Platform
Modules
By sector
By sector
By standard
Blog
News
Events
ISO/IEC 27005
Teams doing the information-security risk assessment that ISO 27001 clauses 6.1.2 and 6.1.3 require.
ISO 27005 is the guidance for managing information security risk - the assessment and treatment that ISO 27001 requires but does not describe. ComplyTrain runs it as a living register, not an annual document.
ISO 27001 requires you to assess information security risk and to treat it, in clauses 6.1.2 and 6.1.3. It does not tell you how. ISO/IEC 27005 is the guidance that does: how to establish criteria, identify risk, analyse and evaluate it, decide treatment, and keep the whole thing under review.
It sits inside the ISO 31000 risk process rather than beside it, applied specifically to information security. If you already run risk to ISO 31000, ISO 27005 is that process pointed at your information assets.
There is no ISO 27005 certificate. The certificate is ISO 27001, and your risk assessment is one of the things the auditor examines to award it. What ISO 27005 gives you is a defensible method - which matters, because the most common finding against a risk assessment is not that the risks are wrong but that nobody can explain how they were arrived at.
There are two honest ways to start. The asset-based approach works from what you hold - systems, data, people - to the threats against each and the vulnerabilities that let a threat land. It is thorough and it is how most organisations begin, because the inventory already exists.
The scenario-based approach works from what could happen - a ransomware event, a supplier breach, an insider taking a customer list - back to what would have to be true. It produces fewer, larger risks that a board can actually discuss, and it tends to find the cross-cutting exposures an asset list misses.
Neither is more correct. What matters for an audit is that you chose one deliberately, applied it consistently, and can say why. A register that mixes both without a stated method is the one that struggles under questioning.
The most common weakness in an information security risk assessment is that the acceptance criteria were written after the scoring. Decide what you will tolerate, on what scale, and who is entitled to accept a risk above it - before any risk is scored. Criteria set afterwards are criteria fitted to the answer.
An information security risk assessment fails an audit for one of two reasons: it was done once and never revisited, or two people scoring the same risk would not arrive at the same answer. ComplyTrain addresses both:
See risk management for how the methodology and the register work, and ISO 31000 for the wider process it sits inside.
Tell us how you need to work with ISO/IEC 27005 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No. ISO 27005 is guidance. Your certificate is ISO 27001, and the risk assessment done to ISO 27005 is part of the evidence for it.
ISO 31000 is the general risk management process for any kind of risk. ISO 27005 applies that process specifically to information security, with the vocabulary of assets, threats and vulnerabilities. If you run both, they are the same process at different scopes rather than two systems.
You do not, and separating them usually costs more than it saves. One register with the right scoping lets a board see the whole risk picture while a security team still works only its own view.
On a defined cadence and whenever something material changes - a new system, a new supplier, an incident, a change of scope. The standard does not set a frequency; what an auditor tests is whether your own stated cadence is being met.
No. It describes the process and leaves the scale to you, which is deliberate: a five-point scale that means something to your organisation is worth more than a seven-point one borrowed from a template. What it does expect is that the scale is defined, that the definitions are written down, and that they are applied consistently.
Directly. The risk assessment identifies the risk, the treatment decision selects the control that addresses it, and the Statement of Applicability records that selection with its justification. An auditor reading the three together is checking that they tell one story.
The process
ISO 27005 gives information security risk management a repeatable shape. It is guidance, not a certifiable standard, and it is what makes the risk clauses of ISO 27001 workable in practice.
Decide what the assessment covers, who owns it, and the criteria you will judge risks against. Criteria set before the assessment are the ones that survive contact with an uncomfortable result.
Work from assets, threats and vulnerabilities, or from the events that would hurt you, or both. ISO 27005 supports either approach rather than insisting on one.
Understand consequence and likelihood, then compare each risk against your criteria to decide which need treatment. The comparison is the decision point, and it belongs on the record.
Choose a treatment, name an owner, and record what residual risk was accepted and by whom. Then keep the register live, because a risk assessment with a date on it is a historical document.
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversOur consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksWe run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service meansOne system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
Learn how to qualify, approve and monitor sub-suppliers, flow down requirements through purchase orders, and keep the records an auditor will ask to see under ISO 9001 clause 8.4 and AQAP.
Learn how to run an ISO 9001 Clause 9.3 management review that turns evidence into decisions, with the right inputs, actionable outputs, and a cadence that fits your risks.