Step 2 · ISO/IEC 27005:2022, Clause 7
ISO 27005 risk identification: events, assets and owners
Identifying a risk means describing it precisely enough to analyse it and to find someone responsible for it. The standard offers two starting points, events or assets, and asks you to name an owner for each risk. This chapter shows how to run the step and what a well-described risk looks like.
- Clause
- 7, Risk assessment: identification
- Participants
- Business owners, management, CISO, CIO, operations
- Deliverable
- List of described risks, with their owner
Guide chapters
In brief
-
Identification has to find, recognise and describe risks: what can happen, why, and what the organisation would lose.
-
The standard offers two approaches: event-based, starting from what the organisation fears, and asset-based, starting from the inventory of assets and their vulnerabilities. They can be combined.
-
A risk is described as a risk scenario: a sequence of events leading from an initial cause to an unwanted consequence.
-
Risk sources are not only attackers: the standard also covers human error, failure and natural events.
-
Each risk is given an owner (7.2.2), the person with the accountability and authority to manage it. ISO/IEC 27001 requires this.
What to describe for each risk
ISO 31000, whose vocabulary ISO/IEC 27005 adopts, defines risk as the effect of uncertainty on objectives. For information security, clause 6.1.2 of ISO/IEC 27001 specifies the angle: risks associated with the loss of confidentiality, integrity and availability of information within the scope.
A usable risk answers four questions. If one is missing, the analysis that follows becomes a matter of opinion.
| Element | Question | Example |
|---|---|---|
| Risk source | Who or what is at the origin? | A cybercriminal group, an employee who makes a mistake, a power failure |
| Event | What happens? | Encryption of the workshop servers |
| What is affected | Which information, which process, through which asset? | The machining programs, through the workshop file server |
| Consequence | What does the organisation lose? | Production stopped, late deliveries, penalties |
The 2022 edition reasons in risk scenarios: the chain that links the initial cause to the consequence. Writing each risk as a complete sentence ("this source causes this event on this asset, which leads to this consequence") is usually enough.
Event-based approach or asset-based approach
The standard describes two ways of identifying risks. They are not opposed: they do not look at the same level.
| Event-based | Asset-based | |
|---|---|---|
| Starting point | What the organisation fears and what could cause it | The inventory of assets, their threats and their vulnerabilities |
| Level | Strategic, overall view | Operational, detailed |
| With whom | Management, business owners | IT, operations, application owners |
| Number of scenarios | Small | Large, to be grouped |
| Mainly used to | Assess consequences, set priorities | Assess likelihood, choose controls |
| Risk of the method | Staying too general to act on | Getting lost in the inventory |
In the asset-based approach, a distinction is made between what has value for the organisation (information and processes, often called primary assets or business assets) and what carries them (hardware, software, networks, premises, people, suppliers: the supporting assets). A vulnerability is found on a supporting asset; a consequence is measured on a primary asset. An up-to-date map of the information system makes this work much easier.
Do not forget unintentional sources
A risk source is an element which, alone or in combination with others, can give rise to risk. It can be human, acting deliberately or by mistake, or be environmental or technical. An assessment that only looks at attackers misses a share of real incidents: accidental deletion, a failed update, the failure of a single piece of equipment, a flooded server room.
This is a difference from EBIOS Risk Manager, which focuses its scenarios on intentional sources and leaves accidental ones to the security baseline, as the Club EBIOS notes. If you use that method within an ISO 27005 framework, check that accidental risks are covered, either by the baseline or by added scenarios.
Name the risk owners
Subclause 7.2.2 of the standard deals with identifying risk owners, which clause 6.1.2 of ISO/IEC 27001 also requires. The owner is the person, or entity, with the accountability for the risk and the authority to manage it. The owner is the one who will approve the treatment plan and accept the residual risk.
- The owner is generally the manager of the activity that would suffer the consequence, not the person who administers the system.
- The owner must have the power to decide: arbitrate a budget, accept a constraint, give up a practice.
- The CISO facilitates the process and informs decisions. If the CISO owns every risk, nobody really does.
Running example: the risks identified at Mécanique Vauclair
A three-hour workshop with the executive committee brings out what the company fears: the workshop stopping, a leak of a customer's drawings, the loss of management data. The CISO and the CIO then go down to asset level for the first two. Four risks are kept for the rest of the guide.
| Ref. | Risk scenario | Approach | Owner |
|---|---|---|---|
| R1 | A cybercriminal group gets in through a machine manufacturer's remote maintenance access, spreads and encrypts the workshop servers: production stopped | Events, then assets | Production director |
| R2 | An attacker obtains a designer's account through phishing and copies a customer's drawings: breach of confidentiality, contract at risk | Events, then assets | Head of the design office |
| R3 | An administrator deletes ERP data by mistake during maintenance: orders to be re-entered, delays | Assets | CIO |
| R4 | A laptop is stolen during a business trip: the disk is encrypted, the loss is limited to the hardware | Assets | CIO |
Frequently asked questions
What is the difference between the event-based and asset-based approaches?
The event-based approach starts from what the organisation fears and from the risk sources that could cause it: it gives an overall, strategic-level view. The asset-based approach starts from the inventory of assets, their threats and their vulnerabilities: it is more detailed. ISO/IEC 27005:2022 presents both and allows them to be combined.
What is a risk scenario?
It is the sequence, or combination, of events leading from an initial cause to an unwanted consequence. Describing a risk as a scenario forces you to specify the source, the event, what is affected and the consequence, which then makes the analysis more reliable.
Who is the owner of a risk?
The person or entity with the accountability for the risk and the authority to manage it. In practice, it is the manager of the activity that would suffer the consequence. ISO/IEC 27001 requires risk owners to be identified, and they are the ones who approve the treatment plan and accept the residual risks.
How many risks should you identify?
The standard sets no number. A useful register contains the risks that someone is able to follow and review: grouping neighbouring scenarios is better than multiplying lines. A register that nobody rereads protects nothing.
Sources
This chapter summarises and rephrases the official publications below. If in doubt, the official text prevails.
- ISO/IEC 27005:2022, Information security, cybersecurity and privacy protection: guidance on managing information security risks (4th edition), ISO, October 2022.
- ISO/IEC 27005:2022, public preview: scope, terms and definitions, table of contents, ISO, Online Browsing Platform.
- ISO/IEC 27001:2022, Information security management systems: requirements, ISO, October 2022.
- ISO 31000:2018, Risk management: guidelines, ISO, February 2018.
- What is the link between EBIOS RM and ISO 27005?, Club EBIOS, October 2022.
- EBIOS Risk Manager, the guide (version 1.5, in French), ANSSI.
A platform and service that adapt to you
Our platform is designed for fine-tuned configuration and broad adaptability to your needs.