What Is the Risk Assessment in ISO 27001

January 12, 2021

ISO 27001 certification is an internationally accepted information security management system (ISMS) that enables organisations to prove that they follow the best practices for cybersecurity measures. It’s an accredited certification that tells users that if they decide to share their personal information with your business, then this data will be safe with you.

ISO 27001 addresses many aspects of a business’ operations, such as information security policies, human resources security, access control, asset management, operations security, as well as compliance with both internal and external policies.

Because it is so encompassing, ISO 27001 risk assessment is often one of the most complex (and also most important) parts of this framework’s implementation. The very philosophy of ISO 27001 is to identify threats and vulnerabilities and establish a risk management framework that will enable you to avoid them.

In this article, we will try to better understand what risk assessment in ISO 27001 is, and how you can identify risks and take action on pre-established criteria.

What Is ISO 27001 Risk Assessment?

An ISO 27001 risk assessment is a framework that helps organisations identify, evaluate, and treat risks that could affect their information security processes. It’s an essential part of the ISO 27001 certification and it can help companies understand the specific scenarios under which their data could be compromised, evaluate risks, determine the damage breaches in each scenario could cause, and establish the impact and likelihood of these threats.

Because the stake is so high and the process is extremely complex, developing an effective information security risk assessment plan is crucial. Let’s take a look at the steps you should take to ensure the development and implementation of an effective ISO 27001 risk assessment plan.

Steps to a Successful ISO 27001 Risk Assessment Plan

Step 1: Create a Risk Assessment Methodology

One of the keys to effective ISO 27001 risk assessment is creating a clear risk management framework. That means all the key actors in your organisation know when, who, and how you will identify risk. Moreover, you also need to create a framework for how those potential risks will affect the availability and integrity of your data, the estimated damage each breach will cause, as well as a risk treatment plan.

Step 2: Be Smart About How You Identify Risks

Identifying risks is often the most time-consuming and error-prone part of an ISO 27001 risk assessment plan. Of course, it’s also the part that could impact the success of your efforts. So, it’s paramount that you are smart about how you approach this step.

We always recommend businesses to follow an asset-based risk assessment approach. That means a list of information assets so that you can rest assured that you didn’t leave any area of your organisation uncovered.

Step 3: Analyse Risks

Now that you’ve created a comprehensive list of information assets, it’s time to try and identify the risks and vulnerabilities that apply to each asset.

Try to identify the threat first and then uncover the vulnerability. For example, if the threat is a “phishing scam” then you could base the risk on vulnerabilities like “lack of security awareness programs for employees.”

Step 4: Evaluate the Risks

It would be unreasonable and wasteful to try and avoid all possible risks and threats that your organisation may face. That’s why you need a way to evaluate each risk and determine which ones you need to prioritise and which you can simply ignore as the damage they could inflict on your company is insignificant.

Create a risk assessment matrice that includes the probability of each risk to occur and the damage it could cause. Then, based on this data, you can determine which risks you should address.

Step 5: The Risk Treatment Plan

Up until now, all your work has been purely theoretical. Now, it’s time to design the actual risk treatment plan and put all these suggestions into practice.

You will need to define who will implement which method, in which timeframe, and with what resources.

There are several risk treatment options, such as:

Avoiding the risk by eliminating it;
Share the risk with a third party, such as an insurance company;
Apply security controls to modify the risk (for example, many risks are introduced by employees, but since you can’t run your company without employees, you can’t eliminate these types of risks completely. So you will need to find the relevant controls to modify the risk;
Try to contain the risk if it falls under the established risk acceptance criteria.)

Step 6: Risk Assessment Report

Creating and implementing an effective ISO 27001 risk assessment plan is important, but your work doesn’t end once you’ve finished this part. You also need to create reports based on your risk assessment for audit and certification processes. SoA (Statement of Applicability) and RTP (risk treatment plan) are two of the most important documents you will need to follow on your findings.

An SoA document must contain a list of controls that you will implement (or not) together with explanations for why you’ve selected or dismissed them.

As mentioned before, the risk treatment plan provides a summary of each identified risk, the way you will deal with the risks, the persons assigned to handle it, the timeframe, resources, and so on.