How do we set up an ISO 27001 risk assessment and treatment method that stands up to an audit?

Start

We need a risk method for our ISO 27001 risk assessment

The standard asks for a defined risk assessment and a defined risk treatment process, each applied and documented. An auditor tests that the criteria are set, that repeated assessments give consistent results, that each risk has an owner, and that owners approved the treatment and accepted the residual risk. The method has to exist before the first risk is scored.

• Then: Has top management approved the ISMS scope?

Decision

Has top management approved the ISMS scope?

Every risk depends on what is in scope, so a scope changed after the risk assessment means assessing again. The scope comes first in the plan's order, and top management approves it before the assessment starts. If you are not sure it is approved, answer no.

• Yes: Fix the criteria before anyone scores a risk
• No, or not known: Hold the risk assessment until the scope is approved

Outcome

Hold the risk assessment until the scope is approved

Scoring risks against a scope that may change produces scores that are thrown away. Settle the scope first, then come back to this question.

Step

Fix the criteria before anyone scores a risk

Write down how impact and likelihood are rated, with an anchor for each level, and which residual risks may be accepted and by whom. Risks scored before the criteria are fixed are scored again once they are, and the first scores confuse the owners. Where a risk sits between two levels, the pack's method uses the higher.

• Then: Does a risk method you already use cover information security?

Decision

Does a risk method you already use cover information security?

A group-wide enterprise risk method can serve as the risk assessment process if it covers information security risk and states the acceptance criteria. A method that only lists risks, or that has no acceptance criteria, does not. If you do not know whether it states them, answer no.

• Yes: Test it against the criteria and add what it lacks
• No, or not known: Write a short method of your own

Step

Test it against the criteria and add what it lacks

Check that it sets acceptance criteria you can measure, that its scales work for information security harm such as data loss and service stop, and that it names risk owners. Add the missing parts as a short annex rather than writing a second method. Approve the combined method before any risk is scored.

• Then: Does every risk have one named owner who can accept it?

Step

Write a short method of your own

One method of a few pages is enough: the scales and anchors, how a risk is written, who owns it, how it is rated before and after controls, and what each band decides. The pack's method writes each risk as a scenario with a threat, the weakness it uses, the service affected and the consequence. Use any approach your people can repeat.

• Then: Does every risk have one named owner who can accept it?

Decision

Does every risk have one named owner who can accept it?

A risk owner is the executive accountable for the service or asset the risk would hurt, named by role, not a committee or the security team. The owner decides the treatment and signs the acceptance, and may delegate the work but not the decision. The security function owns a risk only where the harm falls on its own duties.

• Yes: Rate each risk, compare it with the criteria and rank it
• No, or not known: Name an owner for each risk and confirm they agree

Step

Name an owner for each risk and confirm they agree

Ask the owner to read the risk and agree it is theirs. An owner who has not seen the risk cannot approve its treatment or accept what remains, and an auditor looks for owners who can say what their risks are. Record the owner by role in the register.

• Then: Rate each risk, compare it with the criteria and rank it

Step

Rate each risk, compare it with the criteria and rank it

Rate the consequence and the likelihood, before and after existing controls, and read the band from the matrix. Compare each result with the acceptance criteria and put the risks outside them in order for treatment. Record a reason for every rating, so another person can re-derive the result.

• Then: Do two assessors reach the same rating on the same risks?

Decision

Do two assessors reach the same rating on the same risks?

The standard asks that repeating an assessment gives the same answer, so two people rating the same risk should agree. Have two assessors score the same risks independently and compare. A difference of one level on one rating is normal; a difference that changes the band shows an anchor that needs clearer wording. If you have not tested it, answer no.

• Yes: Is any risk above what the criteria let you accept?
• No, or not tested: Tighten the anchors and rate the risks again

Step

Tighten the anchors and rate the risks again

Change the anchor or add an example in the method itself, not in the assessors' heads, and record the change. Then rate the affected risks again. Repeat the exercise each year.

• Then: Rate each risk, compare it with the criteria and rank it (back to an earlier step)

Decision

Is any risk above what the criteria let you accept?

A risk within the criteria needs no new treatment decision, though the owner may still reduce it where that is cheap. A risk above them needs a decision on how to treat it. Either way you still decide the controls, because legal and contractual requirements also select them. If a residual rating is not known, treat that risk as above the criteria.

• Yes, or not known: Choose reduce, avoid, transfer or accept for each one
• No, all within the criteria: Decide the controls each treatment needs, from any source

Step

Choose reduce, avoid, transfer or accept for each one

Reduce changes the likelihood or the impact with controls. Avoid stops the activity. Transfer shares the impact, for example by insurance or contract, and the owner still owns the risk. Accept keeps the residual risk knowingly, recorded and approved at the right level.

• Then: Decide the controls each treatment needs, from any source

Step

Decide the controls each treatment needs, from any source

Controls come from the treatment you chose, and from any source: your own controls, a customer's requirement or the law. Where no risk is above the criteria, the controls come from those requirements and from what you already run. Choosing from Annex A first produces a checklist that has to be rewritten once the risk work is done.

• Then: Compare the controls with Annex A to catch anything missing

Step

Compare the controls with Annex A to catch anything missing

Annex A is the check, not the source. Go through its controls and ask whether any necessary control is missing from your list, and record the comparison. The certification body looks for evidence that the chosen controls were compared with Annex A.

• Then: Record every decision in the Statement of Applicability

Step

Record every decision in the Statement of Applicability

List all 93 controls, and for each say whether it applies, why, and whether it is implemented. A control that applies is tied to the risks it treats, or to the law or contract that requires it. An exclusion needs a reason that follows from the risk assessment.

• Then: Write the treatment plan: action, owner, date, expected residual risk

Step

Write the treatment plan: action, owner, date, expected residual risk

Each action has an owner, a due date, a cost and the residual score expected when it is done. The plan can be a section of the risk register or the gap tracker, if every action links to a risk and the approval is recorded. The pack drafts this plan during the risk assessment and finishes it once the controls are chosen. Keep it up to date as actions close.

• Then: Have the risk owners approved the plan and accepted what remains?

Decision

Have the risk owners approved the plan and accepted what remains?

The owners approve the treatment plan and accept the residual risks, and the record shows it. Acceptance is approved at the level the band requires, and outside tolerance only the board or its equivalent may accept. Residual risk not accepted by the risk owners is a gap auditors commonly find. If there is no record, answer no.

• Yes: Method, assessment and plan approved: keep the records
• No, or no record: Take it back to the risk owners for a recorded decision

Outcome

Take it back to the risk owners for a recorded decision

Put each risk and its plan to its owner, with the residual risk in plain words, and get a signed or minuted decision. Where the criteria send a risk to the top, who decides depends on how you are governed: the board or a committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board.

Outcome

Method, assessment and plan approved: keep the records

Keep the method, the dated assessment results, the treatment plan, the Statement of Applicability and the owners' acceptance as controlled records. Reassess at the planned interval and after a significant change, and review the Statement of Applicability when the assessment changes. Later results of treatment become records too.