How to do risk assessment in ISO 27001?

The core of any organisation’s ISO 27001 compliance project is risk assessment. Without risk assessments, you cannot ensure that your Information Security Management System (ISMS) addresses security threats appropriately and comprehensively. In this article, we will discuss what a risk assessment is and what an information security risk assessment is and outline the steps to conduct an ISO 27001 risk assessment to answer “how to do risk assessment ISO 27001?”

What is a risk assessment?

Before answering “how to do risk assessment ISO 27001?”, let’s discuss what a risk assessment is. Risk assessment is an in-depth inspection of an organisation’s procedures, policies and documentation to identify potential threats that could hamper the company’s business, growth, effectiveness, functionality or reputation. For detailed information about ISO 27001 cost, contact Edara Systems.

What is an information security risk assessment?

With respect to information risk management, ISO 27001 certification risk assessment helps organisations identify, assess, and handle incidents that have the potential to impact their sensitive data negatively. The entire process involves highlighting vulnerabilities that a cybercriminal could identify and exploit, besides identifying mistakes that an employee could commit unknowingly. The purpose is to make the management system impenetrable to such vulnerabilities or mistakes. Moreover, such assessments also help organisations determine their risk level and decide upon the best course of action to treat them.

How to conduct an ISO 27001 risk assessment?

Let’s dig into the answer of “how to do risk assessment ISO 27001?” question. Risk assessments can seem overwhelming, but we have simplified and broken down the ISO 27001 risk assessment process into seven uncomplicated steps:

1. Define your risk assessment method: The ISO 27001 standard has not specified any specific risk assessment procedure. Instead, they recommend organisations customise their approach according to their unique needs. To select the most appropriate method for your organisation, you should begin by looking at your organisation’s context. Looking at the context of your organisation will help you understand your legal, regulatory and contractual obligations, in addition to cementing your objectives concerning information security and your broad business targets. The context will also help you understand the expectation of your stakeholders. By gathering this information, you can identify, create, or modify your risk criteria. Your risk criteria is an agreed-upon method of measuring risks, usually created per the individual impact that the risks will cause. Some methods of building the risk criteria also include their likelihood of occurrence. Your risk criteria should be widely understood and clearly defined so that the results from any two risk assessments can produce comparable results. Finally, you can determine your risk acceptance criteria after combining all this information. This is because it isn’t feasible to eradicate every risk that you face, and you must decide upon a level of residual risk that your organisation is willing to leave unattended. If you need the complete answer to “what is ISO 27001?”, read the linked article on Edara Systems website.
2. Compile a list of your information assets: One of the benefits of ISO 27001 2013 is that the ISO 27001 standard allows organisations to evaluate their risk through either an asset-based or scenario-based approach. Although each approach has its own pros and cons, an asset-based approach is generally recommended, as creating a list of all possible scenarios would be exhaustive.
3. Identify your threats and vulnerabilities: After successfully creating a comprehensive list of your information and assets, it is time to determine the risks associated with each asset. For example, if your organisation has many footfalls and non-employees come to your work sites, creating antitheft controls for your devices may be fruitful. Similarly, this antitheft policy may be unnecessary if you have only remote workers.
4. Evaluate risks: Some risks may be more severe than others, so you need to identify the ones that concern you the most. This is where your risk criteria become handy as it provides a template or a guide that can help you compare risks and assign a score to them by their likelihood of occurring and the possible damage they may cause.
5. Mitigate the risks: You are provided with four options to treat risks, including:

• Modifying the risk by applying security controls that will minimise the likelihood of its occurrence.
• Retaining the risk.
• Avoiding the risk by changing the circumstances that are causing it.
• Sharing the risk with a partner, such as an insurance or a third-party entity better equipped to handle the risk.

1. Create risk reports: Now, you need to compile your reports for future audits and the certification process. Clause 6.1.3 of ISO 27001 states that the most important documents for audit are the Risk Treatment Plan (RTP) and a Statement Of Applicability (SOA). In your SOA, you must identify which controls the organisation has selected to tackle the identified risks and explain why they were selected.
2. Review: The ISO 27001 standard urges organisations to continually review, monitor, update, and improve their ISMS so its functionality is never compromised. The assessment process needs to be repeated, and you must ensure that you have accounted for all the changes in your organisation and that your controls are still up to date.

If you need help with the ISO 27001 process or obtaining other types of ISO certification for your company, you can count on Edara Systems expert consultants.

Edara Systems helps you conduct an ISO 27001 risk assessment

In this article, we have discussed the answer to “how to do risk assessment ISO 27001?”. The seven steps to conducting an effective ISO 27001 risk assessment are to define your risk assessment methodology, create a list of your information assets, highlight threats and vulnerabilities, evaluate the identified risk, mitigate the risks, compile risk reports and review. Edara Systems professional ISO consultants can help you through the path to conduct an ISO 27001 risk assessment.