ISO 27001 Risk Assessment: Method, Template and Worked Examples

An ISO 27001 risk assessment is the process clause 6.1.2 of ISO/IEC 27001:2022 requires you to define, document and apply: you set risk criteria, identify risks to the confidentiality, integrity and availability of information in your ISMS scope, give each risk an owner, analyse it and evaluate it against your acceptance criteria. Everything else in the ISMS follows from it, including the Statement of Applicability (SoA), the risk treatment plan and the controls you implement.

The standard says what the process must achieve, not which method to use. This guide covers the ISO-specific requirements, how ISO/IEC 27005 helps you choose a method and a register template with worked examples. For a general method that works outside ISO 27001, see our cyber security risk assessment guide.

What does ISO 27001 require for risk assessment?

Four clauses govern risk. Clause 6.1.2 defines the assessment process and 6.1.3 the treatment process; 8.2 requires you to carry out assessments and 8.3 to implement treatment, keeping the results of both. This is what 6.1.2 demands and what a certification auditor will ask to see:

Clause 6.1.3 then turns the results into treatment decisions, controls, the SoA and a treatment plan that risk owners approve. Do not confuse either with 6.1.1, which covers risks and opportunities for the ISMS achieving its intended outcomes rather than information security risks. The other clauses are explained in our guide to ISO 27001 requirements.

How do you do an ISO 27001 risk assessment?

1. Start from the scope and context. The ISMS scope (4.3), issues (4.1) and interested parties’ requirements (4.2) tell you which information matters and which laws and contracts shape the consequences.
2. Write the methodology. Define scales, acceptance criteria, the identification approach, who takes part and how often you reassess. Have top management approve the acceptance criteria, because they set the organisation’s risk appetite.
3. Identify risks. Use an asset-based or event-based approach (below) and record which of confidentiality, integrity and availability each risk affects, and who owns it.
4. Analyse. Score likelihood and consequence with existing controls taken into account, and note why.
5. Evaluate. Compare each score with the acceptance criteria. Anything above the line goes to treatment.
6. Treat. Choose an option, decide the controls, check them against Annex A, update the SoA and treatment plan, then get each risk owner to sign off the residual risk.
7. Repeat and report. Reassess at planned intervals and after significant change, and take the results to management review (9.3).

Asset-based or event-based: which method should you use?

ISO/IEC 27005:2022 describes two ways to identify risks. Either is acceptable for ISO 27001; many organisations use event-based scenarios for their top risks and asset-based detail for critical systems.

How should you set likelihood, consequence and acceptance criteria?

ISO 27001 does not prescribe scales, only that they produce consistent, valid and comparable results. A five-point scale for likelihood and consequence is common; our cyber security risk assessment guide has example definitions. For ISO 27001, define consequence in terms of a loss of confidentiality, integrity or availability and its legal, contractual, financial and operational effect.

The part most methods leave vague is acceptance. Write down who may accept what:

These are example values. Set your own, approve them and apply them consistently.

Is there an ISO 27001 risk assessment template?

ISO does not publish one, but apart from the risk criteria and the Statement of Applicability, which are separate documents, everything 6.1.2 and 6.1.3 ask for fits in a single risk register.

What columns does an ISO 27001 risk register need?

Use these columns, each mapped to the clause it evidences:

Download the free ISO 27001 risk assessment template (.xlsx), free and with no sign-up. It has every column above, plus threat, vulnerability, scoring rationale, treatment actions and due dates, with dropdowns for the treatment options, automatic scoring against the acceptance criteria above and the four worked examples below, marked EXAMPLE. A separate Treatment plan sheet turns those examples into a sample risk treatment plan. For help adapting it to your ISMS, use the form on this page.

ISO 27001 risk assessment examples

Four worked examples on a five-point scale, scored with existing controls in place and banded using the acceptance table above. The scores illustrate the method; yours will depend on your context.

Follow the first example through: the SoA marks 5.15, 5.16, 5.18 and 6.5 as applicable, citing that risk as the reason; the treatment plan names the action, owner and due date; and under 8.3 the evidence is the closed change and the quarterly access review records.

What goes in an ISO 27001 risk treatment plan?

The risk treatment plan is the clause 6.1.3 e) record of how each risk above your acceptance criteria will be treated, by whom and by when. Clause 6.1.3 f) requires each risk owner to approve it and accept the residual risk, and clause 8.3 requires you to carry it out and keep the results. ISO 27001 does not prescribe a format, so the test is whether an auditor can follow each risk from its score to a completed action.

Start by choosing one of the four treatment options that ISO/IEC 27005 describes for each risk:

Then, for every risk you modify, record the actions, the action owner, the resources needed, the due date and the target residual score. Report progress at management review (9.3) and update the plan as actions close or new risks appear. The free template’s Treatment plan sheet is laid out this way: one row per action, with its owner, resources, due date, status and the evidence that it is done, plus the risk owner’s approval, and the risk details fill in from the register when you type the risk ID.

How does the risk assessment feed the Statement of Applicability?

Every control you mark as applicable should trace back to a risk treatment, a legal or contractual requirement or a business need, and every Annex A control you exclude needs a reason. Auditors usually check this link first, because an SoA that does not match the treatment plan is a common nonconformity. Our Statement of Applicability guide explains the required columns, and our guide to ISO 27001 Annex A controls explains all 93 controls you compare against.

What is ISO 27005?

ISO/IEC 27005:2022, “Guidance on managing information security risks”, is the fourth edition of the standard, published in October 2022, and ISO’s main guidance on information security risk management. It applies the risk management principles of ISO 31000 to information security and gives guidance on carrying out the risk requirements of ISO 27001, including the event-based and asset-based approaches above.

It is guidance, not requirements: you cannot be certified to ISO 27005, and you do not have to buy it to pass an ISO 27001 audit.

How often must you repeat the risk assessment?

At planned intervals you set, and whenever significant changes are proposed or occur (clause 8.2). The standard sets no frequency, but reassessing the whole register at least once a year is common practice. Triggers for an interim update include a new system or cloud service, a new supplier with access to your data, an acquisition, a serious incident and test results that reveal weaknesses you had not scored. Penetration testing for ISO 27001 is one of the best sources of evidence for honest likelihood scores.

What do auditors find wrong with ISO 27001 risk assessments?

• Acceptance criteria that are missing or were never approved.
• Every risk owned by “IT” rather than a named person.
• Scores with no rationale, so the results cannot be reproduced.
• SoA controls that trace back to no risk, or high risks with no treatment.
• Residual risk never formally accepted by the risk owner.
• No reassessment after a significant change.
• A generic register copied from a template, with risks that do not match the scope.

Why Sovereign Secure

• ISO 27001 certified ourselves, so our own risk assessment is audited against the same clauses.
• Hands-on consultancy. Our ISO 27001 consultancy covers the ISMS scope, business impact analysis, risk assessment and Statement of Applicability, run with your risk owners rather than handed over as a template. Certification audits are carried out by our partner, the independent certification body MQA International.
• Evidence for likelihood. We run penetration testing and vulnerability scanning, so scores rest on test results rather than assumptions.
• PCI DSS as well. As a PCI SSC Qualified Security Assessor (QSA) company, we know where the PCI DSS targeted risk analysis sits alongside an ISO 27001 risk assessment.
• UK company since 2012, headquartered in Accrington, Lancashire.

What is the next step?

If you are starting from scratch, an ISO 27001 gap analysis shows where you stand and where the risk assessment fits in your plan. Download the risk register template to get started, and to talk through your method, use the form on this page or call +44 161 523 5276.