ISO/IEC 27005:2011

Information technology - Security techniques - Information security risk management

ISO/IEC 27005:2011 provides guidelines for information security risk management. It supports the general concepts specified in ISO/IEC 27001 and is designed to assist the satisfactory implementation of information security based on a risk management approach. Knowledge of the concepts, models, processes and terminologies described in ISO/IEC 27001 and ISO/IEC 27002 is important for a complete understanding of ISO/IEC 27005:2011. ISO/IEC 27005:2011 is applicable to all types of organizations (e.g. commercial enterprises, government agencies, non-profit organizations) which intend to manage risks that could compromise the organization's information security.

Technologies de l'information — Techniques de sécurité — Gestion des risques liés à la sécurité de l'information

L'ISO/CEI 27005:2011 contient des lignes directrices relatives à la gestion des risques en sécurité de l'information. Elle vient en appui des concepts généraux énoncés dans l'ISO/CEI 27001; elle est conçue pour aider à la mise en place de la sécurité de l'information basée sur une approche de gestion des risques. Il est important de connaître les concepts, les modèles, les processus et les terminologies décrites dans l'ISO/CEI 27001 et l'ISO/CEI 27002 afin de bien comprendre l'ISO/CEI 27005:2011. L'ISO/CEI 27005:2011 est applicable à tous types d'organisations (par exemple les entreprises commerciales, les agences gouvernementales, les organisations à but non lucratif) qui ont l'intention de gérer des risques susceptibles de compromettre la sécurité des informations de l'organisation.

Informacijska tehnologija - Varnostne tehnike- Obvladovanje informacijskih varnostnih tveganj

Ta mednarodni standard zagotavlja smernice za obvladovanje informacijskih varnostnih tveganj.
Ta mednarodni standard podpira splošne koncepte, določene v ISO/IEC 27001, in je namenjen kot
pomoč pri zadovoljivem izvajanju informacijske varnosti, ki temelji na pristopu obvladovanja tveganj.
Poznavanje konceptov, modelov, procesov in terminologij, opisanih v ISO/IEC 27001 in ISO/IEC 27002,
je pomembno za popolno razumevanje tega mednarodnega standarda.
Ta mednarodni standard se uporablja za vse vrste organizacij (npr. trgovska podjetja, vladne agencije,
nepridobitne organizacije), ki nameravajo obvladovati tveganja, ki bi lahko ogrozila informacijsko
varnost organizacije.

General Information

• Status: Withdrawn
• Publication Date: 18-May-2011
• Withdrawal Date: 18-May-2011
• ICS: 03.100.70 - Management systems
• ICS: 35.030 - IT Security
• ICS: 35.040 - Information coding
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27/WG 1 - Information security management systems
• Current Stage: 9599 - Withdrawal of International Standard
• Start Date: 09-Jul-2018
• Completion Date: 08-Nov-2025
• Ref Project: SIST ISO/IEC 27005:2011 - Information technology - Security techniques - Information security risk management

Relations

• Revised: ISO/IEC 27005:2018 - Information technology - Security techniques - Information security risk management
• Effective Date: 20-Jan-2018
• Revises: ISO/IEC 27005:2008 - Information technology - Security techniques - Information security risk management
• Effective Date: 05-Jun-2010

Standards Content (Sample)

INTERNATIONAL ISO/IEC
STANDARD 27005
Second edition
2011-06-01
Information technology — Security
techniques — Information security risk
management
Technologies de l'information — Techniques de sécurité — Gestion des
risques liés à la sécurité de l'information

Reference number
©
ISO/IEC 2011
©  ISO/IEC 2011
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail [e-mail]
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2011 – All rights reserved

Contents Page
Foreword .v
Introduction.vi
1 Scope.1
2 Normative references.1
3 Terms and definitions .1
4 Structure of this International Standard .5
5 Background.6
6 Overview of the information security risk management process .7
7 Context establishment.10
7.1 General considerations.10
7.2 Basic Criteria .10
7.2.1 Risk management approach .10
7.2.2 Risk evaluation criteria .10
7.2.3 Impact criteria .11
7.2.4 Risk acceptance criteria .11
7.3 Scope and boundaries.12
7.4 Organization for information security risk management .12
8 Information security risk assessment.13
8.1 General description of information security risk assessment .13
8.2 Risk identification.13
8.2.1 Introduction to risk identification .13
8.2.2 Identification of assets.14
8.2.3 Identification of threats.14
8.2.4 Identification of existing controls.15
8.2.5 Identification of vulnerabilities .15
8.2.6 Identification of consequences.16
8.3 Risk analysis.17
8.3.1 Risk analysis methodologies .17
8.3.2 Assessment of consequences.18
8.3.3 Assessment of incident likelihood .18
8.3.4 Level of risk determination.19
8.4 Risk evaluation .19
9 Information security risk treatment .20
9.1 General description of risk treatment .20
© ISO/IEC 2011 – All rights reserved iii

9.2 Risk modification.22
9.3 Risk retention.23
9.4 Risk avoidance.23
9.5 Risk sharing .23
10 Information security risk acceptance .24
11 Information security risk communication and consultation .24
12 Information security risk monitoring and review .25
12.1 Monitoring and review of risk factors.25
12.2 Risk management monitoring, review and improvement.26
Annex A (informative) Defining the scope and boundaries of the information security risk
management process.28
A.1 Study of the organization.28
A.2 List of the constraints affecting the organization .29
A.3 List of the legislative and regulatory references applicable to the organization.31
A.4 List of the constraints affecting the scope .31
Annex B (informative) Identification and valuation of assets and impact assessment.33
B.1 Examples of asset identification.33
B.1.1 The identification of primary assets .33
B.1.2 List and description of supporting assets .34
B.2 Asset valuation .38
B.3 Impact assessment.41
Annex C (informative) Examples of typical threats .42
Annex D (informative) Vulnerabilities and methods for vulnerability assessment .45
D.1 Examples of vulnerabilities .45
D.2 Methods for assessment of technical vulnerabilities .48
Annex E (informative) Information security risk assessment approaches .50
E.1 High-level information security risk assessment.50
E.2 Detailed information security risk assessment.51
E.2.1 Example 1 Matrix with predefined values .52
E.2.2 Example 2 Ranking of Threats by Measures of Risk .54
E.2.3 Example 3 Assessing a value for the likelihood and the possible consequences of risks.54
Annex F (informative) Constraints for risk modification.56
Annex G (informative) Differences in definitions between ISO/IEC 27005:2008 and ISO/IEC
27005:2011.58
Bibliography .68

iv © ISO/IEC 2011 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members of
ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information
technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as
an International Standard requires approval by at least 75 % of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 27005 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
This second edition cancels and replaces the first edition (ISO/IEC 27005:2008) which has been technically
revised.
© ISO/IEC 2011 – All rights reserved v

Introduction
This International Standard provides guidelines for information security risk management in an organization,
supporting in particular the requirements of an information security management (ISMS) according to
ISO/IEC 27001. However, this International Standard does not provide any specific method for information
security risk management. It is up to the organization to define their approach to risk management, depending
for example on the scope of the ISMS, context of risk management, or industry sector. A number of existing
methodologies can be used under the framework described in this International Standard to implement the
requirements of an ISMS.
This International Standard is relevant to managers and staff concerned with information security risk
management within an organization and, where appropriate, external parties supporting such activities.
vi © ISO/IEC 2011 – All rights reserved

INTERNATIONAL STANDARD ISO/IEC 27005:2011(E)

Information technology — Security techniques — Information
security risk management
1 Scope
This International Standard provides guidelines for information security risk management.
This International Standard supports the general concepts specified in ISO/IEC 27001 and is designed to
assist the satisfactory implementation of information security based on a risk management approach.
Knowledge of the concepts, models, processes and terminologies described in ISO/IEC 27001 and
ISO/IEC 27002 is important for a complete understanding of this International Standard.
This International Standard is applicable to all types of organizations (e.g. commercial enterprises,
government agencies, non-profit organizations) which intend to manage risks that could compromise the
organization’s information security.
2 Normative references
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
ISO/IEC 27000, Information technology — Security techniques — Information security management
systems — Overview and vocabulary
ISO/IEC 27001:2005, Information technology — Security techniques — Information security management
systems — Requirements
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 27000 and the following apply.
NOTE Differences in definitions between ISO/IEC 27005:2008 and this International Standard are shown in Annex G.
3.1
consequence
outcome of an event (3.3) affecting objectives
[ISO Guide 73:2009]
NOTE 1 An event can lead to a range of consequences.
NOTE 2 A consequence can be certain or uncertain and in the context of information security is usually negative.
NOTE 3 Consequences can be expressed qualitatively or quantitatively.
NOTE 4 Initial consequences can escalate through knock-on effects.
© ISO/IEC 2011 – All rights reserved 1

3.2
control
measure that is modifying risk (3.9)
[ISO Guide 73:2009]
NOTE 1 Controls for information security include any process, policy, procedure, guideline, practice or organizational
structure, which can be administrative, technical, management, or legal in nature which modify information security risk.
NOTE 2 Controls may not always exert the intended or assumed modifying effect.
NOTE 3 Control is also used as a synonym for safeguard or countermeasure.
3.3
event
occurrence or change of a particular set of circumstances
[ISO Guide 73:2009]
NOTE 1 An event can be one or more occurrences, and can have several causes.
NOTE 2 An event can consist of something not happening.
NOTE 3 An event can sometimes be referred to as an “incident” or “accident”.
3.4
external context
external environment in which the organization seeks to achieve its objectives
[ISO Guide 73:2009]
NOTE External context can include:
⎯ the cultural, social, political, legal, regulatory, financial, technological, economic, natural and
competitive environment, whether international, national, regional or local;
⎯ key drivers and trends having impact on the objectives of the organization; and
⎯ relationships with, and perceptions and values of, external stakeholders.
3.5
internal context
internal environment in which the organization seeks to achieve its objectives
[ISO Guide 73:2009]
NOTE Internal context can include:
⎯ governance, organizational structure, roles and accountabilities;
⎯ policies, objectives, and the strategies that are in place to achieve them;
⎯ the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people,
processes, systems and technologies);
⎯ information systems, information flows and decision-making processes (both formal and informal);
⎯ relationships with, and perceptions and values of, internal stakeholders;
⎯ the organization's culture;
⎯ standards, guidelines and models adopted by the organization; and
⎯ form and extent of contractual relationships.

2 © ISO/IEC 2011 – All rights reserved

3.6
level of risk
magnitude of a risk (3.9), expressed in terms of the combination of consequences (3.1) and their likelihood
(3.7)
[ISO Guide 73:2009]
3.7
likelihood
chance of something happening
[ISO Guide 73:2009]
NOTE 1 In risk management terminology, the word “likelihood” is used to refer to the chance of something happening,
whether defined, measured or determined objectively or subjectively, qualitatively or quantitatively, and described using
general terms or mathematically (such as a probability or a frequency over a given time period).
NOTE 2 The English term “likelihood” does not have a direct equivalent in some languages; instead, the equivalent of
the term “probability” is often used. However, in English, “probability” is often narrowly interpreted as a mathematical term.
Therefore, in risk management terminology, “likelihood” is used with the intent that it should have the same broad
interpretation as the term “probability” has in many languages other than English.
3.8
residual risk
risk (3.9) remaining after risk treatment (3.17)
[ISO Guide 73:2009]
NOTE 1 Residual risk can contain unidentified risk.
NOTE 2 Residual risk can also be known as “retained risk”.
3.9
risk
effect of uncertainty on objectives

[ISO Guide 73:2009]
NOTE 1 An effect is a deviation from the expected — positive and/or negative.
NOTE 2 Objectives can have different aspects (such as financial, health and safety, information security, and
environmental goals) and can apply at different levels (such as strategic, organization-wide, project, product and process).
NOTE 3 Risk is often characterized by reference to potential events (3.3) and consequences (3.1), or a combination of
these.
NOTE 4 Information security risk is often expressed in terms of a combination of the consequences of an information
security event and the associated likelihood (3.9) of occurrence.
NOTE 5 Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of, an
event, its consequence, or likelihood.
NOTE 6 Information security risk is associated with the potential that threats will exploit vulnerabilities of an information
asset or group of information assets and thereby cause harm to an organization.
3.10
risk analysis
process to comprehend the nature of risk and to determine the level of risk (3.6)
[ISO Guide 73:2009]
© ISO/IEC 2011 – All rights reserved 3

NOTE 1 Risk analysis provides the basis for risk evaluation and decisions about risk treatment.
NOTE 2 Risk analysis includes risk estimation.
3.11
risk assessment
overall process of risk identification (3.15), risk analysis (3.10) and risk evaluation (3.14)
[ISO Guide 73:2009]
3.12
risk communication and consultation
continual and iterative processes that an organization conducts to provide, share or obtain information, and to
engage in dialogue with stakeholders (3.18) regarding the management of risk (3.9)
[ISO Guide 73:2009]
NOTE 1 The information can relate to the existence, nature, form, likelihood, significance, evaluation, acceptability and
treatment of risk.
NOTE 2 Consultation is a two-way process of informed communication between an organization and its stakeholders
on an issue prior to making a decision or determining a direction on that issue. Consultation is:
⎯ a process which impacts on a decision through influence rather than power; and
⎯ an input to decision making, not joint decision making.
3.13
risk criteria
terms of reference against which the significance of a risk (3.9) is evaluated
[ISO Guide 73:2009]
NOTE 1 Risk criteria are based on organizational objectives, and external and internal context.
NOTE 2 Risk criteria can be derived from standards, laws, policies and other requirements.
3.14
risk evaluation
process of comparing the results of risk analysis (3.10) with risk criteria (3.13) to determine whether the risk
and/or its magnitude is acceptable or tolerable
[ISO Guide 73:2009]
NOTE Risk evaluation assists in the decision about risk treatment.
3.15
risk identification
process of finding, recognizing and describing risks
[ISO Guide 73:2009]
NOTE 1 Risk identification involves the identification of risk sources, events, their causes and their potential
consequences.
NOTE 2 Risk identification can involve historical data, theoretical analysis, informed and expert opinions, and
stakeholders’ needs.
4 © ISO/IEC 2011 – All rights reserved

