What is ISO/IEC 27005?
ISO/IEC 27005 is the international guidance standard for managing information security risks: it describes how an organisation identifies, analyses, evaluates, treats and keeps monitoring the risks to its information and systems. The standard supports the implementation of an Information Security Management System (ISMS) in line with ISO 27001, which requires you to assess and treat risks but does not explain how. The current version is ISO/IEC 27005:2022, the fourth edition, developed by the joint ISO/IEC committee JTC 1/SC 27.
ISO 27005 is applicable in both IT and OT environments, provided the risk criteria also weigh process disruption, safety and the environment.
🧠 What does ISO 27005 describe?
The full title of the 2022 edition is Information security, cybersecurity and privacy protection - Guidance on managing information security risks. It is guidance, not a requirements standard: you cannot be certified against ISO 27005. Certification is against ISO 27001; ISO 27005 helps you carry out the risk process that standard requires in a demonstrable and repeatable way.
The standard is method-neutral. It does not prescribe how you calculate a risk. You may choose a qualitative risk matrix, a semi-quantitative scoring model or a quantitative method such as FAIR. Established methods such as OCTAVE or NIST SP 800-30 also fit within the framework, as long as the results are consistent, valid and comparable.
| Edition | Year | Key feature |
|---|---|---|
| First edition | 2008 | First guidance on risk management for the ISO 27000 family |
| Second edition | 2011 | Aligned with ISO 31000:2009 |
| Third edition | 2018 | Titled Information technology - Security techniques - Information security risk management |
| Fourth edition | 2022 | Aligned with ISO 27001:2022 and ISO 31000:2018, risk scenarios, two identification approaches |
| European adoption | 2024 | EN ISO/IEC 27005:2024, adopted by CEN without modification in August 2024 |
🔧 How does the ISO 27005 risk process work?
The process is iterative: you repeat it periodically and whenever something significant changes, such as a new installation, an incident or new legislation. The 2022 edition explicitly names triggers that start a new cycle.
- Establishing the context
- Business objectives, Assets, processes and external requirements (such as NIS2, AVG and IEC 62443), plus the risk criteria: how you scale likelihood and consequence and which risk is acceptable
- Risk identification
- Risk sources, threats, vulnerabilities, threatened assets and possible consequences, described as risk scenarios
- Risk analysis
- Likelihood × consequence → risk level (qualitative, semi-quantitative or quantitative)
- Risk evaluation
- Comparing risks against the acceptance criteria and setting priorities
- Risk treatment
- Choosing to modify the risk (mitigating measures), retain it (conscious acceptance), avoid it (stop the activity) or share it (transfer, for example through insurance or a contract)
- Acceptance of residual risk
- The risk owner formally accepts the risk that remains after treatment (in the 2022 edition part of risk treatment, clause 8.6.3; a separate process step in earlier editions)
- Communication, monitoring and review
- Informing stakeholders, monitoring risks and improving continuously through the PDCA cycle
| Clause (2022) | Content |
|---|---|
| 6 | Context establishment, mainly defining the risk criteria |
| 7 | Risk assessment: identification, analysis, evaluation |
| 8 | Risk treatment, including acceptance of residual risk |
| 9 | Operation: performing assessment and treatment in practice |
| 10 | Leveraging ISMS processes: leadership, communication, documentation, monitoring, management review, improvement |
| Annex A | Examples of risk criteria and practical techniques |
🧭 What is the difference between the event-based and the asset-based approach?
The 2022 edition introduces the concept of a risk scenario: a sequence or combination of events leading from the initial cause to the unwanted consequence. It replaces the earlier term incident scenario. To find scenarios, the standard describes two complementary approaches.
| Feature | Event-based | Asset-based |
|---|---|---|
| Starting point | Risk sources and their objectives, such as criminals, state actors or internal errors | Inventory of assets with their threats and vulnerabilities |
| Level | Strategic, top-down, high level | Operational, bottom-up, detailed |
| Strong at | Quickly identifying strategic scenarios and their consequences, without a complete asset inventory | Finding concrete vulnerabilities and controls per asset |
| OT example | ”Ransomware group stops production for two weeks" | "Unprotected Modbus traffic to a PLC without authentication” |
| Pitfall | Too abstract for technical controls | Without a complete asset list, risks remain invisible |
In practice you combine both: the event-based approach determines which scenarios matter to the board, and the asset-based approach works out the vulnerabilities, likelihood and controls for each scenario. Techniques such as threat modelling and MITRE ATT&CK help describe realistic attack paths.
🔄 How does ISO 27005 relate to ISO 27001 and ISO 31000?
| ISO 27001 | ISO 27005 |
|---|---|
| Determines that risk management is required (clauses 6.1.2, 6.1.3, 8.2 and 8.3) | Describes how to perform risk management |
| Focuses on the ISMS structure | Focuses on the substantive analysis |
| Requires a Statement of Applicability | Helps you justify including or excluding controls |
| Certifiable | Guidance, not certifiable |
ISO 31000 is the generic standard for risk management in any domain; ISO 27005 translates its principles and terms to information security. ISO 27002 then describes the controls themselves.
