Key takeaways
- A note on sourcing: ISO/IEC standards are commercial, copyrighted documents, and this guide's research fetch received an HTTP 403 (access denied) response from ISO's own catalogue page rather than the rendered scope text.
- Don't treat ISO/IEC 27005 as something to certify against.
ISO/IEC 27005, "Guidance on managing information security risks," is the ISO/IEC standard most organizations reach for when an ISMS built on ISO/IEC 27001 needs an actual process for its risk assessment and treatment clauses. The current 4th edition was published in October 2022, replacing the 2018 edition, and realigned the standard's structure and vocabulary with both ISO/IEC 27001:2022 and the generic risk-management standard ISO 31000:2018. Unlike ISO/IEC 27001, it is guidance only — there is nothing in it to certify against — but it is often the document that actually decides how an organization's risk register gets built.
A note on sourcing: ISO/IEC standards are commercial, copyrighted documents, and this guide's research fetch received an HTTP 403 (access denied) response from ISO's own catalogue page rather than the rendered scope text. This guide draws on ISO's publicly indexed abstract/scope language as reproduced by secondary standards-analysis sources (PECB's published comparison of the 2018 and 2022 editions, Wikipedia's sourced edition history) rather than the purchased standard text — treat any clause-level detail below as a starting point to confirm against a purchased copy, not a verbatim quotation of the full standard.
What it guides you through, and what it doesn't require
ISO/IEC 27005's own scope statement, as indexed on ISO's catalogue, says it exists to help organizations fulfil ISO/IEC 27001's requirements for addressing information security risk and to perform information security risk assessment and treatment activities — applicable to "all organizations, regardless of type, size or sector." It supplements ISO/IEC 27001's clause 6.1.2 (risk assessment) and 6.1.3 (risk treatment), which state what an ISMS must do about risk without prescribing exactly how to run the process — ISO/IEC 27005 is the "how." It has no clauses of its own that an auditor checks off during an ISO/IEC 27001 certification audit; a certification body audits conformance to 27001's own clauses, with 27005 serving as explanatory background a Statement of Applicability or risk methodology can reference.
The five-stage process, and two ways to identify risk
The 2022 edition organizes the risk management cycle into five stages: context establishment, risk identification, risk analysis, risk evaluation, and risk treatment — dropping "risk acceptance" as its own sixth stage and instead treating acceptance of residual risk as a decision made inside the treatment stage once a treatment option is chosen. For risk identification specifically, the 2022 edition sets out two approaches an organization can use: an event-based approach, a higher-level, strategic view of how risk sources could affect stakeholders' objectives, useful for an initial or organization-wide pass; and an asset-based approach, the more familiar, granular analysis of specific assets, the threats facing them and their vulnerabilities, used to drive concrete treatment decisions. The standard also replaced the earlier term "incident scenario" with risk scenario — a sequence or combination of events leading from an initial cause to an unwanted consequence — matching ISO 31000:2018's vocabulary more closely than the 2018 edition did.
Why the 2022 edition changed at all
ISO/IEC 27005's revision history tracks the series it supports: the 2008 and 2011 editions predate ISO/IEC 27001:2013's current clause structure, the 2018 edition aligned loosely with 27001:2013, and the 2022 edition followed 27001's own 2022 revision (itself mainly an Annex A control restructuring — see our ISO/IEC 27001 guide) and ISO 31000's 2018 revision of the generic risk-management framework. The practical effect for an organization already running an ISMS: a risk methodology written against the 2018 edition's six-stage model, with "risk acceptance" as a separate step and "incident scenario" terminology, should be re-checked against the 2022 structure and vocabulary rather than assumed to still match the current edition word-for-word.
Where this sits next to NIST's risk publications
Teams that also touch US federal or federally-adjacent work will recognize the same problem addressed from a different standards family: NIST SP 800-30 (conducting risk assessments), SP 800-39 (organization-wide risk management) and the SP 800-37 Risk Management Framework cover the same assess-treat-monitor cycle for federal information systems. Neither family formally references the other for conformance purposes, so an organization operating under both typically keeps them as parallel processes — ISO/IEC 27005 under an ISO/IEC 27001 ISMS, NIST SP 800-30/39 under an RMF/SP 800-53 program — rather than merging them into a single risk methodology document.
