{"history":[],"article":{"id":"88134715-2351-4d23-b972-2fa6b0369655","title":"ISO/IEC 27005","slug":"iso-iec-27005","content":":::summary\n:::\n\n# \n**ISO/IEC 27005 \"Information technology — Security techniques — Information security risk management\"** is an international standard published by the [International Organization for Standardization](https://bliptext.com/articles/international-organization-for-standardization) (ISO) and the [International Electrotechnical Commission](https://bliptext.com/articles/international-electrotechnical-commission) (IEC) providing good practice guidance on managing risks to information.\nIt is a core part of the [ISO/IEC 27000-series](https://bliptext.com/articles/iso-iec-27000-series) of standards, commonly known as ISO27k.\nThe standard offers advice on systematically identifying, assessing, evaluating and treating information security risks - processes at the very heart of an ISO27k Information Security Management System (ISMS).\nIt aims to ensure that organizations design, implement, manage, monitor and maintain their information security controls and other arrangements rationally, according to their information security risks.\nThe current fourth edition of ISO/IEC 27005 was published in October 2022.\n\n# Overview\nISO/IEC 27005 does not specify or recommend specific risk management methods in detail.\nInstead it discusses the process in more general/overall terms, drawing on the generic risk management method described by ISO 31000 i.e.:\nWithin that broad framework, organizations are encouraged to select/develop and use whichever information risk management methods, strategies and/or approaches best suit their particular needs - for example:\n\n# Objectives\nThe [ISO/IEC 27000-series](https://bliptext.com/articles/iso-iec-27000-series) of standards are applicable to all types and sizes of organization - a very diverse group, hence it would not be appropriate to mandate specific approaches, methods, risks or controls for them all.\nInstead, the standards provide general guidance under the umbrella of a management system.\nManagers are encouraged to follow structured methods that are relevant to and appropriate for their organization's particular situation, rationally and systematically dealing with their information risks.\nIdentifying and bringing information risks under management control helps ensure that they are treated appropriately, in a way that responds to changes and takes advantage of improvement opportunities leading over time to greater maturity and effectiveness of the ISMS.\n\n# Structure and content of the standard\nISO/IEC 27005:2018 has the conventional structure common to other ISO/IEC standards, with the following main sections:\n

Background\n

Overview of the information security risk management process\n

Context establishment\n

Information security risk assessment\n

Information security risk treatment\n

Information security risk acceptance\n

Information security [risk communication](https://bliptext.com/articles/risk-communication) and consultation\n

information security risk monitoring and review\n\nAnd six appendices:\n

Defining the scope and boundaries of the information security risk management process\n
Identification and valuation of assets and impact assessment\n
Examples of typical threats\n
Vulnerabilities and methods for vulnerability assessment\n
Information security risk assessment approaches\n
Constraints for risk modification\n

","current_revision":null,"created_by":"kACnuQmH5k9Nr5VNVEpVeg7XpvUmMctD","created_at":"2025-01-26T09:56:28.168Z","updated_at":"2025-01-26T09:56:28.168Z","search_vector":"'27005':2 'iso/iec':1","search_content":" \n \n\n# \n**ISO/IEC 27005 \"Information technology — Security techniques — Information security risk management\"** is an international standard published by the [International Organization for Standardization](https://bliptext.com/articles/international-organization-for-standardization) (ISO) and the [International Electrotechnical Commission](https://bliptext.com/articles/international-electrotechnical-commission) (IEC) providing good practice guidance on managing risks to information.\nIt is a core part of the [ISO/IEC 27000-series](https://bliptext.com/articles/iso-iec-27000-series) of standards, commonly known as ISO27k.\nThe standard offers advice on systematically identifying, assessing, evaluating and treating information security risks - processes at the very heart of an ISO27k Information Security Management System (ISMS).\nIt aims to ensure that organizations design, implement, manage, monitor and maintain their information security controls and other arrangements rationally, according to their information security risks.\nThe current fourth edition of ISO/IEC 27005 was published in October 2022.\n\n# Overview\nISO/IEC 27005 does not specify or recommend specific risk management methods in detail.\nInstead it discusses the process in more general/overall terms, drawing on the generic risk management method described by ISO 31000 i.e.:\nWithin that broad framework, organizations are encouraged to select/develop and use whichever information risk management methods, strategies and/or approaches best suit their particular needs - for example:\n\n# Objectives\nThe [ISO/IEC 27000-series](https://bliptext.com/articles/iso-iec-27000-series) of standards are applicable to all types and sizes of organization - a very diverse group, hence it would not be appropriate to mandate specific approaches, methods, risks or controls for them all.\nInstead, the standards provide general guidance under the umbrella of a management system.\nManagers are encouraged to follow structured methods that are relevant to and appropriate for their organization's particular situation, rationally and systematically dealing with their information risks.\nIdentifying and bringing information risks under management control helps ensure that they are treated appropriately, in a way that responds to changes and takes advantage of improvement opportunities leading over time to greater maturity and effectiveness of the ISMS.\n\n# Structure and content of the standard\nISO/IEC 27005:2018 has the conventional structure common to other ISO/IEC standards, with the following main sections:\n Background\n Overview of the information security risk management process\n Context establishment\n Information security risk assessment\n Information security risk treatment\n Information security risk acceptance\n Information security [risk communication](https://bliptext.com/articles/risk-communication) and consultation\n information security risk monitoring and review\n \nAnd six appendices:\n \n Defining the scope and boundaries of the information security risk management process\n Identification and valuation of assets and impact assessment\n Examples of typical threats\n Vulnerabilities and methods for vulnerability assessment\n Information security risk assessment approaches\n Constraints for risk modification\n ","revisionCount":0},"hasMore":false,"nextCursor":null}

History