The ISO 27005 risk process determines which controls you need; you then compare them with Annex A of ISO 27001, which includes Access Control, Logging and Backup. How to implement those controls is described in ISO 27002.
🏭 How do you apply ISO 27005 in an OT environment?
In OT, cybersecurity risk management is less about confidentiality and much more about availability, process integrity and physical safety. That requires adapted risk criteria and an asset inventory that goes beyond servers and laptops.
| Element | Application in OT |
|---|---|
| Assets | PLC, HMI, Historian, Engineering Station, network components and the processes they control |
| Vulnerability | Outdated firmware, default passwords, unencrypted industrial protocols |
| Threat | Exploitation of a known vulnerability, ransomware spreading from the office network |
| Consequence | Downtime, process disruption, product loss, environmental damage or danger to people |
| Likelihood | Medium without a patch policy and without segmentation |
| Controls | Patch management, Firewall rules, network monitoring, segmentation |
A practical approach for a production site:
- Define OT-specific consequence criteria - for example a 5×5 matrix in which consequence level 5 means injury or environmental damage and level 4 means more than a day of lost production
- Record the asset list per zone - following the zones and conduits model of IEC 62443-3-2, which assigns target security levels (SL) to each zone
- Reuse safety studies - a HAZOP or Business Impact Analysis shows which process disruptions are truly critical
- Record the results in a risk register - with risk owner, chosen treatment, residual risk and review date
- Repeat after changes - every new connection between IT and OT is a trigger for a new assessment
Combine ISO 27005 for the organisation-wide risk process with IEC 62443-3-2 for the technical risk assessment per zone. IEC 62443-3-2 does not prescribe a risk method, so an ISO 27005-based approach fits well, as long as the steps and results are traceable.
🇳🇱 Why is ISO 27005 relevant to the Dutch Cybersecurity Act and the BIO?
The Dutch Cybersecurity Act (Cyberbeveiligingswet) and the Cybersecurity Decree (Cyberbeveiligingsbesluit) entered into force on 15 August 2026. Their duty of care requires essential and important entities to perform risk management with an established risk analysis method and criteria for risk acceptance. These are exactly the elements ISO 27005 works out. ISO 27005 is not legally mandatory, but it is a common and auditable way to demonstrate compliance with the duty of care.
For Dutch government organisations, the BIO (BIO2) is risk-driven: a quick scan per process or system and a full risk analysis where the baseline level is not sufficient. There too, ISO 27005 provides the methodological basis.
✅ What are the benefits and limitations of ISO 27005?
- Structured approach to risk assessment that auditors recognise
- Flexible in method selection, from a simple matrix to quantitative analysis
- Supports Defense in Depth and Security by Design, because controls can be traced back to risks
- Compatible with NIST CSF, IEC 62443, COBIT and NIS2
- Limitation: the standard provides no ready-made threat catalogue or calculation model; you have to choose or develop these yourself
- Limitation: without OT-specific criteria, an IT-focused application underestimates the consequences for safety and continuity
❓ Frequently asked questions
Can an organisation be certified against ISO 27005?
No, ISO 27005 is guidance and not a requirements standard, so certification is not possible. Organisations are certified against ISO 27001 and use ISO 27005 to carry out the risk process that ISO 27001 requires. Auditors do regard an ISO 27005-based approach as strong evidence.
What is the latest version of ISO 27005?
The latest version is ISO/IEC 27005:2022, the fourth edition, published in October 2022. It is aligned with ISO 27001:2022 and ISO 31000:2018. In Europe this text has been adopted as EN ISO/IEC 27005:2024.
What is a risk scenario in ISO 27005?
In ISO 27005, a risk scenario is a sequence or combination of events leading from a cause to an unwanted consequence. Since the 2022 edition, the term replaces the earlier incident scenario. An example is a phishing email that leads to ransomware on an engineering workstation and then to a production stop.
Which risk method does ISO 27005 prescribe?
ISO 27005 does not prescribe a specific risk method. You choose a qualitative matrix, a semi-quantitative model or a quantitative method such as FAIR yourself, as long as the results are consistent and repeatable. Annex A of the standard gives examples of risk criteria and techniques.
Is ISO 27005 suitable for OT environments?
ISO 27005 is suitable for OT, provided you extend the risk criteria with process availability, physical safety and environmental impact. For the technical assessment per zone, the standard is usually combined with IEC 62443-3-2. This connects the organisation-wide ISMS to the risk assessment of the control system.
Does ISO 27005 help with the Dutch Cybersecurity Act?
ISO 27005 helps with the Dutch Cybersecurity Act, because the Cybersecurity Decree requires a risk analysis method and criteria for risk acceptance. The standard describes exactly how to define and document them. Using ISO 27005 is not mandatory, but it makes compliance with the duty of care much easier to demonstrate.
📌 In summary
ISO/IEC 27005 is the international guidance standard that describes how you identify, analyse, evaluate and treat information security risks within an ISMS. The 2022 edition adds risk scenarios and an event-based approach alongside the asset-based one. With OT-specific criteria and IEC 62443-3-2, it applies in both IT and OT environments and supports the duty of care under the Dutch Cybersecurity Act.