3.16
risk management
coordinated activities to direct and control an organization with regard to risk
[ISO Guide 73:2009]
NOTE This International Standard uses the term ‘process’ to describe risk management overall. The elements within
the risk management process are termed ‘activities’
3.17
risk treatment
process to modify risk
[ISO Guide 73:2009]
NOTE 1 Risk treatment can involve:
⎯ avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk;
⎯ taking or increasing risk in order to pursue an opportunity;
⎯ removing the risk source;
⎯ changing the likelihood;
⎯ changing the consequences;
⎯ sharing the risk with another party or parties (including contracts and risk financing); and
⎯ retaining the risk by informed choice.
NOTE 2 Risk treatments that deal with negative consequences are sometimes referred to as “risk mitigation”, “risk
elimination”, “risk prevention” and “risk reduction”.
NOTE 3 Risk treatment can create new risks or modify existing risks.
3.18
stakeholder
person or organization that can affect, be affected by, or perceive themselves to be affected by a decision or
activity
[ISO Guide 73:2009]
NOTE A decision maker can be a stakeholder.
4 Structure of this International Standard
This International Standard contains the description of the information security risk management process and
its activities.
The background information is provided in Clause 5.
A general overview of the information security risk management process is given in Clause 6.
All information security risk management activities as presented in Clause 6 are subsequently described in the
following clauses:
ƒ Context establishment in Clause 7,
ƒ Risk assessment in Clause 8,
ƒ Risk treatment in Clause 9,
© ISO/IEC 2011 – All rights reserved 5

ƒ Risk acceptance in Clause 10,
ƒ Risk communication in Clause 11,
ƒ Risk monitoring and review in Clause 12.
Additional information for information security risk management activities is presented in the annexes. The
context establishment is supported by Annex A (Defining the scope and boundaries of the information security
risk management process). Identification and valuation of assets and impact assessments are discussed in
Annex B. Annex C gives examples of typical threats and Annex D discusses vulnerabilities and methods for
vulnerability assessment. Examples of information security risk assessment approaches are presented in
Annex E.
Constraints for risk modification are presented in Annex F.
Differences in definitions between ISO/IEC 27005:2008 and ISO/IEC 27005:2011 are shown in Annex G.
All risk management activities as presented from Clause 7 to Clause 12 are structured as follows:
Input: Identifies any required information to perform the activity.
Action: Describes the activity.
Implementation guidance: Provides guidance on performing the action. Some of this guidance may not be
suitable in all cases and so other ways of performing the action may be more appropriate.
Output: Identifies any information derived after performing the activity.
5 Background
A systematic approach to information security risk management is necessary to identify organizational needs
regarding information security requirements and to create an effective information security management
system (ISMS). This approach should be suitable for the organization´s environment, and in particular should
be aligned with overall enterprise risk management. Security efforts should address risks in an effective and
timely manner where and when they are needed. Information security risk management should be an integral
part of all information security management activities and should be applied both to the implementation and
the ongoing operation of an ISMS.
Information security risk management should be a continual process. The process should establish the
external and internal context, assess the risks and treat the risks using a risk treatment plan to implement the
recommendations and decisions. Risk management analyses what can happen and what the possible
consequences can be, before deciding what should be done and when, to reduce the risk to an acceptable
level.
Information security risk management should contribute to the following:
ƒ Risks being identified
ƒ Risks being assessed in terms of their consequences to the business and the likelihood of their
occurrence
ƒ The likelihood and consequences of these risks being communicated and understood
ƒ Priority order for risk treatment being established
ƒ Priority for actions to reduce risks occurring
ƒ Stakeholders being involved when risk management decisions are made and kept informed of the risk
management status
ƒ Effectiveness of risk treatment monitoring
6 © ISO/IEC 2011 – All rights reserved

ƒ Risks and the risk management process being monitored and reviewed regularly
ƒ Information being captured to improve the risk management approach
ƒ Managers and staff being educated about the risks and the actions taken to mitigate them
The information security risk management process can be applied to the organization as a whole, any discrete
part of the organization (e.g. a department, a physical location, a service), any information system, existing or
planned or particular aspects of control (e.g. business continuity planning).
6 Overview of the information security risk management process
A high level view of the risk management process is specified in ISO 31000 and shown in Figure 1.

Figure 1 — The risk management process

© ISO/IEC 2011 – All rights reserved 7

Figure 2 shows how this International Standard applies this risk management process.
The information security risk management process consists of context establishment (Clause 7), risk
assessment (Clause 8), risk treatment (Clause 9), risk acceptance (Clause 10), risk communication and
consultation (Clause 11), and risk monitoring and review (Clause 12).

Figure 2 — Illustration of an information security risk management process
As Figure 2 illustrates, the information security risk management process can be iterative for risk assessment
and/or risk treatment activities. An iterative approach to conducting risk assessment can increase depth and
detail of the assessment at each iteration. The iterative approach provides a good balance between
minimizing the time and effort spent in identifying controls, while still ensuring that high risks are appropriately
assessed.
The context is established first. Then a risk assessment is conducted. If this provides sufficient information to
effectively determine the actions required to modify the risks to an acceptable level then the task is complete
and the risk treatment follows. If the information is insufficient, another iteration of the risk assessment with
8 © ISO/IEC 2011 – All rights reserved

revised context (e.g. risk evaluation criteria, risk acceptance criteria or impact criteria) will be conducted,
possibly on limited parts of the total scope (see Figure 2, Risk Decision Point 1).
The effectiveness of the risk treatment depends on the results of the risk assessment.
Note that risk treatment involves a cyclical process of:
• assessing a risk treatment;
• deciding whether residual risk levels are acceptable;
• generating a new risk treatment if risk levels are not acceptable; and
• assessing the effectiveness of that treatment
It is possible that the risk treatment will not immediately lead to an acceptable level of residual risk. In this
situation, another iteration of the risk assessment with changed context parameters (e.g. risk assessment, risk
acceptance or impact criteria), if necessary, may be required, followed by further risk treatment (see Figure 2,
Risk Decision Point 2).
The risk acceptance activity has to ensure residual risks are explicitly accepted by the managers of the
organization. This is especially important in a situation where the implementation of controls is omitted or
postponed, e.g. due to cost.
During the whole information security risk management process it is important that risks and their treatment
are communicated to the appropriate managers and operational staff. Even before the treatment of the risks,
information about identified risks can be very valuable to manage incidents and may help to reduce potential
damage. Awareness by managers and staff of the risks, the nature of the controls in place to mitigate the risks
and the areas of concern to the organization assist in dealing with incidents and unexpected events in the
most effective manner. The detailed results of every activity of the information security risk management
process and from the two risk decision points should be documented.
ISO/IEC 27001 specifies that the controls implemented within the scope, boundaries and context of the ISMS
need to be risk based. The application of an information security risk management process can satisfy this
requirement. There are many approaches by which the process can be successfully implemented in an
organization. The organization should use whatever approach best suits their circumstances for each specific
application of the process.
In an ISMS, establishing the context, risk assessment, developing risk treatment plan and risk acceptance are
all part of the “plan” phase. In the “do” phase of the ISMS, the actions and controls required to reduce the risk
to an acceptable level are implemented according to the risk treatment plan. In the “check” phase of the ISMS,
managers will determine the need for revisions of the risk assessment and risk treatment in the light of
incidents and changes in circumstances. In the ”act” phase, any actions required, including additional
application of the information security risk management process, are performed.
The following table summarizes the information security risk management activities relevant to the four
phases of the ISMS process:
Table 1 — Alignment of ISMS and Information Security Risk Management Process
ISMS Process Information Security Risk Management Process
Establishing the context
Risk assessment
Plan
Developing risk treatment plan
Risk acceptance
Do Implementation of risk treatment plan
Check Continual monitoring and reviewing of risks
Maintain and improve the Information Security Risk
Act
Management Process
© ISO/IEC 2011 – All rights reserved 9

7 Context establishment
7.1 General considerations
Input: All information about the organization relevant to the information security risk management context
establishment.
Action: The external and internal context for information security risk management should be established,
which involves setting the basic criteria necessary for information security risk management (7.2), defining the
scope and boundaries (7.3), and establishing an appropriate organization operating the information security
risk management (7.4).
Implementation guidance:
It is essential to determine the purpose of the information security risk management as this affects the overall
process and the context establishment in particular. This purpose can be:
ƒ Supporting an ISMS
ƒ Legal compliance and evidence of due diligence
ƒ Preparation of a business continuity plan
ƒ Preparation of an incident response plan
ƒ Description of the information security requirements for a product, a service or a mechanism
Implementation guidance for context establishment elements needed to support an ISMS is further discussed in
Clauses 7.2, 7.3 and 7.4 below.
NOTE ISO/IEC 27001:2005 does not use the term “context”. However, all of Clause 7 relates to the requirements
“define the scope and boundaries of the ISMS” [4.2.1 a)], “define an ISMS policy” [4.2.1 b)] and “define the risk
assessment approach” [4.2.1 c)], specified in ISO/IEC 27001:2005.
Output: The specification of basic criteria, the scope and boundaries, and the organization for the information
security risk management process.
7.2 Basic Criteria
7.2.1 Risk management approach
Depending on the scope and objectives of the risk management, different approaches can be applied. The
approach might also be different for each iteration.
An appropriate risk management approach should be selected or developed that addresses basic criteria such
as: risk evaluation criteria, impact criteria, risk acceptance criteria.
Additionally, the organization should assess whether necessary resources are available to:
ƒ Perform risk assessment and establish a risk treatment plan
ƒ Define and implement policies and procedures, including implementation of the controls selected
ƒ Monitor controls
ƒ Monitor the information security risk management process
NOTE See also ISO/IEC 27001:2005 (Clause 5.2.1) concerning the provision of resources for the implementation
and operation of an ISMS.
7.2.2 Risk evaluation criteria
Risk evaluation criteria should be developed for evaluating the organization's information security risk
considering the followings:
ƒ The strategic value of the business information process
ƒ The criticality of the information assets involved
ƒ Legal and regulatory requirements, and contractual obligations
10 © ISO/IEC 2011 – All rights reserved

ƒ Operational and business importance of availability, confidentiality and integrity
ƒ Stakeholders expectations and perceptions, and negative consequences for goodwill and reputation
Additionally, risk evaluation criteria can be used to specify priorities for risk treatment.
7.2.3 Impact criteria
Impact criteria should be developed and specified in terms of the degree of damage or costs to the
organization caused by an information security event considering the following:
ƒ Level of classification of the impacted information asset
ƒ Breaches of information security (e.g. loss of confidentiality, integrity and availability)
ƒ Impaired operations (internal or third parties)
ƒ Loss of business and financial value
ƒ Disruption of plans and deadlines
ƒ Damage of reputation
ƒ Breaches of legal, regulatory or contractual requirements
NOTE See also ISO/IEC 27001:2005 [Clause 4.2.1 d) 4] concerning the impact criteria identification for losses of
confidentiality, integrity and availability.
7.2.4 Risk acceptance criteria
Risk acceptance criteria should be developed and specified. Risk acceptance criteria often depend on the
organization's policies, goals, objectives and the interests of stakeholders.
An organization should define its own scales for levels of risk acceptance. The following should be considered
during development:
ƒ Risk acceptance criteria may include multiple thresholds, with a desired target level of risk, but provision
for senior managers to accept risks above this level under defined circumstances
ƒ Risk acceptance criteria may be expressed as the ratio of estimated profit (or other business benefit) to
the estimated risk
ƒ Different risk acceptance criteria may apply to different classes of risk, e.g. risks that could result in non-
compliance with regulations or laws may not be accepted, while acceptance of high risks may be allowed
if this is specified as a contractual requirement
ƒ Risk acceptance criteria may include requirements for future additional treatment, e.g. a risk may be
accepted if there is approval and commitment to take action to reduce it to an acceptable level within a
defined time period
Risk acceptance criteria may differ according to how long the risk is expected to exist, e.g. the risk may be
associated with a temporary or short term activity. Risk acceptance criteria should be set up considering the
following:
ƒ Business criteria
ƒ Legal and regulatory aspects
ƒ Operations
ƒ Technology
ƒ Finance
ƒ Social and humanitarian factors
NOTE Risk acceptance criteria correspond to “criteria for accepting risks and identify the acceptable level of risk”
specified in ISO/IEC 27001:2005 Clause 4.2.1 c) 2).
More information can be found in Annex A.
© ISO/IEC 2011 – All rights reserved 11

7.3 Scope and boundaries
The organization should define the scope and boundaries of information security risk management.
The scope of the information security risk management process needs to be defined to ensure that all relevant
assets are taken into account in the risk assessment. In addition, the boundaries need to be identified
[see also ISO/IEC 27001:2005 Clause 4.2.1 a)] to address those risks that might arise through these
boundaries.
Information about the organization should be collected to determine the environment it operates in and its
relevance to the information security risk management process.
When defining the scope and boundaries, the organization should consider the following information:
ƒ The organization's strategic business objectives, strategies and policies
ƒ Business processes
ƒ The organization’s functions and structure
ƒ Legal, regulatory and contractual requirements applicable to the organization
ƒ The organization's information security policy
ƒ The organization’s overall approach to risk management
ƒ Information assets
ƒ Locations of the organization and their geographical characteristics
ƒ Constraints affecting the organization
ƒ Expectation of stakeholders
ƒ Socio-cultural environment
ƒ Interfaces (i.e. information exchange with the environment)
Additionally, the organization should provide justification for any exclusion from the scope.
Examples of the risk management scope may be an IT application, IT infrastructure, a business process, or a
defined part of an organization.
NOTE The scope and boundaries of the information security risk management is related to the scope and boundaries
of the ISMS required in ISO/IEC 27001:2005 4.2.1 a).
Further information can be found in Annex A.
7.4 Organization for information security risk management
The organization and responsibilities for the information security risk management process should be set up
and maintained. The following are the main roles and responsibilities of this organization:
ƒ Development of the information security risk management process suitable for the organization
ƒ Identification and analysis of the stakeholders
ƒ Definition of roles and responsibilities of all parties both internal and external to the organization
ƒ Establishment of the required relationships between the organization and stakeholders, as well as
interfaces to the organization's high level risk management functions (e.g. operational risk management),
as well as interfaces to other relevant projects or activities
ƒ Definition of decision escalation paths
ƒ Specification of records to be kept
This organization should be approved by the appropriate managers of the organization.
NOTE ISO/IEC 27001:2005 requires determination and provision of the resources needed to establish, implement,
operate, monitor, review, maintain and improve an ISMS [5.2.1 a)]. The organization for risk management operations may
be regarded as one of the resources required by ISO/IEC 27001:2005.
12 © ISO/IEC 2011 – All rights reserved

8 Information security risk assessment
8.1 General description of information security risk assessment
NOTE Risk assessment activity is referred to as process in ISO/IEC 27001:2005.
Input: Basic criteria, the scope and boundaries, and the organization for the information security risk
management process being established.
Action: Risks should be identified, quantified or qualitatively described, and prioritized against risk evaluation
criteria and objectives relevant to the organization.
Implementation guidance:
A risk is a combination of the consequences that would follow from the occurrence of an unwanted event and
the likelihood of the occurrence of the event. Risk assessment quantifies or qualitatively describes the risk and
enables managers to prioritize risks according to their perceived seriousness or other established criteria.
Risk assessment consists of the following activities:
ƒ Risk Identification (clause 8.2)
ƒ Risk analysis (clause 8.3)
ƒ Risk evaluation (clause 8.4)

Risk assessment determines the value of the information assets, identifies the applicable threats and
vulnerabilities that exist (or could exist), identifies the existing controls and their effect on the risk identified,
determines the potential consequences and finally prioritizes the derived risks and ranks them against the risk
evaluation criteria set in the context establishment.
Risk assessment is often conducted in two (or more) iterations. First a high level assessment is carried out to
identify potentially high risks that warrant further assessment. The next iteration can involve further in-depth
consideration of potentially high risks revealed in the initial iteration. Where this provides insufficient
information to assess the risk then further detailed analyses are conducted, probably on parts of the total
scope, and possibly using a different method.
It is up to the organization to select its own approach to risk assessment based on the objectives and the aim
of the risk assessment.
Discussion on information security risk assessment approaches can be found in Annex E.
Output: A list of assessed risks prioritized according to risk evaluation criteria.
8.2 Risk identification
8.2.1 Int
...

