ISO & IEC / Guidance
ISO/IEC 27005:2022 Manage information security risk
ISO/IEC 27005 helps teams identify, assess, treat and revisit information security risks. It connects risk decisions to the controls and management attention needed inside an ISMS.
The place in the system
Where it fits
It is specialist risk-management guidance supporting ISO/IEC 27001, not a separate set of certifiable ISMS requirements.
Practical interpretation
How to use this reference
These are editorial starting points, not copied requirements or an implementation checklist from the standard.
Questions and actions
- Describe plausible events in terms of assets, business effects and existing safeguards.
- Choose and record risk treatment with a named decision owner.
- Revisit assumptions after incidents, changes or supplier transitions.
Evidence to look for
- Risk scenario register
- Treatment decision record
- Risk review minutes
Illustrative example
What it could look like
A customer-facing service moves to a new provider, changing both exposure and response options. The risk owner updates the scenario and records whether existing controls still reduce the risk enough.
Boundary to keep clear
The standard does not make one risk scoring formula or one tolerance threshold suitable for every organization.
Source and edition check
Open the official record
Research checked 2026-10-20. Catalogue status and edition can change; the official publisher record controls. Full standard text is not reproduced here.