ISO 27005 and the ISO 27000 Family of Standards
ISO 27005 gives European organisations the structured risk methodology behind ISO 27001 Clause 6.1. StartComply turns risk identification, analysis, treatment and monitoring into an audit-ready workflow with owners, evidence and residual risk acceptance built in.
Trusted by 100+ organisations across Europe
ISO 27001:2022 
NIS2 
DORA 
Risk evidence What you need to know about ISO 27005
- ISO 27005 provides the risk management methodology required by ISO 27001 Clause 6.1.2, but it is a guidance standard, not a certification standard.
- The 2022 revision introduced event-based risk identification alongside the traditional asset-based approach, making it more useful for ransomware, phishing and supply chain threat scenarios.
- A written risk assessment methodology is mandatory audit evidence. A risk register without methodology, criteria and approval evidence is not enough.
- Risk treatment must show owners, timelines, target residual risk and formal acceptance by authorised management.
- ISO 27005 supports NIS2 Article 21 risk analysis and DORA Article 6 ICT risk management with one coherent risk process.
- StartComply links risk identification, treatment plans and control evidence in one audit-ready workflow.
Last updated June 2026.
What Is ISO 27005?
ISO 27005 is the international guidance standard for information security risk management. It explains how to identify, analyse, evaluate, treat, accept, communicate and monitor risks inside an Information Security Management System.
ISO 27001 tells you that a risk assessment process is required. ISO 27005 defines the method. It gives compliance teams a repeatable way to move from assets, threats and vulnerabilities to risk treatment decisions that can survive external audit scrutiny.
The standard is especially useful for European organisations because it supports risk-based cybersecurity under NIS2, ICT risk management under DORA, and evidence-driven security governance under ISO 27001:2022.
Risk registers are not enough. Auditors expect a documented methodology, defined scoring criteria, treatment ownership and evidence that residual risks were formally accepted.
ISO 27005 is where risk management becomes evidence.
A structured, repeatable risk process
- Documented risk assessment methodology with defined criteria
- Risk register linked to assets, events, threats and consequences
- Treatment plans with owners, deadlines and residual risk targets
- Formal risk acceptance by authorised management
- Monitoring triggers when assets, threats or business scope change
Audit reality: a risk register without methodology, dates, owners and acceptance evidence is treated as incomplete.
Spreadsheets, inconsistent scoring and annual reviews
- Colour-coded scores with no defined likelihood or impact scale
- Generic threat lists copied without organisational context
- Controls that cannot be traced back to specific risks
- Residual risks accepted by people without authority
- No triggered reassessment after incidents, supplier changes or new systems
The fix: make the risk method repeatable, approved and connected to your control evidence.
Everything You Need to Run ISO 27005 Properly
Methodology and Documentation Control
Build and maintain the methodology, risk criteria, risk register and treatment plan in one controlled workspace. The platform keeps your ISO 27001 documentation aligned with risk decisions.
- Defined likelihood and consequence scales
- Approved risk acceptance thresholds
- Version-controlled methodology records
- Owner and review-date tracking
Risk-to-Control Mapping
Connect every risk to treatment decisions and operating controls. StartComply maps risks directly to ISO 27001 controls, so auditors can trace why each control exists and what it mitigates.
- Risk, control and evidence linkage
- Residual risk tracking
- Treatment status dashboards
- Acceptance workflow for authorised owners
Control Guidance and Evidence Packs
Use ISO 27005 to choose treatments and ISO 27002 to evidence how controls operate. StartComply keeps the risk process connected to ISO 27002 guidance so control implementation does not drift from audit expectations.
- Mapped evidence requirements
- Review schedules for each risk and control
- Exportable audit packs
- NIS2 and DORA alignment views
The ISO 27005 Risk Management Process in Five Steps
Define the risk environment Clause 6.1
Define scope, stakeholders, risk criteria and acceptance thresholds before any scoring begins. Without this context, risk levels are not comparable or defensible.
Capture assets, events and threat scenarios 2022 update
Use asset-based and event-based identification to capture realistic scenarios. This is especially important after the ISO 27001 2022 update, where modern threat context matters more.
Score and prioritise consistently Risk criteria
Analyse likelihood and impact, then evaluate results against approved criteria. This step strengthens your ISO 27001 compliance evidence because every treatment decision becomes traceable.
Assign controls and owners Treatment plan
Choose whether to modify, retain, avoid or share risk. Every treatment needs an owner, a deadline, a target residual risk and supporting evidence.
Review risks continuously Continuous review
Reassess when incidents occur, assets change, suppliers shift or threats evolve. A mature cybersecurity risk assessment process keeps the ISO 27005 cycle live between audits.
StartComply vs Manual ISO 27005 Risk Management
Manual risk management can look complete until an auditor asks for traceability. StartComply keeps every risk, treatment, owner and evidence record connected.
StartComply works as a dedicated risk assessment software layer for ISO 27005, ISO 27001, NIS2 and DORA teams that need evidence, not just registers.
Frequently Asked Questions About ISO 27005
Is ISO 27005 mandatory for ISO 27001 certification?
ISO 27005 is not formally mandatory, but ISO 27001 Clause 6.1.2 requires a documented information security risk assessment process. ISO 27005 is the recognised methodology for satisfying that requirement. Using it reduces audit risk because your risk identification, analysis, treatment and monitoring process becomes repeatable and evidenced.
What is the difference between ISO 27005 and ISO 27001?
ISO 27001 is the certifiable Information Security Management System standard. ISO 27005 is the guidance standard that explains how to perform information security risk management. You certify against ISO 27001, but ISO 27005 helps you build the risk methodology that ISO 27001 expects.
How often should ISO 27005 risk assessments be repeated?
ISO 27005 expects continuous monitoring, not a once-a-year spreadsheet exercise. Most organisations run a full assessment annually, but they also trigger targeted reviews when assets change, incidents occur, suppliers change, or new threats appear. Triggered reviews are mandatory when material changes affect the risk picture.
What is the difference between ISO 27005 and ISO 31000?
ISO 31000 is a general risk management framework for any risk domain. ISO 27005 applies those principles specifically to information security risk inside an ISMS. The 2022 revision strengthened ISO 27005 alignment with ISO 31000 while keeping the focus on cybersecurity, controls and audit evidence.
Can ISO 27005 help with NIS2 compliance?
Yes. NIS2 Article 21 requires risk analysis and information system security policies as mandatory cybersecurity measures. A documented ISO 27005 process gives organisations evidence that security measures are risk-driven, reviewed and linked to treatment decisions rather than chosen arbitrarily.
What documents does ISO 27005 require?
ISO 27005 does not prescribe fixed document titles, but ISO 27001 auditors expect a written risk assessment methodology, risk register, risk treatment plan and formal records of residual risk acceptance. The methodology is the critical item because it proves your risk register was created through a consistent process.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
