August 13, 2018 By Christophe Veltsos 3 min read

The International Organization for Standardization (ISO) recently released an updated version of its security risk management guidelines, ISO/IEC 27005:2018, which are a framework for effective management of cybersecurity risks.

Edward Humphreys, convener of the working group that developed both the ISO 27001 and ISO 27005, said in a press release that the ISO 27005 “provides the ‘why, what and how’ for organizations to be able to manage their information security risks effectively in compliance with ISO/IEC 27001.” The previous version of ISO 27005 was released in 2011 and had become somewhat out of alignment with the ISO 27001:2013.

Here are several ways in which the ISO 27005:2018 can bring value to cybersecurity leaders as well as other stakeholders in the organization.

Break Down the ISO 27005:2018

Unlike ISO 31000:2018 Risk Management Guidelines, which were written to be easily understood by top executives and board directors, the ISO 27005:2018 is longer, denser and more technically targeted to chief information security officers (CISOs), chief risk officers and auditors. It emphasizes the importance of a systematic approach to developing and maintaining an information security risk management (ISRM) process — and reminds stakeholders that risk management must be continual and subject to regular review to ensure continued effectiveness.

Apply a Consistent, Meaningful Structure

Cybersecurity leaders will appreciate that each of the main clauses in the guidelines is organized into four consistent sections:

  1. An “input” section, which covers the information necessary to perform an activity;
  2. An “action” section, which defines the activity itself;
  3. An “implementation guidance” section, which provides additional detail; and
  4. An “output” section, which describes the information that should have been generated by the activity.

This simple, repeatable structure should prove quite useful to extract the most value out of the information security risk management (ISRM) process by ensuring the organization has all of the information needed before beginning a risk-management activity — and knows what to expect at its completion.

Identify Appropriate Security Risk Management

The ISRM process needs to assess the threats to a particular organization’s assets, recognize the business risk of those threats and determine adequate and effective risk treatment options — all while monitoring the impact on the bottom line. The ISRM process must document that residual risks are “explicitly accepted” by the relevant risk owners, and any decision to postpone or cancel a control should be fully recorded. The extensive documentation generated by this process could provide valuable information to the organization during incident response — and, thus, increase resilience.

The organization also needs to determine the appropriate context for different risk-assessment processes. Some areas of risk might not require a full, detailed analysis. Instead, the organization might get a sufficient picture of its risks, controls and strategic efficacy by conducting a high-level security assessment.

For the risks that emerge as significant — or where there isn’t an easy solution — a more detailed risk assessment would yield greater insight into the full range of threats and treatment options.

Leverage Process-Improvement Loops

The guidelines will also help an organization review the completeness and effectiveness of its risk-management process by providing a precise reference framework for the lifecycle of the entire process, as well as a clear description of each step.

Remember: Cyber risks are not static and neither is the organization’s current business focus. An effective ISRM process requires continual monitoring of assets, asset values, threats, vulnerabilities, controls and increased impacts — such as new regulations or increased reliance on a particular asset.

Apply Flexible, Systematic, Adaptive ISRM

While the ISO 27005:2018 outlines both the “what” and the “how” of a risk management process, it avoids doing so narrowly or prescriptively. Although it defines a systematic and cyclical process where inputs, actions and outputs are well-defined at each step, the ISO 27005:2018 leaves a lot of room for the organization to customize its own procedures to produce value regardless of its size, sector, regulatory environment or geographic location.

By developing a structured ISRM process and carefully and continually reviewing it with stakeholders, any organization can ensure that its risk appetite is aligned to its culture, business objectives and strategies, especially in the face of changing market conditions and regulations.

Listen to the podcast series: Dechipering Today’s Cyber Headlines

More from Risk Management

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

The evolution of ransomware: Lessons for the future

5 min read - Ransomware has been part of the cyber crime ecosystem since the late 1980s and remains a major threat in the cyber landscape today. Evolving ransomware attacks are becoming increasingly more sophisticated as threat actors leverage vulnerabilities, social engineering and insider threats. While the future of ransomware is full of unknown threats, we can look to the past and recent trends to predict the future. 2005 to 2020: A rapidly changing landscape While the first ransomware incident was observed in 1989,…

Defense in depth: Layering your security coverage

2 min read - The more valuable a possession, the more steps you take to protect it. A home, for example, is protected by the lock systems on doors and windows, but the valuable or sensitive items that a criminal might steal are stored with even more security — in a locked filing cabinet or a safe. This provides layers of protection for the things you really don’t want a thief to get their hands on. You tailor each item’s protection accordingly, depending on…

The evolution of 20 years of cybersecurity awareness

3 min read - Since 2004, the White House and Congress have designated October National Cybersecurity Awareness Month. This year marks the 20th anniversary of this effort to raise awareness about the importance of cybersecurity and online safety. How have cybersecurity and malware evolved over the last two decades? What types of threat management tools surfaced and when? The Cybersecurity Awareness Month themes over the years give us a clue. 2004 - 2009: Inaugural year and beyond This early period emphasized general cybersecurity hygiene,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today