ISO 27005 risk management

ISO/IEC 27005 is guidance on managing information security risks. It is not certified on its own: it describes the risk method behind the risk assessment and treatment that ISO 27001 requires, which auditors check first.

What it requires

The main obligations in plain words, with the article or clause they come from.

  • Clause 6

    Set the context, and the criteria for accepting risks and for performing risk assessments.

  • Clause 7

    Identify risks and their owners, analyze consequences and likelihood, and evaluate the results against the criteria.

  • Clause 8

    Choose treatment options, determine the controls, compare them with Annex A, produce the Statement of Applicability and a treatment plan the risk owners approve.

  • Clauses 9–10

    Assess risks at planned intervals; communicate and consult, document, monitor and review.

How Atitic covers it

What the product does for this framework, on the same records as every other.

  • The risk register: inherent and residual scores against the risk appetite you set, owners, treatment plans and reviews scheduled by severity.

  • Formal risk acceptance with a reason and an end date.

  • Requirements about the risk register point to it; the crosswalk ties each step to the ISO 27001 clauses on risk.

  • Fasttrack recommends ISO 27005 alongside ISO 27001.

What the catalogue holds

The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.

  • 6 Context establishment5
  • 7.2 Risk identification3
  • 7.3 Risk analysis3
  • 7.4 Risk evaluation2
  • 8 Risk treatment5
  • 8.6 Risk acceptance2
  • 9 Operation2
  • 10.3 Communication and consultation2
  • 10.5 Monitoring and review4
  • 10.4 Documented information2

Related frameworks: ISO 27001 DORA

Common questions

Do we need ISO 27005 for ISO 27001 certification?

No. ISO 27001 requires a risk method but leaves the choice to you; ISO 27005 describes a recognized one that auditors know.

Does ISO 27005 prescribe a risk formula?

No. It describes the steps and leaves the scales, the criteria and the approach, event-based or asset-based, to the organization.

Does it help with DORA?

DORA requires a documented process to identify and assess ICT risks. ISO 27005 describes one you can adopt.

A summary for orientation, not legal advice. The official text is the reference.

Try it on your own data

Adopt ISO 27005 in a free trial, link the evidence you already have and see what is still missing.

Start a free trial