7 steps to run ISO 27001 risk assessment

In this blog post, we'll cover:

• What is information security risk management?
• What is information security risk assessment, and why is it important?
• How does an ISO 27001 risk assessment work?
• How does reviewing and monitoring ISMS continuously help you prepare for a risk assessment?
• How does ISO 27001 define and treat risks?
• What does ISO 27001 require when conducting a risk assessment?
• What are the seven simple steps to an effective ISO 27001 risk assessment?
• How can small or medium organisations conduct risk management?
• Should you conduct an ISO 27001 risk assessment?
• How does ISO 27001 help with risk management?

What is information security risk management?

Risk management is likely the most difficult aspect of ISO 27001 implementation. Still, it's also the most important phase at the start of any information security project, as it lays the groundwork for information security in your organisation.

It entails recognising, analysing, and responding to threats to your organisation's asset confidentiality, integrity, and availability. The end objective of this approach is to address risks in accordance with the overall risk tolerance of an organisation.

The aim is to determine and attain an acceptable risk threshold for your organisation rather than expecting to remove all hazards.

On the other hand, risk assessment (also known as risk analysis) and risk treatment are the two fundamental components of risk management. Let's take an in-depth look below.

What is information security risk assessment, and why is it important?

A security risk assessment finds, evaluates, and applies application security measures. It also focuses on preventing security flaws and vulnerabilities in applications.

An enterprise may see its application portfolio holistically from the standpoint of an attacker by conducting a risk assessment. It assists you in making well-informed decisions about resource allocation, tools, and security control implementation. As a result, completing an evaluation is an important aspect of an organisation's risk management strategy.

In general, risk assessments are conducted across the whole organisation. Once the risk assessment has been conducted, your organisation needs to decide how to manage the risks based on allocated resources and budget.

They cover all the possible risks to which information could be exposed, balanced against the likelihood of materialising risks and their potential impact. Now that we've covered the description of risk assessment let's take a look at how a risk assessment works.

How does an ISO 27001 risk assessment work?

The complexity of risk assessment is affected by factors like size, growth rate, resources, and asset portfolio. When faced with money or time restrictions, organisations might conduct generic evaluations. However, generalised evaluations may not always include precise mappings of assets, related threats, recognised risks, effects, and mitigation mechanisms.

If the findings of the generalised assessment do not offer enough of a link between these areas, an in-depth evaluation is required. The results of a risk assessment form the basis of an ISMS. To reduce recognised risks, organisations must develop a set of controls.

Information security risk assessments must be performed at regular intervals, and if adjustments are required – both must be fully recorded.

How does reviewing and monitoring ISMS continuously help you prepare for a risk assessment?

ISO 27001 mandates that the information security management system (ISMS) be reviewed, updated and improved on a regular basis to ensure that it is working properly and adapting to the environment.

An internal audit is one component of evaluating and testing. This necessitates the ISMS manager generating a set of reports demonstrating that risks are being effectively addressed.

While an information security risk assessment may be conducted in a spreadsheet on a basic level, it is significantly better to have a tool that simplifies the documentation side of the risk assessment.

How does ISO 27001 define and treat risks?

Risk is defined as the "impact of uncertainty on objectives" by ISO 27001, and "uncertainty" is the reason we can't entirely control all risks (after all, you can't defend against what you don't know or understand). However, you can plan for this.

An RTP (risk treatment plan) is an important aspect of the ISO 27001 implementation process that outlines how your organisation will respond to recognised threats. Organisations should modify the risk by:

• Implementing a control to reduce the likelihood of it occurring
• Avoiding the risk by ceasing any activity that causes it
• Sharing the risk with a third party by outsourcing security efforts to another organisation and purchasing cyber insurance to ensure you have the funds to respond appropriately in the event of a disaster
• Retaining the risk by accepting it and believing that the cost of treating it will be less than the cost of preventing it

What does ISO 27001 require when conducting a risk assessment?

ISO 27001 mandates you to record the whole risk assessment process (Clause 6.1.2), which is completed in the Risk Assessment Methodology document.

Typically, most organisations find this challenging as they begin risk assessment without a methodology. You need a clear plan and instructions to set up your organisation for success.

 As a starting point, here is what Clause 6.1.2 requires:

• Define how to spot the threats that might compromise your data's confidentiality, integrity, and/or availability
• Establish a method for identifying the risk owners
• Define the criteria for evaluating repercussions and determining the risk's likelihood
• Define the method for calculating risk
• Define the risk-acceptance criteria

In short, you need to identify these five aspects, and anything less will not be sufficient. Use this as a foundation for your plan.

What are the seven simple steps to an effective ISO 27001 risk assessment?

A risk assessment process that meets the requirements of ISO 27001 should have seven steps:

1. Establish an ISO 27001 risk assessment framework

This is the first stage in your ISO 27001 risk assessment journey. It’s important for your organisation to handle risk assessment consistently. As a result, you need to develop guidelines that explain how the process is undertaken.

