ISO 27001 Risk Assessment

---

These are the rules governing how to identify risks, to whom  to assign risk ownership, how the risks impact the confidentiality, integrity and availability of the information, and the method of calculating the estimated impact and likelihood of the risk occurring. A formal risk assessment methodology needs to address four issues and should be approved by top management:

• Baseline security criteria
• Risk scale
• Risk appetite
• Scenario- or asset-based risk assessment

We follow an asset-based risk assessment process. Starting by developing a list of information assets, ideally by leveraging existing list of information assets that includes hard copies of information, electronic files, removable media, mobile devices, and intangibles, such as intellectual property.

Identify the threats and vulnerabilities that apply to each asset. For instance, the threat could be ‘theft of mobile device’, and the vulnerability could be ‘lack of formal policy for mobile devices’. Assign impact and likelihood values based on your risk criteria.

We then weigh each risk against your predetermined levels of acceptable risk, and prioritize which risks need to be addressed in which order.

There are four suggested ways to treat risks:

1. ‘Avoid’ the risk by eliminating it entirely
2. ‘Modify’ the risk by applying security controls
3. ‘Share’ the risk to a third party (through insurance or outsourced)
4. ‘Retain’ the risk (if the risk falls within established risk acceptance criteria)