# ISO/IEC 27005: Information security risk management guidance

> Guidance for running information security risk assessment and treatment that satisfies ISO 27001.

URL: https://securei3.com/standards/iso-27005/
Category: Information security & privacy: Guidance standard
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


ISO/IEC 27005:2022 describes event-based and asset-based approaches to identifying, analysing, evaluating and treating information security risks. We help you choose a method your team can sustain and connect it to enterprise risk management under ISO 31000.

## Who it is for

- ISMS managers and risk owners
- Organisations reworking their risk methodology

## Benefits

- A defensible, repeatable risk method
- Consistency with enterprise risk management

## How Secure iQube helps

1. **Maturity review**: Assess current practice against the guidance and agree what good looks like for your organisation.
2. **Framework design**: Translate the principles into a practical framework, roles and tools that fit your existing management systems.
3. **Embedding**: Workshops and coaching so teams apply the framework in day-to-day decisions.
4. **Review and reporting**: Periodic reviews and reporting that show progress to leadership and stakeholders.

## Frequently asked questions

### Is ISO 27005 mandatory for ISO 27001?

No, but it is the most widely used guidance for meeting ISO 27001’s risk assessment requirements.

Related: https://securei3.com/standards/iso-27001/, https://securei3.com/standards/iso-31000/

Contact: https://securei3.com/contact/: info@securei3.com