SLOVENSKI STANDARD
01-september-2011
Informacijska tehnologija - Varnostne tehnike- Obvladovanje informacijskih
varnostnih tveganj
Information technology - Security techniques - Information security risk management
Technologies de l'information - Techniques de sécurité - Management du risque de la
sécurité de l'information
Ta slovenski standard je istoveten z: ISO/IEC 27005:2011
ICS:
35.040 Nabori znakov in kodiranje Character sets and
informacij information coding
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

INTERNATIONAL ISO/IEC
STANDARD 27005
Second edition
2011-06-01
Information technology — Security
techniques — Information security risk
management
Technologies de l'information — Techniques de sécurité — Gestion des
risques liés à la sécurité de l'information

Reference number
©
ISO/IEC 2011
©  ISO/IEC 2011
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail [e-mail]
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2011 – All rights reserved

Contents Page
Foreword .v
Introduction.vi
1 Scope.1
2 Normative references.1
3 Terms and definitions .1
4 Structure of this International Standard .5
5 Background.6
6 Overview of the information security risk management process .7
7 Context establishment.10
7.1 General considerations.10
7.2 Basic Criteria .10
7.2.1 Risk management approach .10
7.2.2 Risk evaluation criteria .10
7.2.3 Impact criteria .11
7.2.4 Risk acceptance criteria .11
7.3 Scope and boundaries.12
7.4 Organization for information security risk management .12
8 Information security risk assessment.13
8.1 General description of information security risk assessment .13
8.2 Risk identification.13
8.2.1 Introduction to risk identification .13
8.2.2 Identification of assets.14
8.2.3 Identification of threats.14
8.2.4 Identification of existing controls.15
8.2.5 Identification of vulnerabilities .15
8.2.6 Identification of consequences.16
8.3 Risk analysis.17
8.3.1 Risk analysis methodologies .17
8.3.2 Assessment of consequences.18
8.3.3 Assessment of incident likelihood .18
8.3.4 Level of risk determination.19
8.4 Risk evaluation .19
9 Information security risk treatment .20
9.1 General description of risk treatment .20
© ISO/IEC 2011 – All rights reserved iii

9.2 Risk modification.22
9.3 Risk retention.23
9.4 Risk avoidance.23
9.5 Risk sharing .23
10 Information security risk acceptance .24
11 Information security risk communication and consultation .24
12 Information security risk monitoring and review .25
12.1 Monitoring and review of risk factors.25
12.2 Risk management monitoring, review and improvement.26
Annex A (informative) Defining the scope and boundaries of the information security risk
management process.28
A.1 Study of the organization.28
A.2 List of the constraints affecting the organization .29
A.3 List of the legislative and regulatory references applicable to the organization.31
A.4 List of the constraints affecting the scope .31
Annex B (informative) Identification and valuation of assets and impact assessment.33
B.1 Examples of asset identification.33
B.1.1 The identification of primary assets .33
B.1.2 List and description of supporting assets .34
B.2 Asset valuation .38
B.3 Impact assessment.41
Annex C (informative) Examples of typical threats .42
Annex D (informative) Vulnerabilities and methods for vulnerability assessment .45
D.1 Examples of vulnerabilities .45
D.2 Methods for assessment of technical vulnerabilities .48
Annex E (informative) Information security risk assessment approaches .50
E.1 High-level information security risk assessment.50
E.2 Detailed information security risk assessment.51
E.2.1 Example 1 Matrix with predefined values .52
E.2.2 Example 2 Ranking of Threats by Measures of Risk .54
E.2.3 Example 3 Assessing a value for the likelihood and the possible consequences of risks.54
Annex F (informative) Constraints for risk modification.56
Annex G (informative) Differences in definitions between ISO/IEC 27005:2008 and ISO/IEC
27005:2011.58
Bibliography .68

iv © ISO/IEC 2011 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members of
ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information
technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as
an International Standard requires approval by at least 75 % of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 27005 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
This second edition cancels and replaces the first edition (ISO/IEC 27005:2008) which has been technically
revised.
© ISO/IEC 2011 – All rights reserved v

Introduction
This International Standard provides guidelines for information security risk management in an organization,
supporting in particular the requirements of an information security management (ISMS) according to
ISO/IEC 27001. However, this International Standard does not provide any specific method for information
security risk management. It is up to the organization to define their approach to risk management, depending
for example on the scope of the ISMS, context of risk management, or industry sector. A number of existing
methodologies can be used under the framework described in this International Standard to implement the
requirements of an ISMS.
This International Standard is relevant to managers and staff concerned with information security risk
management within an organization and, where appropriate, external parties supporting such activities.
vi © ISO/IEC 2011 – All rights reserved

INTERNATIONAL STANDARD ISO/IEC 27005:2011(E)

Information technology — Security techniques — Information
security risk management
1 Scope
This International Standard provides guidelines for information security risk management.
This International Standard supports the general concepts specified in ISO/IEC 27001 and is designed to
assist the satisfactory implementation of information security based on a risk management approach.
Knowledge of the concepts, models, processes and terminologies described in ISO/IEC 27001 and
ISO/IEC 27002 is important for a complete understanding of this International Standard.
This International Standard is applicable to all types of organizations (e.g. commercial enterprises,
government agencies, non-profit organizations) which intend to manage risks that could compromise the
organization’s information security.
2 Normative references
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
ISO/IEC 27000, Information technology — Security techniques — Information security management
systems — Overview and vocabulary
ISO/IEC 27001:2005, Information technology — Security techniques — Information security management
systems — Requirements
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 27000 and the following apply.
NOTE Differences in definitions between ISO/IEC 27005:2008 and this International Standard are shown in Annex G.
3.1
consequence
outcome of an event (3.3) affecting objectives
[ISO Guide 73:2009]
NOTE 1 An event can lead to a range of consequences.
NOTE 2 A consequence can be certain or uncertain and in the context of information security is usually negative.
NOTE 3 Consequences can be expressed qualitatively or quantitatively.
NOTE 4 Initial consequences can escalate through knock-on effects.
© ISO/IEC 2011 – All rights reserved 1

3.2
control
measure that is modifying risk (3.9)
[ISO Guide 73:2009]
NOTE 1 Controls for information security include any process, policy, procedure, guideline, practice or organizational
structure, which can be administrative, technical, management, or legal in nature which modify information security risk.
NOTE 2 Controls may not always exert the intended or assumed modifying effect.
NOTE 3 Control is also used as a synonym for safeguard or countermeasure.
3.3
event
occurrence or change of a particular set of circumstances
[ISO Guide 73:2009]
NOTE 1 An event can be one or more occurrences, and can have several causes.
NOTE 2 An event can consist of something not happening.
NOTE 3 An event can sometimes be referred to as an “incident” or “accident”.
3.4
external context
external environment in which the organization seeks to achieve its objectives
[ISO Guide 73:2009]
NOTE External context can include:
⎯ the cultural, social, political, legal, regulatory, financial, technological, economic, natural and
competitive environment, whether international, national, regional or local;
⎯ key drivers and trends having impact on the objectives of the organization; and
⎯ relationships with, and perceptions and values of, external stakeholders.
3.5
internal context
internal environment in which the organization seeks to achieve its objectives
[ISO Guide 73:2009]
NOTE Internal context can include:
⎯ governance, organizational structure, roles and accountabilities;
⎯ policies, objectives, and the strategies that are in place to achieve them;
⎯ the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people,
processes, systems and technologies);
⎯ information systems, information flows and decision-making processes (both formal and informal);
⎯ relationships with, and perceptions and values of, internal stakeholders;
⎯ the organization's culture;
⎯ standards, guidelines and models adopted by the organization; and
⎯ form and extent of contractual relationships.

2 © ISO/IEC 2011 – All rights reserved

3.6
level of risk
magnitude of a risk (3.9), expressed in terms of the combination of consequences (3.1) and their likelihood
(3.7)
[ISO Guide 73:2009]
3.7
likelihood
chance of something happening
[ISO Guide 73:2009]
NOTE 1 In risk management terminology, the word “likelihood” is used to refer to the chance of something happening,
whether defined, measured or determined objectively or subjectively, qualitatively or quantitatively, and described using
general terms or mathematically (such as a probability or a frequency over a given time period).
NOTE 2 The English term “likelihood” does not have a direct equivalent in some languages; instead, the equivalent of
the term “probability” is often used. However, in English, “probability” is often narrowly interpreted as a mathematical term.
Therefore, in risk management terminology, “likelihood” is used with the intent that it should have the same broad
interpretation as the term “probability” has in many languages other than English.
3.8
residual risk
risk (3.9) remaining after risk treatment (3.17)
[ISO Guide 73:2009]
NOTE 1 Residual risk can contain unidentified risk.
NOTE 2 Residual risk can also be known as “retained risk”.
3.9
risk
effect of uncertainty on objectives

[ISO Guide 73:2009]
NOTE 1 An effect is a deviation from the expected — positive and/or negative.
NOTE 2 Objectives can have different aspects (such as financial, health and safety, information security, and
environmental goals) and can apply at different levels (such as strategic, organization-wide, project, product and process).
NOTE 3 Risk is often characterized by reference to potential events (3.3) and consequences (3.1), or a combination of
these.
NOTE 4 Information security risk is often expressed in terms of a combination of the consequences of an information
security event and the associated likelihood (3.9) of occurrence.
NOTE 5 Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of, an
event, its consequence, or likelihood.
NOTE 6 Information security risk is associated with the potential that threats will exploit vulnerabilities of an information
asset or group of information assets and thereby cause harm to an organization.
3.10
risk analysis
process to comprehend the nature of risk and to determine the level of risk (3.6)
[ISO Guide 73:2009]
© ISO/IEC 2011 – All rights reserved 3

NOTE 1 Risk analysis provides the basis for risk evaluation and decisions about risk treatment.
NOTE 2 Risk analysis includes risk estimation.
3.11
risk assessment
overall process of risk identification (3.15), risk analysis (3.10) and risk evaluation (3.14)
[ISO Guide 73:2009]
3.12
risk communication and consultation
continual and iterative processes that an organization conducts to provide, share or obtain information, and to
engage in dialogue with stakeholders (3.18) regarding the management of risk (3.9)
[ISO Guide 73:2009]
NOTE 1 The information can relate to the existence, nature, form, likelihood, significance, evaluation, acceptability and
treatment of risk.
NOTE 2 Consultation is a two-way process of informed communication between an organization and its stakeholders
on an issue prior to making a decision or determining a direction on that issue. Consultation is:
⎯ a process which impacts on a decision through influence rather than power; and
⎯ an input to decision making, not joint decision making.
3.13
risk criteria
terms of reference against which the significance of a risk (3.9) is evaluated
[ISO Guide 73:2009]
NOTE 1 Risk criteria are based on organizational objectives, and external and internal context.
NOTE 2 Risk criteria can be derived from standards, laws, policies and other requirements.
3.14
risk evaluation
process of comparing the results of risk analysis (3.10) with risk criteria (3.13) to determine whether the risk
and/or its magnitude is acceptable or tolerable
[ISO Guide 73:2009]
NOTE Risk evaluation assists in the decision about risk treatment.
3.15
risk identification
process of finding, recognizing and describing risks
[ISO Guide 73:2009]
NOTE 1 Risk identification involves the identification of risk sources, events, their causes and their potential
consequences.
NOTE 2 Risk identification can involve historical data, theoretical analysis, informed and expert opinions, and
stakeholders’ needs.
4 © ISO/IEC 2011 – All rights reserved

3.16
risk management
coordinated activities to direct and control an organization with regard to risk
[ISO Guide 73:2009]
NOTE This International Standard uses the term ‘process’ to describe risk management overall. The elements within
the risk management process are termed ‘activities’
3.17
risk treatment
process to modify risk
[ISO Guide 73:2009]
NOTE 1 Risk treatment can involve:
⎯ avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk;
⎯ taking or increasing risk in order to pursue an opportunity;
⎯ removing the risk source;
⎯ changing the likelihood;
⎯ changing the consequences;
⎯ sharing the risk with another party or parties (including contracts and risk financing); and
⎯ retaining the risk by informed choice.
NOTE 2 Risk treatments that deal with negative consequences are sometimes referred to as “risk mitigation”, “risk
elimination”, “risk prevention” and “risk reduction”.
NOTE 3 Risk treatment can create new risks or modify existing risks.
3.18
stakeholder
person or organization that can affect, be affected by, or perceive themselves to be affected by a decision or
activity
[ISO Guide 73:2009]
NOTE A decision maker can be a stakeholder.
4 Structure of this International Standard
This International Standard contains the description of the information security risk management process and
its activities.
The background information is provided in Clause 5.
A general overview of the information security risk management process is given in Clause 6.
All information security risk management activities as presented in Clause 6 are subsequently described in the
following clauses:
ƒ Context establishment in Clause 7,
ƒ Risk assessment in Clause 8,
ƒ Risk treatment in Clause 9,
© ISO/IEC 2011 – All rights reserved 5

