ISO 27005 Risk Assessment — Information Security Risk Management
ISO 27005 explains how to run the information security risk assessment and treatment that ISO 27001 requires. The 2022 edition supports both asset-based and event-based (scenario) approaches.
Mutex Systems builds a risk method you can repeat every year, and a register your board can read.
- Category
- Compliance Framework
- Jurisdiction
- International
- Issuing Body
- ISO / IEC
- Current Version
- ISO/IEC 27005:2022
- Who It's For
- Organisations implementing ISO 27001, and any organisation needing a defensible cyber risk assessment for regulators, insurers or boards.
Core Domains
A Practical Compliance Path
- 01
Set criteria
Agree scales, appetite and acceptance rules.
- 02
Assess
Workshops to identify and rate risks.
- 03
Treat
Treatment plans linked to controls and owners.
- 04
Review
Regular review driven by incidents, findings and change.
Risk you can explain to a board
Short scenarios in business language, scored consistently, each linked to the controls that reduce it.
- Repeatable methodology document
- Risk register and treatment plan
- Board risk report
A live risk register, not a spreadsheet
grComply’s risk register uses your own scoring method, shows a live heat map, and raises risks automatically from scan findings and auditor observations.
- Configurable likelihood and impact scales
- Inherent and residual scores with history
- Risks raised from findings and observations
- Treatment plans linked to controls
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About ISO 27005
Is ISO 27005 mandatory for ISO 27001?
No. ISO 27001 requires a risk assessment process but not a specific method; ISO 27005 is the most common guidance auditors recognise.
What changed in ISO 27005:2022?
It aligned terminology with ISO 27001:2022 and ISO 31000 and added event-based (scenario) risk identification alongside the asset-based approach.
Ready to Start Your ISO 27005 Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.