The largest difficulty with risk assessment is when various portions of your organisation do it differently. As a result, you must decide if you want a qualitative or quantitative risk assessment, which scales to use for qualitative evaluation, and what amount of risk is acceptable, among other things.

Several concerns must be addressed in a formal risk assessment methodology:

• The most important security criteria for your organisation
• The scale of risk
• Appetite for risk
• Methodology: Risk assessment based on scenarios or assets

2. Create a list of your organisation's information assets

Making a list of your information assets is one method to undertake a risk assessment for your company.

The first method is asset-based, which implies that your company must concentrate on the risk to its information assets. This method takes longer to detect concerns, but it provides a more comprehensive picture of risk.

The second method is scenario-based, which means your company must concentrate on scenarios that might lead to a data breach. Users are more likely to recognise risk circumstances in this report, which frequently speeds up the risk identification process. However, one downside of this strategy is that users frequently overlook some factors that may pose a risk. As a result, the risk assessment is lacking.

3. Identify risks

Once you understand the rules, you can determine which potential problems may affect you. First, list all of your assets, then threats and vulnerabilities related to those assets, assess the impact and likelihood of each combination of assets/threats/vulnerabilities, and finally calculate your risk level.

4. Evaluate risk impact

Some risks are more serious than others, so you will need to figure out which ones are the most pressing at this point. That is why it is critical to rank risks according to their chance of occurrence and the potential damage they can inflict.

Create a checklist based on these characteristics to evaluate risks to your risk appetite, as well as identify and prioritise hazards that need to be addressed. You will benefit from a consistent and comparative evaluation of the hazards your organisations face by analysing the risks in this manner.

5. Create a Statement of Applicability

The Statement of Applicability (SoA) depicts your organisation’s security profile; you must identify all the controls you have installed, why you have implemented them, and how you have implemented them, based on the results of the risk assessment in ISO 27001.

This document is crucial since it will be used as the audit's major guideline by the certification auditor.

6. Create a risk treatment plan

You must identify risk owners for all risks, according to ISO 27001. This body is in charge of approving any risk mitigation strategies as well as accepting the residual risk level.

Human error introduces numerous risks to an organisation, and it's rare that you will be able to eliminate them entirely. As a result, most risks will have to be modified. This entails implementing controls as described in ISO 27001 Annex A as part of the mitigation strategy.

7. Review, monitor and audit internally 

To guarantee that you have accounted for changes in how your organisation functions as well as the evolving threat environment, you will need to repeat the assessment process every year.

Mitigation techniques, responsibilities, budget, and timeline should all be included in the risk assessment strategy.

You should also take advantage of this chance to seek methods to improve your ISMS. This might include moving to a new risk treatment option or adopting a different control to handle risks.

How can small or medium organisations conduct risk management?

Many smaller organisations are attempting to adopt risk management software as part of their ISO 27001 implementation project. However, some of these are designed keeping large organisations in mind.

Here are some suggestions for making risk management easier for small organisations:

Select the appropriate framework

The framework should be streamlined to include the ISO 27001-required parts. If you end up employing a framework that you replicated from a major organisation, risk assessment and treatment will take months instead of days.

Select the appropriate instrument

Look for software that follows your (simplified) technique. In certain circumstances, a well-designed Excel template will outperform more complex software.

Include the relevant individuals

You should not try to accomplish this on your own; you should enlist the help of the leaders of all of your departments since they are the most knowledgeable about their processes, which means they are the most aware of possible difficulties.

Make no attempt to be faultless

Instead of attempting to uncover all of the risks the first time around, you should complete your risk assessment and treatment first, then return later to include any hazards that were missed.

To summarise, risk assessment and treatment are the pillars of ISO 27001, but they do not have to be difficult. Always remember to adapt the process to fit your organisational needs.

Should you conduct an ISO 27001 risk assessment?

The ISO 27001 risk assessment is a method for systematically evaluating your organisation's risks, understanding how they could affect your information security, and implementing a strategy to reduce those risks.

ISO 27001 focuses on risk assessment and treatment, allowing you to not only identify which incidents may compromise your information security but also establish the best strategies to prevent or mitigate them.

You may also prioritise each risk so that instead of wasting time, effort, or money treating all risks, you can concentrate your efforts on the most important ones. An ISO 27001 risk assessment might be advantageous for your organisation for all of these reasons.

The risk assessment framework is outlined clearly in ISO 27001 and elaborated in ISO 27005; information security risk assessment focuses on maintaining confidentiality, integrity, and availability.

How does ISO 27005 help with risk management?

ISO 27005 is a standard dedicated completely to the management of information security risks. It is extremely beneficial if you want to better understand information security risk assessment and treatment.

Start risk assessment to protect your organisation

Risk assessments are not only an audit exercise, regardless of whether your organisation adopts ISO 27001. A dynamic risk assessment is a real-time procedure that addresses issues as they arise. On a daily level, everyone is responsible for risk management.

Need some guidance on your ISO 27001 risk assessment? DataGuard's information security experts are there for you. We can help manage your information security, conduct risk analysis and get you ISO 27001 certified.

Check out our ISO 27001 solution or book a free consultation with us.