ƒ Risk acceptance in Clause 10,
ƒ Risk communication in Clause 11,
ƒ Risk monitoring and review in Clause 12.
Additional information for information security risk management activities is presented in the annexes. The
context establishment is supported by Annex A (Defining the scope and boundaries of the information security
risk management process). Identification and valuation of assets and impact assessments are discussed in
Annex B. Annex C gives examples of typical threats and Annex D discusses vulnerabilities and methods for
vulnerability assessment. Examples of information security risk assessment approaches are presented in
Annex E.
Constraints for risk modification are presented in Annex F.
Differences in definitions between ISO/IEC 27005:2008 and ISO/IEC 27005:2011 are shown in Annex G.
All risk management activities as presented from Clause 7 to Clause 12 are structured as follows:
Input: Identifies any required information to perform the activity.
Action: Describes the activity.
Implementation guidance: Provides guidance on performing the action. Some of this guidance may not be
suitable in all cases and so other ways of performing the action may be more appropriate.
Output: Identifies any information derived after performing the activity.
5 Background
A systematic approach to information security risk management is necessary to identify organizational needs
regarding information security requirements and to create an effective information security management
system (ISMS). This approach should be suitable for the organization´s environment, and in particular should
be aligned with overall enterprise risk management. Security efforts should address risks in an effective and
timely manner where and when they are needed. Information security risk management should be an integral
part of all information security management activities and should be applied both to the implementation and
the ongoing operation of an ISMS.
Information security risk management should be a continual process. The process should establish the
external and internal context, assess the risks and treat the risks using a risk treatment plan to implement the
recommendations and decisions. Risk management analyses what can happen and what the possible
consequences can be, before deciding what should be done and when, to reduce the risk to an acceptable
level.
Information security risk management should contribute to the following:
ƒ Risks being identified
ƒ Risks being assessed in terms of their consequences to the business and the likelihood of their
occurrence
ƒ The likelihood and consequences of these risks being communicated and understood
ƒ Priority order for risk treatment being established
ƒ Priority for actions to reduce risks occurring
ƒ Stakeholders being involved when risk management decisions are made and kept informed of the risk
management status
ƒ Effectiveness of risk treatment monitoring
6 © ISO/IEC 2011 – All rights reserved

ƒ Risks and the risk management process being monitored and reviewed regularly
ƒ Information being captured to improve the risk management approach
ƒ Managers and staff being educated about the risks and the actions taken to mitigate them
The information security risk management process can be applied to the organization as a whole, any discrete
part of the organization (e.g. a department, a physical location, a service), any information system, existing or
planned or particular aspects of control (e.g. business continuity planning).
6 Overview of the information security risk management process
A high level view of the risk management process is specified in ISO 31000 and shown in Figure 1.

Figure 1 — The risk management process

© ISO/IEC 2011 – All rights reserved 7

Figure 2 shows how this International Standard applies this risk management process.
The information security risk management process consists of context establishment (Clause 7), risk
assessment (Clause 8), risk treatment (Clause 9), risk acceptance (Clause 10), risk communication and
consultation (Clause 11), and risk monitoring and review (Clause 12).

Figure 2 — Illustration of an information security risk management process
As Figure 2 illustrates, the information security risk management process can be iterative for risk assessment
and/or risk treatment activities. An iterative approach to conducting risk assessment can increase depth and
detail of the assessment at each iteration. The iterative approach provides a good balance between
minimizing the time and effort spent in identifying controls, while still ensuring that high risks are appropriately
assessed.
The context is established first. Then a risk assessment is conducted. If this provides sufficient information to
effectively determine the actions required to modify the risks to an acceptable level then the task is complete
and the risk treatment follows. If the information is insufficient, another iteration of the risk assessment with
8 © ISO/IEC 2011 – All rights reserved

revised context (e.g. risk evaluation criteria, risk acceptance criteria or impact criteria) will be conducted,
possibly on limited parts of the total scope (see Figure 2, Risk Decision Point 1).
The effectiveness of the risk treatment depends on the results of the risk assessment.
Note that risk treatment involves a cyclical process of:
• assessing a risk treatment;
• deciding whether residual risk levels are acceptable;
• generating a new risk treatment if risk levels are not acceptable; and
• assessing the effectiveness of that treatment
It is possible that the risk treatment will not immediately lead to an acceptable level of residual risk. In this
situation, another iteration of the risk assessment with changed context parameters (e.g. risk assessment, risk
acceptance or impact criteria), if necessary, may be required, followed by further risk treatment (see Figure 2,
Risk Decision Point 2).
The risk acceptance activity has to ensure residual risks are explicitly accepted by the managers of the
organization. This is especially important in a situation where the implementation of controls is omitted or
postponed, e.g. due to cost.
During the whole information security risk management process it is important that risks and their treatment
are communicated to the appropriate managers and operational staff. Even before the treatment of the risks,
information about identified risks can be very valuable to manage incidents and may help to reduce potential
damage. Awareness by managers and staff of the risks, the nature of the controls in place to mitigate the risks
and the areas of concern to the organization assist in dealing with incidents and unexpected events in the
most effective manner. The detailed results of every activity of the information security risk management
process and from the two risk decision points should be documented.
ISO/IEC 27001 specifies that the controls implemented within the scope, boundaries and context of the ISMS
need to be risk based. The application of an information security risk management process can satisfy this
requirement. There are many approaches by which the process can be successfully implemented in an
organization. The organization should use whatever approach best suits their circumstances for each specific
application of the process.
In an ISMS, establishing the context, risk assessment, developing risk treatment plan and risk acceptance are
all part of the “plan” phase. In the “do” phase of the ISMS, the actions and controls required to reduce the risk
to an acceptable level are implemented according to the risk treatment plan. In the “check” phase of the ISMS,
managers will determine the need for revisions of the risk assessment and risk treatment in the light of
incidents and changes in circumstances. In the ”act” phase, any actions required, including additional
application of the information security risk management process, are performed.
The following table summarizes the information security risk management activities relevant to the four
phases of the ISMS process:
Table 1 — Alignment of ISMS and Information Security Risk Management Process
ISMS Process Information Security Risk Management Process
Establishing the context
Risk assessment
Plan
Developing risk treatment plan
Risk acceptance
Do Implementation of risk treatment plan
Check Continual monitoring and reviewing of risks
Maintain and improve the Information Security Risk
Act
Management Process
© ISO/IEC 2011 – All rights reserved 9

7 Context establishment
7.1 General considerations
Input: All information about the organization relevant to the information security risk management context
establishment.
Action: The external and internal context for information security risk management should be established,
which involves setting the basic criteria necessary for information security risk management (7.2), defining the
scope and boundaries (7.3), and establishing an appropriate organization operating the information security
risk management (7.4).
Implementation guidance:
It is essential to determine the purpose of the information security risk management as this affects the overall
process and the context establishment in particular. This purpose can be:
ƒ Supporting an ISMS
ƒ Legal compliance and evidence of due diligence
ƒ Preparation of a business continuity plan
ƒ Preparation of an incident response plan
ƒ Description of the information security requirements for a product, a service or a mechanism
Implementation guidance for context establishment elements needed to support an ISMS is further discussed in
Clauses 7.2, 7.3 and 7.4 below.
NOTE ISO/IEC 27001:2005 does not use the term “context”. However, all of Clause 7 relates to the requirements
“define the scope and boundaries of the ISMS” [4.2.1 a)], “define an ISMS policy” [4.2.1 b)] and “define the risk
assessment approach” [4.2.1 c)], specified in ISO/IEC 27001:2005.
Output: The specification of basic criteria, the scope and boundaries, and the organization for the information
security risk management process.
7.2 Basic Criteria
7.2.1 Risk management approach
Depending on the scope and objectives of the risk management, different approaches can be applied. The
approach might also be different for each iteration.
An appropriate risk management approach should be selected or developed that addresses basic criteria such
as: risk evaluation criteria, impact criteria, risk acceptance criteria.
Additionally, the organization should assess whether necessary resources are available to:
ƒ Perform risk assessment and establish a risk treatment plan
ƒ Define and implement policies and procedures, including implementation of the controls selected
ƒ Monitor controls
ƒ Monitor the information security risk management process
NOTE See also ISO/IEC 27001:2005 (Clause 5.2.1) concerning the provision of resources for the implementation
and operation of an ISMS.
7.2.2 Risk evaluation criteria
Risk evaluation criteria should be developed for evaluating the organization's information security risk
considering the followings:
ƒ The strategic value of the business information process
ƒ The criticality of the information assets involved
ƒ Legal and regulatory requirements, and contractual obligations
10 © ISO/IEC 2011 – All rights reserved

ƒ Operational and business importance of availability, confidentiality and integrity
ƒ Stakeholders expectations and perceptions, and negative consequences for goodwill and reputation
Additionally, risk evaluation criteria can be used to specify priorities for risk treatment.
7.2.3 Impact criteria
Impact criteria should be developed and specified in terms of the degree of damage or costs to the
organization caused by an information security event considering the following:
ƒ Level of classification of the impacted information asset
ƒ Breaches of information security (e.g. loss of confidentiality, integrity and availability)
ƒ Impaired operations (internal or third parties)
ƒ Loss of business and financial value
ƒ Disruption of plans and deadlines
ƒ Damage of reputation
ƒ Breaches of legal, regulatory or contractual requirements
NOTE See also ISO/IEC 27001:2005 [Clause 4.2.1 d) 4] concerning the impact criteria identification for losses of
confidentiality, integrity and availability.
7.2.4 Risk acceptance criteria
Risk acceptance criteria should be developed and specified. Risk acceptance criteria often depend on the
organization's policies, goals, objectives and the interests of stakeholders.
An organization should define its own scales for levels of risk acceptance. The following should be considered
during development:
ƒ Risk acceptance criteria may include multiple thresholds, with a desired target level of risk, but provision
for senior managers to accept risks above this level under defined circumstances
ƒ Risk acceptance criteria may be expressed as the ratio of estimated profit (or other business benefit) to
the estimated risk
ƒ Different risk acceptance criteria may apply to different classes of risk, e.g. risks that could result in non-
compliance with regulations or laws may not be accepted, while acceptance of high risks may be allowed
if this is specified as a contractual requirement
ƒ Risk acceptance criteria may include requirements for future additional treatment, e.g. a risk may be
accepted if there is approval and commitment to take action to reduce it to an acceptable level within a
defined time period
Risk acceptance criteria may differ according to how long the risk is expected to exist, e.g. the risk may be
associated with a temporary or short term activity. Risk acceptance criteria should be set up considering the
following:
ƒ Business criteria
ƒ Legal and regulatory aspects
ƒ Operations
ƒ Technology
ƒ Finance
ƒ Social and humanitarian factors
NOTE Risk acceptance criteria correspond to “criteria for accepting risks and identify the acceptable level of risk”
specified in ISO/IEC 27001:2005 Clause 4.2.1 c) 2).
More information can be found in Annex A.
© ISO/IEC 2011 – All rights reserved 11

7.3 Scope and boundaries
The organization should define the scope and boundaries of information security risk management.
The scope of the information security risk management process needs to be defined to ensure that all relevant
assets are taken into account in the risk assessment. In addition, the boundaries need to be identified
[see also ISO/IEC 27001:2005 Clause 4.2.1 a)] to address those risks that might arise through these
boundaries.
Information about the organization should be collected to determine the environment it operates in and its
relevance to the information security risk management process.
When defining the scope and boundaries, the organization should consider the following information:
ƒ The organization's strategic business objectives, strategies and policies
ƒ Business processes
ƒ The organization’s functions and structure
ƒ Legal, regulatory and contractual requirements applicable to the organization
ƒ The organization's information security policy
ƒ The organization’s overall approach to risk management
ƒ Information assets
ƒ Locations of the organization and their geographical characteristics
ƒ Constraints affecting the organization
ƒ Expectation of stakeholders
ƒ Socio-cultural environment
ƒ Interfaces (i.e. information exchange with the environment)
Additionally, the organization should provide justification for any exclusion from the scope.
Examples of the risk management scope may be an IT application, IT infrastructure, a business process, or a
defined part of an organization.
NOTE The scope and boundaries of the information security risk management is related to the scope and boundaries
of the ISMS required in ISO/IEC 27001:2005 4.2.1 a).
Further information can be found in Annex A.
7.4 Organization for information security risk management
The organization and responsibilities for the information security risk management process should be set up
and maintained. The following are the main roles and responsibilities of this organization:
ƒ Development of the information security risk management process suitable for the organization
ƒ Identification and analysis of the stakeholders
ƒ Definition of roles and responsibilities of all parties both internal and external to the organization
ƒ Establishment of the required relationships between the organization and stakeholders, as well as
interfaces to the organization's high level risk management functions (e.g. operational risk management),
as well as interfaces to other relevant projects or activities
ƒ Definition of decision escalation paths
ƒ Specification of records to be kept
This organization should be approved by the appropriate managers of the organization.
NOTE ISO/IEC 27001:2005 requires determination and provision of the resources needed to establish, implement,
operate, monitor, review, maintain and improve an ISMS [5.2.1 a)]. The organization for risk management operations may
be regarded as one of the resources required by ISO/IEC 27001:2005.
12 © ISO/IEC 2011 – All rights reserved

8 Information security risk assessment
8.1 General description of information security risk assessment
NOTE Risk assessment activity is referred to as process in ISO/IEC 27001:2005.
Input: Basic criteria, the scope and boundaries, and the organization for the information security risk
management process being established.
Action: Risks should be identified, quantified or qualitatively described, and prioritized against risk evaluation
criteria and objectives relevant to the organization.
Implementation guidance:
A risk is a combination of the consequences that would follow from the occurrence of an unwanted event and
the likelihood of the occurrence of the event. Risk assessment quantifies or qualitatively describes the risk and
enables managers to prioritize risks according to their perceived seriousness or other established criteria.
Risk assessment consists of the following activities:
ƒ Risk Identification (clause 8.2)
ƒ Risk analysis (cla
...

