Information Security Risk Assessment (ISO 27001)

About the Information Security Risk Assessment (ISO 27001)

ISO/IEC 27001:2022 clause 6.1.2 asks you to identify the risks to the confidentiality, integrity and availability of your information, give each an owner, analyse and evaluate them against criteria you set, and choose how to treat them. This tool runs that assessment the way NIST SP 800-30 Rev. 1 describes it: an asset register, threats and vulnerabilities from editable libraries, likelihood and impact on a 3 × 3, 4 × 4 or 5 × 5 scale whose levels you name and describe, and the level of risk from likelihood × impact in bands you set, or from the NIST matrix.

For each risk you record how it is treated, the Annex A controls chosen, the actions, the residual rating and the owner. You get heat maps before and after treatment, a risk register in order of risk, the risk treatment plan, findings against your acceptance criteria, and a control list you can send straight to the Statement of Applicability Generator. Unlike a project risk register, it is organised around information assets and security controls.

The free preview scores every risk and shows the heat maps watermarked and the first rows of each table; the Excel and PDF files need a Premium pass. Nothing you enter is uploaded.

Common uses

• The risk assessment of a first ISO/IEC 27001 certification.
• The yearly review of the risk register before a surveillance audit or a SOC 2 examination.
• Showing management where the biggest risks are, before and after the planned controls.
• Turning risk decisions into the control list of the Statement of Applicability.

How the level of risk is worked out

• Likelihood × impact, in bands: the score runs from 1 to 9, 16 or 25 with the scale. The suggested bands for a 5 × 5 scale are Low up to 4, Medium up to 9, High up to 16 and Critical above; change the names and limits to your own risk criteria.
• The NIST SP 800-30 matrix (5 × 5): Table I-2 of NIST SP 800-30 Rev. 1 gives the level of risk for each combination of likelihood and impact, from very low to very high. It is not symmetrical: a very likely event with moderate impact is a moderate risk, a moderately likely one with very high impact a high risk.

The default level descriptions are written in plain words; for errors and failures they give the yearly frequencies NIST uses as a guide (from less than once in ten years to more than a hundred times a year).

Treatment options and acceptance

• Modify: reduce the likelihood or impact with controls; rate the residual risk after them.
• Retain: accept the risk as it is. Within your acceptance level the owner may decide; above it, the tool asks for a recorded decision.
• Avoid: stop or change the activity that causes the risk.
• Share: transfer part of it, for example with insurance or a supplier contract.

Where no residual rating is entered, the residual risk is taken to be the same as the inherent one and marked with an asterisk in the outputs.

From risks to the Statement of Applicability

Every control you choose for a risk is collected with the risks it treats. Send the controls to the Statement of Applicability opens the Statement of Applicability Generator in a new tab, so this assessment stays open, and offers to include those controls with their risk IDs; Save the control list gives you the same as a file. The risk policy text itself can come from the Information Security Policy Generator.

Sources

• ISO/IEC 27001:2022, clause 6.1.2 (information security risk assessment) and 6.1.3 (risk treatment): sold by ISO
• NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments: threat source types (Table D-2), likelihood and impact scales (Tables G-2, G-3, H-3) and the risk matrix (Table I-2)

Limitations

• A working tool for your ISMS, not professional advice: the ratings and the treatment decisions are yours and your risk owners’.
• Qualitative ratings: there is no money estimate (annual loss expectancy) or Monte Carlo simulation.
• The starting threats and vulnerabilities are a common baseline, not a complete catalogue for your sector; add what applies to you.
• One asset per risk: for a scenario that touches several assets, add a risk per asset or name the main one.

Privacy

Your assessment stays in this browser and is never uploaded: it describes your weaknesses, so it should not leave your hands. Keep this assessment in this browser is off unless you switch it on; Save answers gives you a file to keep instead.