The International Organization for Standardization (ISO) recently released an updated version of its security risk management guidelines, ISO/IEC 27005:2018, which are a framework for effective management of cybersecurity risks.

Edward Humphreys, convener of the working group that developed both the ISO 27001 and ISO 27005, said in a press release that the ISO 27005 “provides the ‘why, what and how’ for organizations to be able to manage their information security risks effectively in compliance with ISO/IEC 27001.” The previous version of ISO 27005 was released in 2011 and had become somewhat out of alignment with the ISO 27001:2013.

Here are several ways in which the ISO 27005:2018 can bring value to cybersecurity leaders as well as other stakeholders in the organization.

Break Down the ISO 27005:2018

Unlike ISO 31000:2018 Risk Management Guidelines, which were written to be easily understood by top executives and board directors, the ISO 27005:2018 is longer, denser and more technically targeted to chief information security officers (CISOs), chief risk officers and auditors. It emphasizes the importance of a systematic approach to developing and maintaining an information security risk management (ISRM) process — and reminds stakeholders that risk management must be continual and subject to regular review to ensure continued effectiveness.

Apply a Consistent, Meaningful Structure

Cybersecurity leaders will appreciate that each of the main clauses in the guidelines is organized into four consistent sections:

1. An “input” section, which covers the information necessary to perform an activity;
2. An “action” section, which defines the activity itself;
3. An “implementation guidance” section, which provides additional detail; and
4. An “output” section, which describes the information that should have been generated by the activity.

This simple, repeatable structure should prove quite useful to extract the most value out of the information security risk management (ISRM) process by ensuring the organization has all of the information needed before beginning a risk-management activity — and knows what to expect at its completion.

Identify Appropriate Security Risk Management

The ISRM process needs to assess the threats to a particular organization’s assets, recognize the business risk of those threats and determine adequate and effective risk treatment options — all while monitoring the impact on the bottom line. The ISRM process must document that residual risks are “explicitly accepted” by the relevant risk owners, and any decision to postpone or cancel a control should be fully recorded. The extensive documentation generated by this process could provide valuable information to the organization during incident response — and, thus, increase resilience.

The organization also needs to determine the appropriate context for different risk-assessment processes. Some areas of risk might not require a full, detailed analysis. Instead, the organization might get a sufficient picture of its risks, controls and strategic efficacy by conducting a high-level security assessment.

For the risks that emerge as significant — or where there isn’t an easy solution — a more detailed risk assessment would yield greater insight into the full range of threats and treatment options.

Leverage Process-Improvement Loops

The guidelines will also help an organization review the completeness and effectiveness of its risk-management process by providing a precise reference framework for the lifecycle of the entire process, as well as a clear description of each step.

Remember: Cyber risks are not static and neither is the organization’s current business focus. An effective ISRM process requires continual monitoring of assets, asset values, threats, vulnerabilities, controls and increased impacts — such as new regulations or increased reliance on a particular asset.

Apply Flexible, Systematic, Adaptive ISRM

While the ISO 27005:2018 outlines both the “what” and the “how” of a risk management process, it avoids doing so narrowly or prescriptively. Although it defines a systematic and cyclical process where inputs, actions and outputs are well-defined at each step, the ISO 27005:2018 leaves a lot of room for the organization to customize its own procedures to produce value regardless of its size, sector, regulatory environment or geographic location.

By developing a structured ISRM process and carefully and continually reviewing it with stakeholders, any organization can ensure that its risk appetite is aligned to its culture, business objectives and strategies, especially in the face of changing market conditions and regulations.

Listen to the podcast series: Dechipering Today’s Cyber Headlines