NORME ISO/CEI
INTERNATIONALE 27005
Deuxième édition
2011-06-01
Technologies de l'information —
Techniques de sécurité —Gestion des
risques liés à la sécurité de l'information
Information technology — Security techniques — Information security
risk management
Numéro de référence
ISO/CEI 27005:2011(F)
©
ISO/CEI 2011
ISO/CEI 27005:2011(F)
DOCUMENT PROTÉGÉ PAR COPYRIGHT

©  ISO/CEI 2011
Droits de reproduction réservés. Sauf prescription différente, aucune partie de cette publication ne peut être reproduite ni utilisée sous
quelque forme que ce soit et par aucun procédé, électronique ou mécanique, y compris la photocopie et les microfilms, sans l'accord écrit
de l'ISO à l'adresse ci-après ou du comité membre de l'ISO dans le pays du demandeur.
ISO copyright office
Case postale 56  CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail [e-mail]
Web www.iso.org
Version française parue en 2013
Publié en Suisse
ii © ISO/CEI 2011 – Tous droits réservés

ISO/CEI 27005:2011(F)
Sommaire Page
1  Domaine d'application . 1
2  Références normatives . 1
3  Termes et définitions . 1
4  Structure de la présente Norme internationale . 6
5  Contexte . 6
6  Présentation générale du processus de gestion des risques en sécurité de l'information . 7
7  Établissement du contexte . 11
7.1  Considérations générales . 11
7.2  Critères de base . 12
7.2.1  Approche de gestion des risques . 12
7.2.2  Critères d'évaluation du risque . 12
7.2.3  Critères d'impact . 12
7.2.4  Critères d'acceptation des risques . 13
7.3  Domaine d'application et limites . 13
7.4  Organisation de la gestion des risques en sécurité de l'information . 14
8  Appréciation des risques en sécurité de l'information . 15
8.1  Description générale de l'appréciation des risques en sécurité de l'information . 15
8.2  Identification des risques . 16
8.2.1  Introduction à l'identification des risques . 16
8.2.2  Identification des actifs . 16
8.2.3  Identification des menaces . 17
8.2.4  Identification des mesures de sécurité existantes . 17
8.2.5  Identification des vulnérabilités . 18
8.2.6  Identification des conséquences . 19
8.3  Analyse des risques . 20
8.3.1  Méthodologies d'analyse des risques . 20
8.3.2  Appréciation des conséquences . 21
8.3.3  Appréciation de la vraisemblance d'un incident . 22
8.3.4  Estimation du niveau des risques . 23
8.4  Évaluation des risques . 23
9  Traitement des risques en sécurité de l'information . 24
9.1  Description générale du traitement des risques . 24
9.2  Réduction du risque . 26
9.3  Maintien des risques . 28
9.4  Refus des risques . 28
9.5  Partage des risques . 28
10  Acceptation des risques en sécurité de l'information . 28
11  Communication et concertation relatives aux risques en sécurité de l'information . 29
12  Surveillance et revue du risque en sécurité de l'information . 30
12.1  Surveillance et revue des facteurs de risque . 30
12.2  Surveillance, revue et amélioration de la gestion des risques . 31
Annexe A (informative) Définition du domaine d'application et des limites du processus de
gestion des risques en sécurité de l'information . 33
A.1  Étude de l'organisation . 33
A.2  Liste des contraintes affectant l'organisation . 34
A.3  Liste des références législatives et réglementaires applicables à l'organisation . 36
© ISO/CEI 2011 – Tous droits réservés iii

ISO/CEI 27005:2011(F)
A.4  Liste des contraintes affectant le domaine d'application .36
Annexe B (informative) Identification et valorisation des actifs et appréciation des impacts .39
B.1  Exemples d'identification des actifs .39
B.1.1  Identification des actifs primordiaux .39
B.1.2  Liste et description des actifs en support .40
B.2  Valorisation des actifs .45
B.3  Appréciation des impacts .48
Annexe C (informative) Exemples de menaces types .50
Annexe D (informative) Vulnérabilités et méthodes d'appréciation des vulnérabilités .52
D.1  Exemples de vulnérabilités .52
D.2  Méthodes d'appréciation des vulnérabilités techniques .55
Annexe E (informative) Approches d'appréciation des risques en sécurité de l'information .57
E.1  Appréciation des risques de haut niveau en sécurité de l'information .57
E.2  Appréciation détaillée des risques en sécurité de l'information .58
E.2.1  Exemple 1 — Matrice avec valeurs prédéfinies .59
E.2.2  Exemple 2 — Classement des menaces par mesures des risques .61
E.2.3  Exemple 3 — Appréciation d'une valeur relative à la vraisemblance et aux conséquences
possibles des risques .62
Annexe F (informative) Contraintes liées à la réduction du risque .64
Annexe G (informative) Différences de définitions entre l’ISO/CEI 27005:2008 et
l’ISO/CEI 27005:2011 .66
Bibliographie .77

iv © ISO/CEI 2011 – Tous droits réservés

ISO/CEI 27005:2011(F)
Avant-propos
L'ISO (Organisation internationale de normalisation) est une fédération mondiale d'organismes nationaux de
normalisation (comités membres de l'ISO). L'élaboration des Normes internationales est en général confiée
aux comités techniques de l'ISO. Chaque comité membre intéressé par une étude a le droit de faire partie du
comité technique créé à cet effet. Les organisations internationales, gouvernementales et non
gouvernementales, en liaison avec l'ISO participent également aux travaux. L'ISO collabore étroitement avec
la Commission électrotechnique internationale (CEI) en ce qui concerne la normalisation électrotechnique.
Les Normes internationales sont rédigées conformément aux règles données dans les Directives ISO/CEI,
Partie 2.
La tâche principale des comités techniques est d'élaborer les Normes internationales. Les projets de Normes
internationales adoptés par les comités techniques sont soumis aux comités membres pour vote. Leur
publication comme Normes internationales requiert l'approbation de 75 % au moins des comités membres
votants.
L'attention est appelée sur le fait que certains des éléments du présent document peuvent faire l'objet de
droits de propriété intellectuelle ou de droits analogues. L'ISO ne saurait être tenue pour responsable de ne
pas avoir identifié de tels droits de propriété et averti de leur existence.
L'ISO/CEI 27005 a été élaborée par le comité technique ISO/CEI JTC 1, Technologies de l'information,
sous-comité SC 27, Techniques de sécurité des technologies de l'information.
Cette deuxième édition annule et remplace la première édition (ISO/CEI 27005:2008), qui a fait l'objet d'une
révision technique.
© ISO/CEI 2011 – Tous droits réservés v

ISO/CEI 27005:2011(F)
Introduction
La présente Norme internationale contient des lignes directrices relatives à la gestion des risques en sécurité
de l'information dans une organisation, qui viennent notamment en appui des exigences d'un SMSI (système
de management de la sécurité de l'information) tel que défini dans l'ISO/CEI 27001. Cependant, la présente
Norme internationale ne fournit aucune méthodologie spécifique à la gestion des risques en sécurité de
l'information. Il est du ressort de chaque organisation de définir son approche de la gestion des risques, en
fonction, par exemple, du périmètre du SMSI, de ce qui existe dans l'organisation dans le domaine de la
gestion des risques, ou encore de son secteur industriel. Plusieurs méthodologies existantes peuvent être
utilisées en cohérence avec le cadre décrit dans la présente Norme internationale pour appliquer les
exigences du SMSI.
La présente Norme internationale s'adresse aux responsables et aux personnels concernés par la gestion des
risques en sécurité de l'information au sein d'une organisation et, le cas échéant, aux tiers prenant part à ces
activités.
vi © ISO/CEI 2011 – Tous droits réservés

NORME INTERNATIONALE ISO/CEI 27005:2011(F)

Technologies de l'information — Techniques de sécurité —
Gestion des risques en sécurité de l'information
1 Domaine d'application
La présente Norme internationale contient des lignes directrices relatives à la gestion des risques en sécurité
de l'information.
La présente Norme internationale vient en appui des concepts généraux énoncés dans l'ISO/CEI 27001; elle
est conçue pour aider à la mise en place de la sécurité de l'information basée sur une approche de gestion
des risques.
Il est important de connaître les concepts, les modèles, les processus et les terminologies décrites dans
l'ISO/CEI 27001 et l'ISO/CEI 27002 afin de bien comprendre la présente Norme internationale.
La présente Norme internationale est applicable à tous types d'organisations (par exemple les entreprises
commerciales, les agences gouvernementales, les organisations à but non lucratif) qui ont l'intention de gérer
des risques susceptibles de compromettre la sécurité des informations de l'organisation.
2 Références normatives
Les documents de référence suivants sont indispensables pour l'application du présent document. Pour les
références datées, seule l'édition citée s'applique. Pour les références non datées, la dernière édition du
document de référence s'applique (y compris les éventuels amendements).
ISO/CEI 27000, Technologies de l'information — Techniques de sécurité — Systèmes de management de la
sécurité de l'information — Vue d'ensemble et vocabulaire
ISO/CEI 27001:2005, Technologies de l'information — Techniques de sécurité — Systèmes de gestion de la
sécurité de l'information — Exigences
3 Termes et définitions
Pour les besoins du présent document, les termes et définitions donnés dans l'ISO/CEI 27000 et les suivants
s'appliquent.
NOTE Les différences de définitions entre l’ISO/CEI 27005:2008 et la présente Norme internationale sont indiquées
dans l’Annexe G.
3.1
conséquence
effet d’un événement (3.3) affectant les objectifs
[Guide ISO 73:2009]
NOTE 1 Un événement unique peut engendrer des conséquences multiples.
© ISO/CEI 2011 – Tous droits réservés 1

ISO/CEI 27005:2011(F)
NOTE 2 Une conséquence peut être certaine ou incertaine et dans le cadre de la sécurité de l’information elle est
généralement négative.
NOTE 3 Les conséquences peuvent être exprimées de façon qualitative ou quantitative.
NOTE 4 Des conséquences initiales peuvent déclencher des réactions en chaîne.
3.2
mesure de sécurité
mesure qui modifie un risque (3.9)
[Guide ISO 73:2009]
NOTE 1 Une mesure de sécurité du risque en sécurité de l’information inclut n’importe quel processus, politique,
procédure, recommandation, dispositif pratique ou organisation, qui peut être d’ordre administratif, technique, managérial
ou juridique et qui modifie le risque en sécurité de l’information.
NOTE 2 Une mesure de sécurité du risque n’aboutit pas toujours à la modification voulue ou supposée.
NOTE 3 Une mesure de sécurité du risque est également utilisée comme synonyme de protection ou contre-mesure.
3.3
événement
occurrence ou changement d’un ensemble particulier de circonstances
[Guide ISO 73:2009]
NOTE 1 Un événement peut être unique ou se reproduire, et peut avoir plusieurs causes.
NOTE 2 Un événement peut consister en quelque chose qui ne se produit pas.
NOTE 3 Il peut parfois être fait référence à un événement en tant qu’«incident» ou «accident».
3.4
contexte externe
environnement externe dans lequel l’organisation cherche à atteindre ses objectifs
[Guide ISO 73:2009]
NOTE Le contexte externe peut inclure:
 l’environnement culturel, social, politique, légal, réglementaire, financier, technologique, économique, naturel et
concurrentiel, au niveau international, national, régional ou local;
 les facteurs et tendances ayant un impact déterminant sur les objectifs de l’organisation; et
 les relations avec les parties prenantes externes, leurs perceptions et leurs valeurs.
3.5
contexte interne
environnement interne dans lequel l’organisation cherche à atteindre ses objectifs
[Guide ISO 73:2009]
NOTE Le contexte interne peut inclure:
 la gouvernance, l’organisation, les rôles et responsabilités;
 les politiques, les objectifs et les stratégies mises en place pour atteindre ces derniers;
2 © ISO/CEI 2011 – Tous droits réservés

ISO/CEI 27005:2011(F)
 les capacités, en termes de ressources et de connaissances (par exemple capital, temps, personnels, processus,
systèmes et technologies);
 les systèmes d’information, les flux d’information et les processus de prise de décision (à la fois formels et informels);
 les relations avec les parties prenantes internes, ainsi que leurs perceptions et leurs valeurs;
 la culture de l’organisation;
 les normes, lignes directrices et modèles adoptés par l’organisation; et
 la forme et l’étendue des relations contractuelles.
3.6
niveau de risque
importance d’un risque (3.9), exprimée en termes de combinaison des conséquences (3.1) et de leur
vraisemblance (3.7)
[Guide ISO 73:2009]
3.7
vraisemblance
possibilité que quelque chose se produise
[Guide ISO 73:2009]
NOTE 1 Dans la terminologie de la gestion des risques, le mot «vraisemblance» est utilisé pour indiquer la possibilité
que quelque chose se produise, que cette possibilité soit définie, mesurée ou déterminée de façon objective ou subjective,
qualitative ou quantitative, et qu’elle soit décrite au moyen de termes généraux ou mathématiques (telles une probabilité
ou une fréquence sur une période donnée).
NOTE 2 Le terme anglais «likelihood» (vraisemblance) n’a pas d’équivalent direct dans certaines langues et c’est
souvent l’équivalent du terme «probability» (probabilité) qui est utilisé à la place. En anglais, cependant, le terme
«probability» (probabilité) est souvent limité à son interprétation mathématique. Par conséquent, dans la terminologie de
la gestion des risques, le terme «vraisemblance» est utilisé avec l’intention qu’il fasse l’objet d’une interprétation aussi
large que celle dont bénéficie le terme «probability» (probabilité) dans de nombreuses langues autres que l’anglais.
3.8
risque résiduel
risque (3.9) subsistant après le traitement des risques (3.17)
[Guide ISO 73:2009]
NOTE 1 Un risque résiduel peut inclure des risques non identifiés.
NOTE 2 Un risque résiduel peut également être appelé «risque maintenu».
3.9
risque
effet de l’incertitude sur l’atteinte des objectifs
[Guide ISO 73:2009]
NOTE 1 Un effet est un écart, positif et/ou négatif, par rapport à un attendu, positif et/ou négatif.
NOTE 2 Les objectifs peuvent avoir différents aspects (par exemple buts financiers, de santé et de sécurité, ou
environnementaux) et peuvent concerner différents niveaux (niveau stratégique, niveau d’un projet, d’un produit, d’un
processus ou d’une organisation toute entière).
NOTE 3 Un risque est souvent caractérisé en référence à des événements (3.3) et des conséquences (3.1) potentiels
ou à une combinaison des deux.
© ISO/CEI 2011 – Tous droits réservés 3

