level can change with the context or the threats.

Who decides on treatment priorities?

The ranking follows first from the levels of risk and the criteria set with the context. The final arbitration between close risks falls to the risk owners and to management, who hold the budget and accept the constraints. The CISO prepares the decision and keeps a record of it.

Should you present a risk matrix to management?

It is not a requirement of the standard, but it is an effective support: the grid shows at a glance which risks exceed the threshold. It is best accompanied by the ranked list of risks and, for each, a sentence that describes the scenario in terms of consequences for the business.

Sources

This chapter summarises and rephrases the official publications below. If in doubt, the official text prevails.

A platform and service that adapt to you

Our platform is designed for fine-tuned configuration and broad adaptability to your needs.

Request a demo