ISO 27001 Risk Assessment Step-by-Step
Ready to improve your ISO 27001 risk scoring?
This guide explains risk identification, scoring, treatment and reporting so your ISMS is audit-ready and resilient against the most significant threats.
As an organisation, your Information Security Management System is one of the most integral parts of your functionality. It is there to keep information protected and secured, especially sensitive information that could cause risk if it were ever leaked. However, developing and maintaining such a system requires you to have a deep understanding of risk management.
After all, the whole point of risk management and assessment is to identify and mitigate all of the most notable and dangerous threats to the security and integrity of your ISMS. It might seem quite daunting, but it can be broken down into a series of simple steps that we’re going to take you through so that you have a better understanding of ISO 27001 risk assessment.
What is ISO 27001 Risk Management
ISO 27001 risk management can be broken down into two parts: risk assessment and risk treatment. Risk assessment is a process that must establish and maintain security risk procedures while also identifying and analysing the risks. Risk treatment is all about finding solutions and implementing fixes that can mitigate the most notable risks.
Steps for ISO 27001 Risk Assessment
There are six key steps for undertaking an ISO 27001 risk assessment, each of which has been laid out clearly below to help maximise your ISO 27001 risk scoring.
Define and Establish Risks
First, you need to outline how you intend to measure and evaluate the risks to your ISMS. It’s something that you will have to develop yourself, and based on the industry you’re in, since it can vary greatly between them. The entire risk assessment should be tailored to your organisation, but this is especially true of the risk owners.
Identify Security Risks/Vulnerabilities and Document Them
Once the outline is finished, you will need to identify any and all risks and vulnerabilities within your system. It is very easy to determine security concerns with these steps:
- Build a list that contains all of your information assets.
- List every potential threat and risk that could be associated with each asset.
- Create a comprehensive risk register that contains all of this information.
Analyse and Prioritise the Risks
Once the register is complete, you can use it to score each risk according to how much of a threat it is to your ISMS. It should be done according to probability and impact, which is why a numerical risk assessment matrix is the best option for this step. It allows you to prioritise the threats properly and assign them a risk level based on the two axes (probability and impact).
Implement Your Risk Treatment Options
Now that the risk assessment is complete, you can start treating the risks. You will need to do this individually to see how you can reduce or negate its impact through the Annex A controls in ISO 27001. That way, you can ensure your treatment options are compliant with the standard. Make sure to document each treatment and the corresponding controls for your SoA.
Complete Risk Reports
Your ISO 27001 auditor will need to see all of your documentation and reports, which is why it’s so important for you to keep thorough records of all the evidence. This is everything from the planning process to the implementation and management. Normally, you will need to provide the following reports:
- Risk assessment report (with results)
- Risk summary report (with justification of selection and prioritisation)
- Risk treatment plan (with the corresponding controls)
Monitor and Review ISMS
Risk management doesn’t end. It’s something constant and ongoing that will need to be monitored and reviewed regularly. The reassessments will also mean that you will find new flaws and non-conformities to fix, and your treatment plan will have to be updated regularly to protect against new threats. Risk assessments should be done annually at the very least.
Request an ISO 27001 Risk Assessment Pre-Assessment →