ISO/CEI 27005:2011(F)
NOTE 4 Un risque en sécurité de l’information est souvent exprimé en termes de combinaison des conséquences d’un
événement de sécurité de l’information et de sa vraisemblance (3.9).
NOTE 5 L’incertitude est l’état, même partiel, de défaut d’information concernant la compréhension ou la connaissance
d’un événement, de ses conséquences ou de sa vraisemblance.
NOTE 6 Le risque en sécurité de l’information est associé à la possibilité que des menaces exploitent les vulnérabilités
d’une ressource d’information ou d’un groupe de ressources d’information et portent de ce fait préjudice à l’organisation.
3.10
analyse des risques
processus mis en œuvre pour comprendre la nature d’un risque et pour déterminer le niveau de risque (3.6)
[Guide ISO 73:2009]
NOTE 1 L’analyse des risques fournit la base de l’évaluation du risque et les décisions relatives au traitement des
risques.
NOTE 2 L’analyse des risques inclut l’estimation des risques.
3.11
appréciation des risques
ensemble du processus d’identification des risques (3.15), d’analyse des risques (3.10) et d’évaluation
du risque (3.14)
[Guide ISO 73:2009]
3.12
communication et concertation relatives aux risques
processus itératifs et continus mis en œuvre par une organisation afin de fournir, partager ou obtenir des
informations et d’engager un dialogue avec les parties prenantes (3.18) concernant la gestion des
risques (3.9)
[Guide ISO 73:2009]
NOTE 1 Ces informations peuvent concerner l’existence, la nature, la forme, la vraisemblance, l’importance,
l’évaluation, l’acceptabilité et le traitement des risques.
NOTE 2 La concertation est un processus de communication argumentée à double sens entre une organisation et ses
parties prenantes sur une question donnée avant de prendre une décision ou de déterminer une orientation concernant
ladite question. La concertation est:
 un processus dont l’effet sur une décision s’exerce par l’influence plutôt que par le pouvoir; et
 une contribution à une prise de décision, et non une prise de décision conjointe.
3.13
critères de risque
termes de référence vis-à-vis desquels le caractère significatif d’un risque (3.9) est évalué
[Guide ISO 73:2009]
NOTE 1 Les critères de risque sont fondés sur les objectifs de l’organisation ainsi que sur le contexte externe et
interne.
NOTE 2 Les critères de risque peuvent être issus de normes, de lois, de politiques et d’autres exigences.
3.14
évaluation du risque
processus de comparaison des résultats de l’analyse des risques (3.10) avec les critères de risque (3.13)
afin de déterminer si les risques et/ou leur importance sont acceptables ou tolérables
4 © ISO/CEI 2011 – Tous droits réservés

ISO/CEI 27005:2011(F)
[Guide ISO 73:2009]
NOTE L’évaluation du risque aide à la prise de décision relative au traitement des risques.
3.15
identification des risques
processus de recherche, de reconnaissance et de description des risques
[Guide ISO 73:2009]
NOTE 1 L’identification des risques comprend l’identification des sources de risque, des événements, de leurs causes
et de leurs conséquences potentielles.
NOTE 2 L’identification des risques peut faire appel à des données historiques, des analyses théoriques, des avis
d’experts et autres personnes compétentes et tenir compte des besoins des parties prenantes.
3.16
gestion des risques
activités coordonnées dans le but de diriger et piloter une organisation en prenant en compte les risques
[Guide ISO 73:2009]
NOTE La présente Norme internationale utilise le terme «processus» pour décrire l’ensemble de la gestion des
risques. Les éléments internes au processus de gestion des risques sont désignés les «activités».
3.17
traitement des risques
processus destiné à modifier un risque
[Guide ISO 73:2009]
NOTE 1 Le traitement des risques peut inclure:
 un refus du risque en décidant de ne pas démarrer ou poursuivre l’activité porteuse du risque;
 la prise ou l’augmentation d’un risque afin de saisir une opportunité;
 l’élimination de la source de risque;
 une modification de la vraisemblance;
 une modification des conséquences;
 un partage du risque avec une ou plusieurs autres parties (incluant des contrats et un financement du risque); et
 un maintien du risque fondé sur une décision argumentée.
NOTE 2 Les traitements des risques portant sur les conséquences négatives sont parfois appelés «atténuation du
risque», «élimination du risque», «prévention du risque» et «réduction du risque».
NOTE 3 Le traitement des risques peut créer de nouveaux risques ou modifier des risques existants.
3.18
partie prenante
personne ou organisation susceptible d’affecter, d’être affectée ou de se sentir elle-même affectée par une
décision ou une activité
[Guide ISO 73:2009]
NOTE Un décideur peut être une partie prenante.
© ISO/CEI 2011 – Tous droits réservés 5

ISO/CEI 27005:2011(F)
4 Structure de la présente Norme internationale
La présente Norme internationale contient la description du processus de gestion des risques en sécurité de
l'information, et la description de ses activités.
Les informations générales sont fournies dans l'Article 5.
Un aperçu général du processus de gestion des risques en sécurité de l'information est donné dans l'Article 6.
Toutes les activités liées à la gestion des risques en sécurité de l'information, telles que présentées
dans l'Article 6, sont ensuite décrites dans les articles suivants:
 établissement du contexte dans l'Article 7;
 appréciation des risques dans l'Article 8;
 traitement des risques dans l'Article 9;
 acceptation des risques dans l'Article 10;
 communication et concertation relatives aux risques dans l'Article 11;
 surveillance et revue du risque dans l'Article 12.
Des informations supplémentaires relatives aux activités de gestion des risques en sécurité de l'information
sont présentées dans les annexes. L'établissement du contexte est abordé dans l'Annexe A (Définition du
domaine d'application et des limites du processus de gestion des risques en sécurité de l'information).
L'identification, la valorisation des actifs et l'appréciation des impacts sont traitées dans l'Annexe B (Exemples
d'identification des actifs). L'Annexe C donne des xemples de menaces type et l'Annexe D traite des
vulnérabilités et des méthodes d’appréciation des vulnérabilités. Des exemples d'approches relatives à
l'appréciation des risques en sécurité de l'information sont présentés dans l'Annexe E.
Les contraintes liées à la réduction du risque sont traitées dans l'Annexe F.
Les différences de définitions entre l’ISO/CEI 27005:2008 et l’ISO/CEI 27005:2011 sont indiquées dans
l’Annexe G.
Toutes les activités liées à la gestion des risques, présentées dans les Articles 7 à 12, sont structurées de la
manière suivante:
Élément(s) d'entrée: Identifie toute information requise pour réaliser l'activité.
Action: Décrit l'activité.
Préconisations de mise en œuvre: Propose des préconisations pour réaliser l'action. Il se peut que certaines
préconisations ne soient pas adaptées à tous les cas, et que d'autres solutions pour réaliser l'action s'avèrent
préférables.
Élément(s) de sortie: Identifie toute information obtenue après la réalisation de l'activité.
5 Contexte
Une approche systématique de la gestion des risques en sécurité de l'information est nécessaire pour
identifier les besoins organisationnels concernant les exigences en matière de sécurité de l'information, et
pour créer un système de management de la sécurité de l'information (SMSI) efficace. Il convient que cette
approche soit adaptée à l'environnement de l'organisation, et soit notamment alignée sur la démarche
générale de gestion des risques de l'entreprise. Il convient que les efforts effectués en matière de sécurité
adressent les risques de manière efficace et opportune quand et lorsque cela est nécessaire. Il convient que
6 © ISO/CEI 2011 – Tous droits réservés

ISO/CEI 27005:2011(F)
la gestion des risques en sécurité de l'information fasse partie intégrante de l'ensemble des activités de
management de la sécurité de l'information et qu'elle s'applique à la fois à la mise en œuvre et au
fonctionnement d'un SMSI.
Il convient que la gestion des risques en sécurité de l'information soit un processus continu. Il convient que ce
processus établisse le contexte externe et interne, apprécie les risques et les traite à l'aide d'un plan de
traitement des risques permettant de mettre en œuvre les recommandations et décisions. La gestion des
risques analyse les évènements susceptibles de se produire ainsi que leurs possibles conséquences avant de
décider de ce qui pourrait être fait, dans quels délais et à quel moment, pour réduire les risques à un niveau
acceptable.
Il convient que la gestion des risques en sécurité de l'information contribue à ce qui suit:
 l'identification des risques;
 l'appréciation des risques en termes de conséquences sur les activités métier et de vraisemblance;
 la communication et la compréhension de la vraisemblance et des conséquences de ces risques;
 l'établissement d'un ordre de priorité pour le traitement des risques;
 la définition des priorités d'actions afin de réduire les occurrences des risques;
 l'implication des parties prenantes lors de la prise de décisions relatives à la gestion des risques et
l'information sur l'état de la gestion des risques;
 l'efficacité de la supervision du traitement des risques;
 la surveillance et la revue régulières des risques et du processus de gestion des risques;
 la capture de l'information afin d'améliorer l'approche de gestion des risques;
 la formation des dirigeants et du personnel sur les risques et les actions à entreprendre pour les atténuer.
Le processus de gestion des risques en sécurité de l'information peut s'appliquer à l'organisation dans son
ensemble, à toute partie distincte de l'organisation (à titre d'exemples un département, un lieu physique, un
service), à tout système d'information existant ou prévu, ou à des types particuliers de mesures de sécurité
(par exemple la planification de la continuité d'activité).
6 Présentation générale du processus de gestion des risques en sécurité de
l'information
Un aperçu de haut niveau du processus de gestion des risques est spécifié dans l’ISO 31000 et illustré à la
Figure 1.
© ISO/CEI 2011 – Tous droits réservés 7

ISO/CEI 27005:2011(F)
Figure 1 — Processus de gestion des risques
La Figure 2 illustre la manière dont la présente Norme internationale applique ce processus de gestion des
risques.
Le processus de gestion des risques en sécurité de l'information comprend l'établissement du contexte
(Article 7), l'appréciation des risques (Article 8), le traitement des risques (Article 9), l'acceptation des risques
(Article 10), la communication relative aux risques (Article 11), ainsi que la surveillance et la revue du risque
(Article 12).
8 © ISO/CEI 2011 – Tous droits réservés

ISO/CEI 27005:2011(F)
Figure 2 — Illustration du processus de gestion des risques en sécurité de l'information
Comme l'illustre la Figure 2, le processus de gestion des risques en sécurité de l'information peut être itératif
pour les activités d'appréciation et/ou de traitement des risques. Une approche itérative de conduite de
l'appréciation des risques permet d'approfondir et de préciser l'appréciation à chaque itération. Cette
approche itérative assure un bon équilibre entre la minimisation du temps et des efforts investis dans
l'identification des mesures de sécurité et l'assurance que les risques élevés sont correctement appréciés.
© ISO/CEI 2011 – Tous droits réservés 9

ISO/CEI 27005:2011(F)
Le contexte est établi en premier lieu. Une appréciation des risques est ensuite réalisée. Si cette appréciation
donne suffisamment d'informations pour déterminer correctement les actions nécessaires pour ramener les
risques à un niveau acceptable, la tâche est alors terminée et suivie par le traitement des risques. Si les
informations ne sont pas suffisantes, une autre itération de l'appréciation des risques sera réalisée avec un
contexte révisé (par exemple les critères d'évaluation du risque, les critères d'acceptation des risques ou les
critères d'impact) et, éventuellement, sur des parties limitées de l'ensemble du domaine d'application (voir la
Figure 2, point de décision du risque n° 1).
L'efficacité du traitement des risques dépend des résultats de l'appréciation des risques.
Il est à noter que le traitement des risques implique un processus cyclique de:
 appréciation d'un traitement des risques;
 décision de reconnaître si les niveaux de risque résiduel sont acceptables;
 génération d’un nouveau traitement des risques si les niveaux de risque ne sont pas acceptables; et
 appréciation de l’efficacité du traitement considéré.
Il est possible que le traitement des risques ne donne pas immédiatement un niveau acceptable de risque
résiduel. Dans ce cas, une nouvelle itération de l'appréciation des risques utilisant, si nécessaire, de
nouveaux paramètres de contexte (à titre d'exemples l'appréciation des risques, l'acceptation des risques ou
les critères d'impact) peut être requise et suivie d'un autre traitement des risques (voir la Figure 2, Point de
décision du risque n° 2).
L'activité d'acceptation des risques doit garantir que les risques résiduels sont explicitement acceptés par les
dirigeants de l'organisation. Elle est particulièrement importante dans une situation où la mise en œuvre de
mesures de sécurité est omise ou reportée, par exemple en raison des coûts.
Au cours de l’ensemble du processus de gestion des risques en sécurité de l'information, il est important que
les risques et leur traitement soient communiqués aux dirigeants et au personnel concerné. Avant même le
traitement des risques, les informations relatives aux risques identifiés peuvent être très utiles pour gérer les
incidents et contribuer à réduire les dommages potentiels. La sensibilisation des dirigeants et du personnel
aux risques, la nature des mesures de sécurité mises en place pour atténuer les risques et les problèmes
rencontrés par l'organisation sont utiles pour gérer les incidents et les événements imprévus de la manière la
plus efficace. Il convient de documenter les résultats détaillés de toute activité du processus de gestion des
risques en sécurité de l'information, ainsi que ceux obtenus à partir des deux points de décision de risque.
L'ISO/CEI 27001 spécifie que les mesures de sécurité mises en œuvre dans le domaine d'application, les
limites et le contexte du SMSI doivent être fondées sur le risque. L'application d'un processus de gestion des
risques en sécurité de l'information peut répondre à cette exigence. De nombreuses approches de ce
processus peuvent être mises en œuvre avec succès au sein d'une organisation. Il convient que cette
dernière utilise l'approche la plus adaptée à ses besoins pour chacun des usages spécifiques du processus.
Dans un SMSI, l'établissement du contexte, l'appréciation des risques, l'élaboration d'un plan de traitement
des risques et l'acceptation des risques font partie intégrante de la phase «Planifier». Lors de la phase
«Déployer» du SMSI, les actions et mesures de sécurité requises pour ramener le risque à un niveau
acceptable sont mises en œuvre, conformément au plan de traitement des risques. Lors de la phase
«Contrôler» du SMSI, les dirigeants déterminent les besoins en matière de révision de l'appréciation et du
traitement des risques à la lumière des incidents et des changements de situations. Lors de la phase «Agir»,
toutes les actions nécessaires, y compris une itération supplémentaire du processus de gestion des risques
en sécurité de l'information, sont réalisées.
Le tableau suivant résume les activités de gestion des risques en sécurité de l'information associées aux
quatre phases du processus SMSI.
10 © ISO/CEI 2011 – Tous droits réservés

