Key Facts
- Regulator
- ISO/IEC JTC 1/SC 27 (published by ISO and IEC)
- Latest version
- ISO/IEC 27005:2022 (Edition 4), Information security, cybersecurity and privacy protection — Guidance on managing information security risks. It replaced ISO/IEC 27005:2018.
- Effective
- 25 October 2022
- Official text
- www.iso.org ↗
What is ISO/IEC 27005?
ISO/IEC 27005, often called ISO 27005, is the international guidance standard for managing information security risks. ISO and IEC publish it through committee JTC 1/SC 27. It supports an information security management system built on ISO/IEC 27001 and applies to all organisations, whatever their type, size or sector.
The current version is ISO/IEC 27005:2022 (Edition 4), Information security, cybersecurity and privacy protection — Guidance on managing information security risks. It was published on 25 October 2022 and replaced ISO/IEC 27005:2018. The IEC's edition history also lists 2008 and 2011 editions, so anything citing ISO/IEC 27005:2011 points at a version since revised.
The standard describes a structured approach to identifying, assessing and treating information security risks. It covers the full risk management cycle, not only assessment: treatment, communication, monitoring and review are in scope too. The ISO page for ISO/IEC 27005 carries the publisher's summary.
ISO/IEC 27005 gives you a method, not a certificate.
Why it matters
The auditor asks how you chose which risks to treat. The answer is a spreadsheet nobody has reviewed since the week it was built.
That is the gap ISO/IEC 27005 fills. ISO/IEC 27001 requires actions to address information security risks, and ISO/IEC 27005 is the guidance on how to carry out that risk work: a structured approach rather than a template to fill in.
On ISO 27005 vs ISO 27001, keep the two straight. ISO/IEC 27001 sets the requirements and is the standard organisations certify against. ISO/IEC 27005 is guidance that supports the ISMS built on it.
A risk register nobody reviews is a list, not a risk process.
Who it applies to
ISO/IEC 27005 applies to any organisation that needs to manage information security risks, whatever its type, size or sector. It is not reserved for large firms: a 30-person SaaS company and a large insurer can both use it. It is most useful to organisations running, or building, an ISMS on ISO/IEC 27001.
Obligation: voluntary. ISO/IEC 27005 is guidance, not a certifiable standard, and nothing in the sources checked makes it mandatory. A contract could name it, which would make it contractual for that supplier only.
The relationship to ISO 27001. Clause 6.1 of ISO/IEC 27001 asks you to take actions to address information security risks. ISO/IEC 27005 helps you meet that requirement with guidance on risk assessment and treatment. Certification stays with ISO/IEC 27001. For the management system itself, see the ISO 27001 vault.
The UK position
None of the UK sources checked makes ISO/IEC 27005 mandatory, but three UK references sit around it:
| Reference | Who it affects | What it says about risk |
|---|---|---|
| NCSC cyber security risk management guidance (v2.0, June 2023) | Cyber security risk practitioners | Government guidance on risk assessment methods and risk management governance. It does not mention ISO/IEC 27005 and says it is not prescriptive |
| UK Government Secure by Design: performing a security risk assessment | Security professionals and delivery teams building government services | Steps follow the NCSC method; ISO's guidance on managing information security risks is listed as further reading |
| BS EN ISO/IEC 27005:2024 | UK organisations buying or citing the standard | BSI's British Standard edition of the guidance, published on 31 August 2024 |
A UK firm meets ISO/IEC 27005 as voluntary guidance: alongside an ISO/IEC 27001 ISMS, or in public-sector work where the Secure by Design pages point to it.
Key requirements
ISO/IEC 27005 is guidance, so it offers recommendations rather than certifiable requirements. What it gives you is a cycle to run. In plain terms, the activities are:
- Identify. Find the information security risks the organisation faces, in the context of its own business.
- Assess. Judge how serious each risk is, so treatment effort goes where it matters.
- Treat. Decide what to do about each risk and record the decision.
- Communicate. Keep decision-makers and the people who own the risks informed.
- Monitor and review. Check that the risks and treatments still hold as the business and its threats change.
What an ISO 27005 risk assessment covers
An ISO 27005 risk assessment is the identify-and-assess part of that cycle. It supports the risk assessment and treatment activities that ISO/IEC 27001 asks for. It is not the end of the work: treatment, communication, monitoring and review follow.
An assessment that never reaches treatment is paperwork.
Frequently asked questions
No. ISO/IEC 27005 is guidance, so there is no ISO 27005 certificate and no auditor assesses you against it. What gets certified is an ISMS, against ISO/IEC 27001, and the auditor checks your risk assessment and treatment against ISO/IEC 27001's own requirements. Following ISO/IEC 27005 is one recognised way to meet those requirements, not the only one.
ISO/IEC 27001 is the certifiable requirements standard; ISO/IEC 27005 is guidance for meeting its risk requirements. Those sit in ISO/IEC 27001 clause 6.1, which asks for a defined risk assessment and treatment process, and in clauses 8.2 and 8.3, which ask you to run assessments at planned intervals or after significant change and to carry out the treatment plan. ISO/IEC 27005 guides the work in all three.
ISO 31000 holds the general risk management principles. ISO/IEC 27005 adapts those principles to the specific context of information security and aligns with ISO/IEC 27001. For risks managed inside an ISMS, ISO/IEC 27005 is the closer fit; ISO 31000 is the wider reference.
ISO/IEC 27005:2022 (Edition 4), published on 25 October 2022, is the current edition, and the IEC's record shows no newer edition under development as of October 2026. Documents that cite the 2011 or 2018 edition point at text that has since been revised. In the UK, the same guidance is sold as BS EN ISO/IEC 27005:2024, so either reference is current.
No. No UK law or regulator in the sources checked requires ISO/IEC 27005; it is voluntary guidance. Where UK firms do meet it, it is by reference: the government's Secure by Design pages list it as further reading, and a customer contract or tender can name it, which binds only that supplier. The NCSC's own risk management guidance does not mention it.