When organisations begin their ISO 27001 certification project, they must prove their compliance with appropriate documentation.
That involves documenting your information security risk assessment process. In this blog, we explain how you can do that.
Elements of the ISO 27001 risk assessment procedure
Clause 6.1.2 of the Standard states that organisations must “define and apply” a risk assessment process.
An information security risk assessment is a formal, top management-driven process and sits at the core of an ISO 27001 information security management system (ISMS).
There are five simple steps that you should take to conduct a successful risk assessment:
- Establish a risk management framework
- Identify risks
- Analyse risks
- Evaluate risks
- Select risk treatment options
The risk assessment process determines the controls that you must deploy in your ISMS. It leads to the Statement of Applicability, which identifies the controls that you are deploying in light of your risk assessment process.
You can find out more about this process in our bestselling book, Nine Steps to Success – An ISO 27001 Implementation Overview.
Conducting a risk assessment
For an ISO 27001 risk assessment to be successful, it needs to reflect the organisation’s view on risk management. Likewise, it must produce “consistent, valid and comparable results”.
The risk assessment procedure should be detailed, and describe who is responsible for each task, when they must be completed and in what order.
This can be a daunting task for many. Inexperienced assessors often rely on spreadsheets, spending hours interviewing people in their organisation, exchanging documents and methodologies with other departments and filling in data.
After all that, they’ll probably realise how inconvenient spreadsheets are. For example:
- They are prone to user error;
- They are hard to maintain;
- It’s difficult to find relevant data in multiple tabs; and
- They don’t automatically conform to ISO 27001
It doesn’t have to be like this. The risk assessment software vsRisk Cloud provides a simple and fast way to identify relevant threats, and deliver repeatable, consistent assessments year after year.
Its asset library assigns organisational roles to each asset group, applying relevant potential threats and risks by default.
Additionally, its integrated risk, vulnerability and threat databases eliminate the need to compile a list of potential risks, and the built-in control sets help you comply with multiple frameworks.
A version of this blog was originally published on 11 January 2018.
No Responses