ISO/CEI 27005:2011(F)
Tableau 1 — Alignement du SMSI et du processus de gestion des risques en sécurité de l'information
Processus SMSI Processus de gestion des risques en sécurité de l'information
Établissement du contexte
Appréciation des risques
Planifier
Élaboration du plan de traitement des risques
Acceptation des risques
Déployer Mise en œuvre du plan de traitement des risques
Contrôler Surveillance et revue continues des risques
Maintien et amélioration du processus de gestion des risques en
Agir
sécurité de l'information
7 Établissement du contexte
7.1 Considérations générales
Éléments d'entrée: Toutes les informations relatives à l'organisation permettant l'établissement du contexte de
la gestion des risques en sécurité de l'information.
Action: Il convient d'établir le contexte externe et interne de la gestion des risques en sécurité de l'information,
ce qui implique de déterminer les critères de base nécessaires à la gestion des risques en sécurité de
l'information (7.2), de définir le domaine d'application et les limites (7.3), et d'établir une organisation adaptée
au fonctionnement de la gestion des risques en sécurité de l'information (7.4).
Préconisations de mise en œuvre:
Il est essentiel de déterminer l'objectif de la gestion des risques en sécurité de l'information puisqu'il influence
l'ensemble du processus et, en particulier, l'établissement du contexte. L'objectif peut être:
 une réponse aux exigences d'un SMSI;
 la conformité avec la loi et la preuve de la mise en œuvre du devoir de précaution;
 la préparation d'un plan de continuité d'activité;
 la préparation d'un plan de réponse aux incidents;
 la description des exigences en matière de sécurité de l'information pour un produit, un service ou un
mécanisme.
Les préconisations de mise en œuvre des éléments d'établissement du contexte nécessaires pour répondre
aux exigences d'un SMSI sont traitées en 7.2, 7.3 et 7.4.
NOTE L'ISO/CEI 270001:2005 n'utilise pas le terme «contexte». Cependant, l'Article 7 aborde les exigences «définir
le domaine d'application et les limites du SMSI» [4.2.1 a)], «définir une politique du SMSI» [4.2.1 b)] et «définir l'approche
d'appréciation des risques» [4.2.1 c)], spécifiées dans l'ISO/CEI 27001:2005.
Éléments de sortie: La spécification des critères de base, le domaine d'application et les limites, et
l'organisation dédiée au fonctionnement du processus de gestion des risques en sécurité de l'information.
© ISO/CEI 2011 – Tous droits réservés 11

ISO/CEI 27005:2011(F)
7.2 Critères de base
7.2.1 Approche de gestion des risques
Selon le domaine d'application et les objectifs de la gestion des risques, différentes approches peuvent
s'appliquer. L'approche peut également être différente pour chaque itération.
Il convient de choisir ou d'élaborer une approche de gestion des risques adaptée qui comprenne des critères
de base tels que les critères d'évaluation du risque, les critères d'impact et les critères d'acceptation des
risques.
En outre, il convient que l'organisation évalue si les ressources nécessaires sont disponibles pour:
 effectuer une appréciation des risques et établir un plan de traitement des risques;
 définir et mettre en œuvre des politiques et des procédures, y compris la mise en œuvre des mesures de
sécurité choisies;
 surveiller les mesures de sécurité;
 surveiller le processus de gestion des risques en sécurité de l'information.
NOTE Voir également l'ISO/CEI 27001:2005 (5.2.1) relatif à la mise à disposition de ressources pour la mise en
œuvre et le fonctionnement d'un SMSI.
7.2.2 Critères d'évaluation du risque
Il convient d'élaborer des critères d'évaluation du risque afin d'évaluer le risque de l'organisation en sécurité
de l'information en prenant en compte les éléments suivants:
 la valeur stratégique des processus informationnels métier;
 la criticité des actifs informationnels concernés;
 les exigences légales et réglementaires ainsi que les obligations contractuelles;
 l'importance opérationnelle et métier de la disponibilité, de la confidentialité et de l'intégrité;
 les attentes et les perceptions des parties prenantes ainsi que les conséquences négatives sur la
valorisation financière et la réputation de l'organisation.
En outre, les critères d'évaluation du risque peuvent être utilisés pour spécifier les priorités du traitement des
risques.
7.2.3 Critères d'impact
Il convient que les critères d'impact soient élaborés et spécifiés en fonction du niveau de dommages ou de
coûts pour l'organisation pouvant être causés par un événement lié à la sécurité de l'information, en tenant
compte des points suivants:
 le niveau de classification de l'actif informationnel impacté;
 l'atteinte à la sécurité de l'information (par exemple, une perte de confidentialité, d'intégrité et de
disponibilité);
 les erreurs opérationnelles (équipes internes ou tierces parties);
 des pertes de marchés et de valeur financière;
12 © ISO/CEI 2011 – Tous droits réservés

ISO/CEI 27005:2011(F)
 la perturbation des plans d'actions et des délais;
 les atteintes à la réputation;
 le non respect des exigences légales, réglementaires ou contractuelles.
NOTE Voir aussi l'ISO/CEI 27001:2005 [4.2.1 d) 4] concernant l'identification des critères d'impact relatifs aux pertes
de confidentialité, d'intégrité et de disponibilité.
7.2.4 Critères d'acceptation des risques
Il convient que les critères d'acceptation des risques soient élaborés et spécifiés. Ces critères dépendent
souvent des politiques de l'organisation, des intentions, des objectifs et des intérêts des parties prenantes.
Il convient que l'organisation définisse ses propres échelles pour les seuils d'acceptation des risques. Il y a
lieu de prendre en compte les éléments suivants au moment de l'élaboration:
 les critères d'acceptation des risques peuvent inclure des seuils multiples correspondant à un niveau de
risques cibles souhaité, tout en réservant aux cadres décisionnaires la possibilité d'accepter des risques
situés au-dessus de ce niveau dans certains cas;
 les critères d'acceptation des risques peuvent être exprimés comme un rapport entre le profit estimé (ou
tout autre bénéfice métier) et le risque estimé;
 différents critères d'acceptation des risques peuvent s'appliquer à différents types de risques, par
exemple des risques susceptibles d'aboutir à une non-conformité, à des réglementations ou à des lois
peuvent ne pas être acceptés, tandis que l'acceptation de risques élevés peut être autorisée si cela est
spécifié comme une exigence contractuelle;
 les critères d'acceptation des risques peuvent comprendre des exigences relatives à de futurs traitements
additionnels. Ainsi, il est possible d'accepter un risque s'il y a un engagement et une validation que des
mesures destinées à le ramener à un niveau acceptable, dans un délai défini, vont être mises en œuvre.
Les critères d'acceptation des risques peuvent varier selon la durée d'existence prévue du risque; il est, par
exemple, possible que le risque soit associé à une activité temporaire ou de courte durée. Il convient de
déterminer les critères d'acceptation des risques en tenant compte des points suivants:
 critères commerciaux;
 aspects légaux et réglementaires;
...

S L O V E N S K I SIST ISO/IEC 27005

STANDARD
september 2011
Informacijska tehnologija – Varnostne tehnike – Obvladovanje
informacijskih varnostnih tveganj

Information technology – Security techniques – Information security risk
management
Technologies de l'information – Techniques de sécurité – Management du
risque de la sécurité de l'information

Referenčna oznaka
ICS 35.040 SIST ISO/IEC 27005:2011 (sl)

Nadaljevanje na straneh 2 do 73

© 2015-06: Slovenski inštitut za standardizacijo. Razmnoževanje ali kopiranje celote ali delov tega standarda ni dovoljeno.

SIST ISO/IEC 27005 : 2011
NACIONALNI UVOD
Standard SIST ISO/IEC 27005 (sl), Informacijska tehnologija – Varnostne tehnike – Obvladovanje
informacijskih varnostnih tveganj, 2011, ima status slovenskega standarda in je istoveten
mednarodnemu standardu ISO/IEC 27005 (en), Information technology – Security techniques –
Information security risk, 2011-06.

NACIONALNI PREDGOVOR
Mednarodni standard ISO/IEC 27005:2011 je pripravil pododbor združenega tehničnega odbora
Mednarodne organizacije za standardizacijo in Mednarodne elektrotehniške komisije ISO/IEC JTC
1/SC 27 Varnostne tehnike v informacijski tehnologiji.

Slovenski standard SIST ISO/IEC 27005:2011 je prevod mednarodnega standarda ISO/IEC
27005:2011. Slovenski standard SIST ISO/IEC 27005:2011 je pripravil tehnični odbor SIST/TC ITC
Informacijska tehnologija. V primeru spora glede besedila slovenskega prevoda je odločilen izvirni
mednarodni standard v angleškem jeziku.

Odločitev za izdajo tega standarda je dne 2. junija 2011 sprejel SIST/TC ITC Informacijska
tehnologija.
ZVEZA Z NACIONALNIMI STANDARDI

S privzemom tega evropskega standarda veljajo za omejeni namen referenčnih standardov vsi
standardi, navedeni v izvirniku, razen tistih, ki so že sprejeti v nacionalno standardizacijo:

SIST ISO/IEC 27000:2011 Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Pregled in izrazoslovje

SIST ISO/IEC 27001:2005 Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Zahteve (zamenjan s SIST ISO/IEC 27001:2013)

OSNOVA ZA IZDAJO STANDARDA
– privzem standarda ISO/IEC 27005:2011

OPOMBI
– Nacionalni uvod in nacionalni predgovor nista sestavni del standarda.

– Povsod, kjer se v besedilu standarda uporablja izraz “mednarodni standard”, v SIST ISO/IEC
27005:2011 to pomeni “slovenski standard”.

SIST ISO/IEC 27005 : 2011
Vsebina Stran
Predgovor . 5
Uvod . 6
1 Področje uporabe . 7
2 Zveza s standardi . 7
3 Izrazi in definicije . 7
4 Struktura tega mednarodnega standarda . 11
5 Ozadje . 12
6 Pregled procesa obvladovanja informacijskih varnostnih tveganj . 13
7 Vzpostavljanje konteksta . 16
7.1 Splošni opis . 16
7.2 Osnovni kriteriji . 16
7.2.1 Pristop k obvladovanju tveganja . 16
7.2.2 Kriteriji za vrednotenje tveganja . 16
7.2.3 Kriteriji vpliva . 17
7.2.4 Kriteriji za sprejetje tveganja . 17
7.3 Obseg in meje . 18
7.4 Organiziranost za obvladovanje informacijskih varnostnih tveganj . 18
8 Ocenjevanje informacijskih varnostnih tveganj . 19
8.1 Splošni opis ocenjevanja informacijskih varnostnih tveganj . 19
8.2 Prepoznavanje tveganja . 20
8.2.1 Uvod v prepoznavanje tveganja . 20
8.2.2 Prepoznavanje dobrin . 20
8.2.3 Prepoznavanje groženj . 20
8.2.4 Prepoznavanje obstoječih kontrol . 21
8.2.5 Prepoznavanje ranljivosti . 22
8.2.6 Prepoznavanje posledic . 22
8.3 Analiza tveganja . 23
8.3.1 Metodologije analize tveganja . 23
8.3.2 Ocenjevanje posledic . 24
8.3.3 Ocenjevanje verjetnosti incidenta . 25
8.3.4 Raven določanja tveganja . 25
8.4 Vrednotenje tveganja. 26
9 Obravnavanje informacijskega varnostnega tveganja . 27
9.1 Splošni opis obravnavanja tveganja . 27
9.2 Spreminjanje tveganja . 29
9.3 Zadrževanje tveganja . 30
9.4 Izogibanje tveganju . 30
9.5 Porazdelitev tveganja . 30
10 Sprejetje informacijskega varnostnega tveganja . 31
SIST ISO/IEC 27005 : 2011
11 Obveščanje o informacijskem varnostnem tveganju in posvetovanje . 31
12 Spremljanje in pregled informacijskega varnostnega tveganja . 32
12.1 Spremljanje in pregled dejavnikov tveganja . 32
12.2 Spremljanje, pregled in izboljševanje obvladovanja tveganja . 33
Dodatek A (informativni): Opredelitev obsega in meja procesa obvladovanja informacijskih
varnostnih tveganj . 35
A.1 Študija organizacije . 35
A.2 Seznam omejitev, ki vplivajo na organizacijo. 36
A.3 Seznam zakonodajnih in regulativnih referenc, ki se uporabljajo za organizacijo . 37
A.4 Seznam omejitev, ki vplivajo na obseg . 38
Dodatek B (informativni): Prepoznavanje in vrednotenje dobrin ter ocenjevanje vplivov . 40
B.1 Primeri prepoznavanja dobrin . 40
B.1.1 Prepoznavanje osnovnih dobrin . 40
B.1.2 Seznam in opis podpornih dobrin . 41
B.2 Vrednotenje dobrin . 45
B.3 Ocenjevanje vpliva . 48
Dodatek C (informativni): Primeri tipičnih groženj . 50
Dodatek D (informativni): Ranljivosti in metode za ocenjevanje ranljivosti . 53
D.1 Primeri ranljivosti . 53
D.2 Metode za presojo tehnične ranljivosti . 56
Dodatek E (informativni): Pristopi ocenjevanja informacijskega varnostnega tveganja . 58
E.1 Ocenjevanje informacijskega varnostnega tveganja na visoki ravni . 58
E.2 Podrobnejše ocenjevanje informacijskega varnostnega tveganja . 59
E.2.1 1. primer: Matrika z vnaprej določenimi vrednostmi . 60
E.2.2 2. primer: Razvrstitev groženj z meritvami tveganja . 62
E.2.3 3. primer: Ocenjevanje vrednosti verjetnosti in možnih posledic tveganja . 62
Dodatek F (informativni): Omejitve pri spreminjanju tveganja . 64
Dodatek G (informativni): Razlike v definicijah med ISO/IEC 27005:2008 in ISO/IEC 27005:2011 . 66
Literatura. 73
SIST ISO/IEC 27005 : 2011
Predgovor
ISO (Mednarodna organizacija za standardizacijo) in IEC (Mednarodna elektrotehniška komisija)
tvorita specializiran sistem za svetovno standardizacijo. Nacionalni organi, ki so člani ISO ali IEC,
sodelujejo pri pripravi mednarodnih standardov prek tehničnih odborov, ki jih za obravnavanje
določenih strokovnih področij ustanovi ustrezna organizacija. Tehnični odbori ISO in IEC sodelujejo na
področjih skupnega interesa. Pri delu sodelujejo tudi druge mednarodne, vladne in nevladne
organizacije, povezane z ISO in IEC. Na področju informacijske tehnologije sta ISO in IEC vzpostavila
združeni tehnični odbor ISO/IEC JTC 1.
Mednarodni standardi so pripravljeni v skladu s pravili iz 2. dela Direktiv ISO/IEC.
Glavna naloga združenega tehničnega odbora je priprava mednarodnih standardov. Osnutki
mednarodnih standardov, ki jih sprejme združeni tehnični odbor, se pošljejo nacionalnim organom v
glasovanje. Za objavo kot mednarodni standard je treba pridobiti soglasje najmanj 75 % glasov
glasujočih nacionalnih organov.
Opozoriti je treba na možnost, da je lahko nekaj elementov tega dokumenta predmet patentnih pravic.
ISO in IEC ne prevzemata odgovornosti za prepoznavanje katerih koli ali vseh takih patentnih pravic.
ISO/IEC 27005 je pripravil združeni tehnični odbor JTC ISO/IEC 1 Informacijska tehnologija, pododbor
SC 27 Varnostne tehnike IT.
Ta druga izdaja razveljavlja in nadomešča prvo izdajo (ISO/IEC 27005:2008), ki je bila tehnično
revidirana.
SIST ISO/IEC 27005 : 2011
Uvod
Ta mednarodni standard zagotavlja smernice za obvladovanje informacijskih varnostnih tveganj v
organizaciji, pri čemer še zlasti podpira zahteve za upravljanje informacijske varnosti (SUIV) glede na
ISO/IEC 27001. Vendar pa ta mednarodni standard ne daje nobene posebne metode za obvladovanje
informacijskih varnostnih tveganj. Organizacija sama mora opredeliti svoj pristop k obvladovanju
tveganj, odvisno, na primer, od obsega SUIV, konteksta obvladovanja tveganja ali industrijske panoge.
V okviru, ki je opisan v tem mednarodnem standardu za izvedbo zahtev SUIV, je mogoče uporabiti
številne obstoječe metodologije.

