ISO 27005 provides guidelines for information security risk management, complementing ISO 27001 requirements.
ISO/IEC 27005:2022 provides guidance for information security risk management aligned with ISO 27001. It describes the complete process: identification, analysis, evaluation and treatment of risks within the ISMS context.
No. ISO 27001 requires risk assessment but does not prescribe a specific methodology. ISO 27005 is the most aligned and recommended guide for meeting that requirement.
It strengthens the event and risk scenario-based approach, aligning with ISO 27001:2022 and its new 93-control Annex A.
Need an assessment in this area?