A workable starting point
Don't treat ISO/IEC 27005 as something to certify againstOnly ISO/IEC 27001 is certifiable; 27005 is the methodology an auditor expects your risk assessment and treatment records to be consistent with, not a separate audit target. Re-check a pre-2022 risk methodology against the current five-stage structureIf your documented process still has a standalone "risk acceptance" stage or uses "incident scenario" language, it was likely written against the 2018 edition. Pick event-based or asset-based (or both) deliberatelyUse the event-based approach for an organization-wide first pass, and the asset-based approach where you need concrete, assignable treatment decisions for specific systems or firmware. Keep your NIST and ISO risk processes separate but cross-referenced, if you run both — don't try to collapse SP 800-30/39 and ISO/IEC 27005 into one methodology document; map their outputs to each other instead. Budget for a purchased copy before citing clause numbersThis guide describes the standard's structure at a high level; exact clause text and numbering should be confirmed against a purchased copy from ISO, IEC or a national member body.
SoftWSP's device and firmware security assessments can supply the asset-based risk evidence — SBOM, CVE exposure, firmware hardening findings — that an ISO/IEC 27005-style risk assessment needs as input: see Device & Firmware Security.
This guide summarizes ISO's publicly indexed catalogue information and independent secondary analysis of the 2022 revision; ISO/IEC 27005's full operative text is copyrighted and must be purchased from ISO, IEC or a national standards body. This guide is not a substitute for the full standard or for compliance/legal advice.
Sources
- ISO: ISO/IEC 27005:2022 — Information security, cybersecurity and privacy protection — Guidance on managing information security risks (catalogue page; this guide's research fetch received an HTTP 403 response rather than the rendered page)
- ISO/IEC 27001:2022, clauses 6.1.2 and 6.1.3 (risk assessment and risk treatment), ISO catalogue page
- PECB: ISO/IEC 27005:2022 — Main Changes and Implications (secondary analysis of the 2018-to-2022 revision)
- Wikipedia: ISO/IEC 27005 (edition history, 2008-2022, and relationship to ISO 31000)
- ISO 31000:2018 — Risk management — Guidelines, ISO catalogue page
Frequently asked questions
What is ISO/IEC 27005, and who publishes it?
ISO/IEC 27005 is "Information security, cybersecurity and privacy protection — Guidance on managing information security risks," published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) under their joint technical committee ISO/IEC JTC 1/SC 27. The current edition is the 4th, published in October 2022, which replaced the 3rd edition from 2018; earlier editions date to 2011 and 2008. Like other ISO/IEC standards, its full text is copyrighted and must be purchased from ISO, IEC or a national standards body (for example BSI, ANSI or DIN) — this guide draws on the publicly available scope/abstract text ISO publishes on its own catalogue page plus independent secondary analysis of the 2022 revision, not the purchased standard.
Is ISO/IEC 27005 certifiable, and how does it relate to ISO/IEC 27001?
No. ISO/IEC 27005 is explicitly guidance, not a set of auditable requirements — only ISO/IEC 27001 (the information security management system, or ISMS, requirements standard) is certifiable. ISO/IEC 27005 exists to help an organization fulfil ISO/IEC 27001's own risk-related clauses (notably clause 6.1.2, information security risk assessment, and 6.1.3, risk treatment) by supplying a detailed process those clauses reference but do not fully spell out themselves. See our guide to [ISO/IEC 27001](/guides/iso-iec-27001-isms-requirements/) for the certifiable ISMS requirements this guidance supports.
What changed in the 2022 edition compared with 2018?
The 2022 edition realigned its structure and terminology with ISO/IEC 27001:2022 and with ISO 31000:2018, the generic risk management standard. It restructured the risk management process around five stages — context establishment, risk identification, risk analysis, risk evaluation and risk treatment — removing risk acceptance as its own standalone process step and instead addressing residual-risk acceptance as a decision point inside the treatment stage. It also introduced two explicit risk identification approaches: an "event-based" approach (a higher-level view of how risk sources could affect an organization's objectives) and an "asset-based" approach (the more granular, traditional asset/threat/vulnerability analysis), and it replaced the term "incident scenario" with "risk scenario" to align with ISO 31000 vocabulary.
How does ISO/IEC 27005 relate to NIST's risk publications like SP 800-30 and SP 800-39?
They cover similar ground from different standards families: ISO/IEC 27005 guides information security risk management generally (for any organization, regardless of sector), while [NIST SP 800-30](/guides/nist-sp-800-30-risk-assessment/) and [SP 800-39](/guides/nist-sp-800-39-managing-information-security-risk/) are US government publications written primarily for US federal information systems and the [SP 800-37 Risk Management Framework](/guides/nist-sp-800-37-risk-management-framework/) they feed into, though both are widely used outside government too. Neither family formally cross-references the other as a conformance mechanism; an organization using both typically treats ISO/IEC 27005 as the risk-process layer under an ISO/IEC 27001 ISMS and NIST SP 800-30/39 as the risk-process layer under an RMF/SP 800-53 program, rather than trying to merge the two into one combined process.
In this cluster
