Book a consultation
Information security & privacy / Guidance standard

ISO/IEC 27005: Information security risk management guidance

Guidance for running information security risk assessment and treatment that satisfies ISO 27001.

Talk to a consultant Start with a gap assessment

ISO/IEC 27005:2022 describes event-based and asset-based approaches to identifying, analysing, evaluating and treating information security risks. We help you choose a method your team can sustain and connect it to enterprise risk management under ISO 31000.

Who it is for

  • ISMS managers and risk owners
  • Organisations reworking their risk methodology

What you gain

  • A defensible, repeatable risk method
  • Consistency with enterprise risk management

How we help you apply it

  1. Maturity review

    Assess current practice against the guidance and agree what good looks like for your organisation.

  2. Framework design

    Translate the principles into a practical framework, roles and tools that fit your existing management systems.

  3. Embedding

    Workshops and coaching so teams apply the framework in day-to-day decisions.

  4. Review and reporting

    Periodic reviews and reporting that show progress to leadership and stakeholders.

ISO/IEC 27005 questions

Is ISO 27005 mandatory for ISO 27001?
No, but it is the most widely used guidance for meeting ISO 27001’s risk assessment requirements.

Ready to start on ISO/IEC 27005?

Tell us which standard or customer requirement you are facing. In a free 30-minute call we will outline the gaps, a realistic timeline and what it will take to be audit-ready.

Book a free consultation Try the standard finder