Information security, cybersecurity and privacy protection — Guidance on managing information security risks Sécurité de l'information, cybersécurité et protection de la vie privée — Préconisations pour la gestion des risques liés à la sécurité de l'informationINTERNATIONAL STANDARDISO/IEC 27005 Fourth edition 2022-10 Reference number ISO/IEC 27005:2022(E) © ISO/IEC 2022iiISO/IEC 27005:2022(E) COPYRIGHT PROTECTED DOCUMENT © ISO/IEC 2022 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of the requester. ISO copyright office CP 401 • Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone: +41 22 749 01 11 Email: [email protected] Website: www.iso.org Published in Switzerland © ISO/IEC 2022 – All rights reserved ISO/IEC 27005:2022(E) Foreword .......................................................................................................................................................................................................................................... v Introduction .............................................................................................................................................................................................................................. vi 1 Scope ................................................................................................................................................................................................................................. 1 2 Normative references ..................................................................................................................................................................................... 1 3 Terms and definitions .................................................................................................................................................................................... 1 3.1 Terms related to information security risk .................................................................................................................. 1 3.2 Terms related to information security risk management ................................................................................ 5 4 Structure of this document ........................................................................................................................................... ............................ 7 5 Information security risk management ...................................................................................................................................... 7 5.1 Information security risk management process ...................................................................................................... 7 5.2 Information security risk management cycles .......................................................................................................... 9 6 Context establishment ........................................................................................................................................... ........................................ 9 6.1 Organizational considerations ................................................................................................................................................. 9 6.2 Identifying basic requirements of interested parties ...................................................................................... 10 6.3 Applying risk assessment ......................................................................................................................................................