Is it…
Do we need a separate register of risks and opportunities for our ISMS itself, apart from our risk register?
Add to board memoOpen the memo
The short answer
- Recommendation
- Take the issues and parties you recorded, list what could stop the ISMS working and what could improve it, give each an owner and action, and keep them as a flagged category in your risk register or a short separate list. Either is acceptable if the link and the actions are visible.
- Reasoning
- Planning the ISMS asks for risks and opportunities to the system itself: ownership, resources, supplier dependence and the like. The information security risk assessment is about risks to information. Mixing the two leaves the second looking like the first and the first missing. Public guides do not list a separate register as required for this clause, so what matters is that an auditor can follow the link from your context to planned actions.
- Considerations
- The standard's text is paywalled. That a separate register is not required comes from public guides, which do not list one. Check with your certification body.
- The examples of ISMS risks here come from the pack's common failure modes. Your own context decides yours.
- Opportunities are easily skipped. Recording that you considered them and took none up is better than silence.
The decision, step by step
Select any step for the reasoning behind it and where the pack covers it.
- Start
- Step
- Decision
- Outcome
Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.
Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.
Read as text
The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.
Start
We must show we considered risks and opportunities to the ISMS
This is the planning step that sits before the risk assessment. It asks what could prevent the ISMS achieving its intended results, and what could improve it. It is a short list, but an auditor looks for the thread from your context to the actions.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanPhase 2 — Assess risk (5 weeks)
- P08-A02 ISO 27001 Implementation Methodology & Project PlanCommon failure modes
Decision
Are the issues and interested parties' requirements recorded?
The list starts from them. Without them you are guessing at what the ISMS must achieve. If they are not recorded or not current, answer no.
- Yes: Ask what could stop the ISMS achieving its intended results
- No, or not known: Record them first
In the pack
- P08-A10 Stage 1 and Stage 2 Audit Preparation GuideWhat the auditor samples, by clause
Step
Record them first
Record the issues and the parties' requirements, then return here. The record can be short, and it is the evidence the auditor looks for first.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanPhase 1 — Decide and scope (3 weeks)
Step
Ask what could stop the ISMS achieving its intended results
Think about the system, not the assets. The pack's common failure modes are good prompts: top management not involved, gaps with no owner or date, an internal audit done by the person who runs the system, a plan never reassessed, findings patched rather than fixed.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanCommon failure modes
Step
Keep them apart from risks to information
A risk to a laptop's data belongs in the information security risk assessment. A risk that the ISMS manager leaves and nobody can run the audit belongs here. Public guides draw the same line between the two clauses. Keep each on its own list or category so neither crowds out the other.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanPhase 2 — Assess risk (5 weeks)
Decision
Is there an opportunity worth taking up?
Opportunities are things that would improve the ISMS: a measure that would help you decide, a tool that would collect evidence, a customer requirement that gives value to the certificate. The management review also takes up improvement opportunities. If none, answer no.
- Yes: Does your risk register let you filter by category and owner?
- No: Record that you considered opportunities and took none up
In the pack
- P08-A09 Management Review Meeting PackThe decisions to record
Step
Record that you considered opportunities and took none up
Silence looks like the question was never asked. One dated line, with the owner, shows it was considered. The management review can add some later.
In the pack
- P08-A09 Management Review Meeting PackThe decisions to record
Decision
Does your risk register let you filter by category and owner?
If it does, a flagged category is enough. If you are not sure, or the register is a document nobody filters, keep a short separate list. Either form works if an auditor can see owners, actions and dates.
- Yes: Add a category for risks and opportunities to the ISMS
- No, or not known: Keep a short separate list
In the pack
- P08-A05 Mandatory ISMS Documentation ChecklistRequired Documents
Step
Add a category for risks and opportunities to the ISMS
Use the register you already have. Mark each item as an ISMS risk or opportunity, so it can be listed on its own for the management review.
In the pack
- P08-A05 Mandatory ISMS Documentation ChecklistRequired Documents
Step
Keep a short separate list
A one-page table is enough: the item, the issue or party it came from, the owner, the action and the date. Keep it with the ISMS records so the auditor finds it with the context record.
In the pack
- P08-A05 Mandatory ISMS Documentation ChecklistRequired Documents
Step
Give each item an owner, an action and a date
A risk with no owner is a note. Put each action into a process that already runs, such as the gap tracker, the objectives or the management review, so it is followed up without new machinery.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanThe rules (rule IS-08)
- P08-A07 ISMS Gap & Remediation TrackerGap Register
Decision
Can you tell whether each action worked?
The test is a measure, a check or a date when you will look. Without one an action stays open and nobody knows. If you cannot say, answer no.
- Yes: Take the list to the management review
- No, or not known: Add a measure or a date for a check
In the pack
- P08-A10 Stage 1 and Stage 2 Audit Preparation GuideWhat the auditor samples, by clause
Step
Add a measure or a date for a check
Link the action to an objective or a measure where one fits, or set a date for the owner to report back. The choice of measures is the monitoring question.
In the pack
- P08-A09 Management Review Meeting PackThe pre-read pack, with owners
Step
Take the list to the management review
Management reviews changes that affect the ISMS and opportunities for improvement. Show the list, what changed and what was decided. Refresh it when the context record changes.
In the pack
- P08-A09 Management Review Meeting PackThe agenda
- P08-A09 Management Review Meeting PackThe decisions to record
Outcome
ISMS risks and opportunities recorded, owned and followed
You can now show the thread from context to actions. Do not present this list as your information security risk assessment, and do not describe it as a register the standard demands. It is the evidence of planning.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanPhase 2 — Assess risk (5 weeks)
Practical checklist
- Start from the recorded issues and interested parties' requirements.
- List what could stop the ISMS achieving its intended results, such as top management involvement, ownership or time.
- List opportunities, or record that you considered them and took none up.
- Keep them in the risk register as a flagged category, or in a short separate list.
- Give each item an owner, an action and a date, and put the action in an existing process.
- Add a way to tell whether each action worked, and take the list to the management review.
Evidence to have ready
- A dated list or register category showing ISMS risks and opportunities, with owners.
- The link from context and interested parties' requirements to those items and their actions.
- Management review minutes where the list or its actions were considered.
Assumptions
- You have recorded your issues and interested parties' requirements, or are about to.
- You aim for ISO/IEC 27001:2022, whose planning clause treats risks and opportunities to the ISMS separately from the information security risk assessment.
- You keep, or will keep, an information security risk register of the kind the risk method question describes.
Not covered here
- Setting the risk assessment and treatment method for risks to information. That is “How do we set up an ISO 27001 risk assessment and treatment method that stands up to an audit?”.
- Building a risk register from nothing. That is “How do we build a risk register from nothing?”.
- Deciding the issues and requirements the list starts from. That is “How do we decide which issues and interested parties' requirements our ISMS has to address?”.
- Setting measurable objectives. That is “How do we write an information security policy and objectives that stand up to an ISO 27001 audit?”.
Related questions
- How do we decide which issues and interested parties' requirements our ISMS has to address?
- How do we set up an ISO 27001 risk assessment and treatment method that stands up to an audit?
- How do we write an information security policy and objectives that stand up to an ISO 27001 audit?
- How do we decide what to monitor and measure in our ISMS, and who evaluates it?
- How do we run a management review that actually decides things?