The International Organization for Standardization (ISO) recently released an updated version of its security risk management guidelines, ISO/IEC 27005:2018, which are a framework for effective management of cybersecurity risks.

Edward Humphreys, convener of the working group that developed both the ISO 27001 and ISO 27005, said in a press release that the ISO 27005 “provides the ‘why, what and how’ for organizations to be able to manage their information security risks effectively in compliance with ISO/IEC 27001.” The previous version of ISO 27005 was released in 2011 and had become somewhat out of alignment with the ISO 27001:2013.

Here are several ways in which the ISO 27005:2018 can bring value to cybersecurity leaders as well as other stakeholders in the organization.

Break Down the ISO 27005:2018

Unlike ISO 31000:2018 Risk Management Guidelines, which were written to be easily understood by top executives and board directors, the ISO 27005:2018 is longer, denser and more technically targeted to chief information security officers (CISOs), chief risk officers and auditors. It emphasizes the importance of a systematic approach to developing and maintaining an information security risk management (ISRM) process — and reminds stakeholders that risk management must be continual and subject to regular review to ensure continued effectiveness.

Apply a Consistent, Meaningful Structure

Cybersecurity leaders will appreciate that each of the main clauses in the guidelines is organized into four consistent sections:

  1. An “input” section, which covers the information necessary to perform an activity;
  2. An “action” section, which defines the activity itself;
  3. An “implementation guidance” section, which provides additional detail; and
  4. An “output” section, which describes the information that should have been generated by the activity.

This simple, repeatable structure should prove quite useful to extract the most value out of the information security risk management (ISRM) process by ensuring the organization has all of the information needed before beginning a risk-management activity — and knows what to expect at its completion.

Identify Appropriate Security Risk Management

The ISRM process needs to assess the threats to a particular organization’s assets, recognize the business risk of those threats and determine adequate and effective risk treatment options — all while monitoring the impact on the bottom line. The ISRM process must document that residual risks are “explicitly accepted” by the relevant risk owners, and any decision to postpone or cancel a control should be fully recorded. The extensive documentation generated by this process could provide valuable information to the organization during incident response — and, thus, increase resilience.

The organization also needs to determine the appropriate context for different risk-assessment processes. Some areas of risk might not require a full, detailed analysis. Instead, the organization might get a sufficient picture of its risks, controls and strategic efficacy by conducting a high-level security assessment.

For the risks that emerge as significant — or where there isn’t an easy solution — a more detailed risk assessment would yield greater insight into the full range of threats and treatment options.

Leverage Process-Improvement Loops

The guidelines will also help an organization review the completeness and effectiveness of its risk-management process by providing a precise reference framework for the lifecycle of the entire process, as well as a clear description of each step.

Remember: Cyber risks are not static and neither is the organization’s current business focus. An effective ISRM process requires continual monitoring of assets, asset values, threats, vulnerabilities, controls and increased impacts — such as new regulations or increased reliance on a particular asset.

Apply Flexible, Systematic, Adaptive ISRM

While the ISO 27005:2018 outlines both the “what” and the “how” of a risk management process, it avoids doing so narrowly or prescriptively. Although it defines a systematic and cyclical process where inputs, actions and outputs are well-defined at each step, the ISO 27005:2018 leaves a lot of room for the organization to customize its own procedures to produce value regardless of its size, sector, regulatory environment or geographic location.

By developing a structured ISRM process and carefully and continually reviewing it with stakeholders, any organization can ensure that its risk appetite is aligned to its culture, business objectives and strategies, especially in the face of changing market conditions and regulations.

Listen to the podcast series: Dechipering Today’s Cyber Headlines

More from Risk Management

The Evolution of Antivirus Software to Face Modern Threats

Over the years, endpoint security has evolved from primitive antivirus software to more sophisticated next-generation platforms employing advanced technology and better endpoint detection and response.  Because of the increased threat that modern cyberattacks pose, experts are exploring more elegant ways of keeping data safe from threats.Signature-Based Antivirus SoftwareSignature-based detection is the use of footprints to identify malware. All programs, applications, software and files have a digital footprint. Buried within their code, these digital footprints or signatures are unique to the respective…

Contain Breaches and Gain Visibility With Microsegmentation

Organizations must grapple with challenges from various market forces. Digital transformation, cloud adoption, hybrid work environments and geopolitical and economic challenges all have a part to play. These forces have especially manifested in more significant security threats to expanding IT attack surfaces. Breach containment is essential, and zero trust security principles can be applied to curtail attacks across IT environments, minimizing business disruption proactively. Microsegmentation has emerged as a viable solution through its continuous visualization of workload and device communications…

How the Silk Road Affair Changed Law Enforcement

The Silk Road was the first modern dark web marketplace, an online place for anonymously buying and selling illegal products and services using Bitcoin. Ross Ulbricht created The Silk Road in 2011 and operated it until 2013 when the FBI shut it down. Its creator was eventually arrested and sentenced to life in prison. But in a plot twist right out of a spy novel, a cyber attacker stole thousands of bitcoins from Silk Road and hid them away. It…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…