Ta mednarodni standard je pomemben za vodje in zaposlene, ki delujejo na področju obvladovanja
informacijskih varnostnih tveganj v organizaciji, in kadar je to primerno, tudi za zunanje stranke, ki
podpirajo takšne dejavnosti.
SIST ISO/IEC 27005 : 2011
Informacijska tehnologija – Varnostne tehnike – Obvladovanje informacijskih
varnostnih tveganj
1 Področje uporabe
Ta mednarodni standard zagotavlja smernice za obvladovanje informacijskih varnostnih tveganj.

Ta mednarodni standard podpira splošne koncepte, določene v ISO/IEC 27001, in je namenjen kot
pomoč pri zadovoljivem izvajanju informacijske varnosti, ki temelji na pristopu obvladovanja tveganj.

Poznavanje konceptov, modelov, procesov in terminologij, opisanih v ISO/IEC 27001 in ISO/IEC 27002,
je pomembno za popolno razumevanje tega mednarodnega standarda.

Ta mednarodni standard se uporablja za vse vrste organizacij (npr. trgovska podjetja, vladne agencije,
nepridobitne organizacije), ki nameravajo obvladovati tveganja, ki bi lahko ogrozila informacijsko
varnost organizacije.
2 Zveza s standardi
Za uporabo tega standarda so nujno potrebni naslednji navedeni dokumenti. Pri datiranih sklicevanjih se
uporablja zgolj navedena izdaja. Pri nedatiranih sklicevanjih se uporablja zadnja izdaja navedenega
dokumenta (vključno z dopolnili).

ISO/IEC 27000 Informacijska tehnologija – Varnostne tehnike – Sistemi za upravljanje
informacijske varnosti – Pregled in izrazoslovje

ISO/IEC 27001:2005 Informacijska tehnologija – Varnostne tehnike – Sistemi za upravljanje
informacijske varnosti – Zahteve

3 Izrazi in definicije
V tem dokumentu so uporabljeni izrazi in definicije, podani v ISO/IEC 27000, ter naslednji:

OPOMBA: Razlike v definicijah, podanih v ISO/IEC 27005:2008 in v tem mednarodnem standardu, so prikazane v dodatku G.

3.1
posledica
izid dogodka (3.3), ki vpliva na cilje

[ISO Vodilo 73:2009]
OPOMBA 1: Dogodek lahko povzroči vrsto posledic.
OPOMBA 2: Posledica je lahko določena ali nedoločena in v kontekstu informacijske varnosti je po navadi negativna.
OPOMBA 3: Posledice se lahko izražajo kakovostno ali količinsko.
OPOMBA 4: Začetne posledice se lahko stopnjujejo z učinkom verižne reakcije.

3.2
kontrola
ukrep, ki spreminja tveganje (3.9)

[ISO Vodilo 73:2009]
OPOMBA 1: Kontrole za informacijsko varnost vključujejo vsak proces, politiko, postopek, smernico, prakso ali organizacijsko
strukturo, ki so lahko upravne, tehnične, upravljavske ali pravne narave, ki spreminja informacijsko varnostno tveganje.
OPOMBA 2: Kontrole ne uveljavljajo vedno predvidenega ali nameravanega učinka spremembe.
SIST ISO/IEC 27005 : 2011
OPOMBA 3: Kontrola se uporablja tudi kot sopomenka za zaščito ali protiukrep.

3.3
dogodek
pojav ali sprememba posameznega niza okoliščin

[ISO Vodilo 73:2009]
OPOMBA 1: Dogodek je lahko en ali več pojavov in ima lahko več vzrokov.
OPOMBA 2: Dogodek je lahko sestavljen tudi iz nečesa, kar se ne dogaja.
OPOMBA 3: Dogodek je lahko včasih poimenovan "incident" ali "nesreča".

3.4
zunanji kontekst
zunanje okolje, v katerem organizacija poskuša doseči svoje cilje

[ISO Vodilo 73:2009]
OPOMBA: Zunanji kontekst lahko vključuje:
– kulturno, socialno, politično, zakonodajno, regulativno, finančno, tehnološko, ekonomsko, naravno in
konkurenčno okolje, bodisi mednarodno, nacionalno, regionalno ali lokalno,
– ključne dejavnike in trende, ki vplivajo na cilje organizacije, in
– odnose z zunanjimi deležniki ter njihova dojemanja in vrednote.

3.5
notranji kontekst
notranje okolje, v katerem organizacija poskuša doseči svoje cilje

[ISO Vodilo 73:2009]
OPOMBA: Notranji kontekst lahko vključuje:
– upravljanje, organizacijsko strukturo, vloge in odgovornosti,
– politike in cilje ter strategije, vzpostavljene za njihovo doseganje,
– zmogljivosti, razumljene v pomenu virov in znanja (npr. kapital, čas, ljudje, procesi, sistemi in tehnologije),
– informacijske sisteme, informacijske tokove in procese odločanja (tako formalne kot neformalne),
– odnose z notranjimi deležniki ter njihova dojemanja in vrednote,
– kulturo organizacije,
– standarde, smernice in modele, ki jih je sprejela organizacija, ter
– obliko in obseg pogodbenih razmerij.

3.6
raven tveganja
velikost tveganja (3.9), izražena v kombinaciji posledic (3.1) in njihove verjetnosti (3.7)

[ISO Vodilo 73:2009]
3.7
verjetnost
možnost, da se nekaj dogaja
[ISO Vodilo 73:2009]
OPOMBA 1: V terminologiji obvladovanja tveganja se beseda "verjetnost" uporablja za sklicevanje na možnost, da se nekaj
dogaja, bodisi določeno, merjeno ali opredeljeno objektivno ali subjektivno, kakovostno ali količinsko, in opisano
z uporabo splošnih izrazov ali matematično (kot je verjetnost ali pogostost v določenem časovnem obdobju).
OPOMBA 2: Angleški izraz "likelihood" v nekaterih jezikih nima neposrednega enakovrednega izraza, ampak se pogosto
uporablja ekvivalent izraza "probability". Vendar pa se v angleškem jeziku "probability" pogosto razlaga restriktivno
SIST ISO/IEC 27005 : 2011
kot matematični izraz. Zato se v terminologiji obvladovanja tveganja "likelihood" uporablja z namenom, da naj bi to
imelo enako široko razlago, kot jo ima izraz "probability" v številnih drugih jezikih razen v angleščini.
3.8
preostalo tveganje
tveganje (3.9), ki ostane po obravnavanju tveganja (3.17)

[ISO Vodilo 73:2009]
OPOMBA 1: Preostalo tveganje lahko vsebuje neprepoznano tveganje.
OPOMBA 2: Preostalo tveganje je lahko znano tudi kot "zadržano tveganje".

3.9
tveganje
učinek negotovosti na cilje
[ISO Vodilo 73:2009]
OPOMBA 1: Učinek je odstopanje od pričakovanega – pozitivno in/ali negativno.
OPOMBA 2: Cilji imajo lahko različne vidike (kot so finančni, v zvezi z zdravjem in varnostjo pri delu, informacijsko varnostjo
in okoljskimi cilji) in se lahko uporabljajo na različnih ravneh (kot so strateška raven, raven celotne organizacije
ter raven projektov, izdelkov in procesov).
OPOMBA 3: Tveganje je pogosto označeno glede na morebitne dogodke (3.3) in posledice (3.1) ali kombinacijo le-teh.
OPOMBA 4: Informacijsko varnostno tveganje je pogosto izraženo v pomenu kombinacije posledic informacijskega
varnostnega dogodka in povezane verjetnosti (3.7) pojava.
OPOMBA 5: Negotovost je stanje, tudi delno, pomanjkanja informacij, ki se nanašajo na razumevanje ali vedenje o dogodku,
njegovih posledicah ali verjetnosti.
OPOMBA 6: Informacijsko varnostno tveganje je povezano z možnostjo, da bodo grožnje izkoristile ranljivosti informacijskih
dobrin ali skupine informacijskih dobrin in s tem povzročile škodo organizaciji.

3.10
analiza tveganja
proces razumevanja narave tveganja in določitve ravni tveganja (3.6)

[ISO Vodilo 73:2009]
OPOMBA 1: Analiza tveganja je podlaga za vrednotenje tveganja in odločitve o obravnavanju tveganja.
OPOMBA 2: Analiza tveganja vključuje oceno tveganja.

3.11
ocenjevanje tveganja
celoten proces prepoznavanja tveganja (3.15), analize tveganja (3.10) in vrednotenja tveganja
(3.14)
[ISO Vodilo 73:2009]
3.12
obveščanje o tveganju in posvetovanje
stalni in ponovljivi procesi, ki jih organizacija vodi, da zagotavlja, deli ali pridobiva informacije in da
vodi dialog z deležniki (3.18) v zvezi z obvladovanjem tveganja (3.9)

[ISO Vodilo 73:2009]
OPOMBA 1: Informacije se lahko nanašajo na obstoj, naravo, obliko, verjetnost, pomen, vrednotenje, sprejemljivost in
obravnavanje tveganja.
OPOMBA 2: Posvetovanje je dvosmerni proces obveščanja med organizacijo in njenimi deležniki o določenem vprašanju
pred odločitvijo ali določitvijo usmeritve o tem vprašanju. Posvetovanje je:
SIST ISO/IEC 27005 : 2011
– proces, ki vpliva na odločitev s pomočjo vplivanja in ne z uporabo moči, ter
– vhod za sprejemanje odločitev in ne skupno odločanje.

3.13
kriterij tveganja
področje delovanja, na podlagi katerega se vrednoti pomen tveganja (3.9)

[ISO Vodilo 73:2009]
OPOMBA 1: Kriteriji tveganja temeljijo na organizacijskih ciljih ter na zunanjem in notranjem kontekstu.
OPOMBA 2: Kriterije tveganja je mogoče izpeljati iz standardov, zakonov, politik in drugih zahtev.

3.14
vrednotenje tveganja
proces primerjanja rezultatov analize tveganja (3.10) s kriteriji tveganja (3.13), da se ugotovi, ali sta
tveganje in/ali njegova velikost sprejemljiva ali znosna

[ISO Vodilo 73:2009]
OPOMBA: Vrednotenje tveganja pomaga pri odločitvi o obravnavanju tveganja.

3.15
prepoznavanje tveganja
proces iskanja, spoznavanja in opisovanja tveganj

[ISO Vodilo 73:2009]
OPOMBA 1: Prepoznavanje tveganja vključuje prepoznavanje virov tveganja, dogodkov tveganja, njihovih vzrokov in možnih
posledic.
OPOMBA 2: Prepoznavanje tveganja lahko vključuje zgodovinske podatke, teoretične analize, mnenja poznavalcev in
strokovnjakov ter potrebe deležnikov.

3.16
obvladovanje tveganja
usklajene aktivnosti za usmerjanje in nadzorovanje organizacije v zvezi s tveganjem

[ISO Vodilo 73:2009]
OPOMBA: Ta mednarodni standard uporablja izraz "proces" za opis obvladovanja tveganja v celoti. Elementi v procesu
obvladovanja tveganja se imenujejo "aktivnosti".

3.17
obravnavanje tveganja
proces za spremembo tveganja
[ISO Vodilo 73:2009]
OPOMBA 1: Obravnavanje tveganja lahko vključuje:
– preprečevanje tveganja z odločitvijo, da se ne začne ali ne nadaljuje z aktivnostjo, ki povzroča tveganje,
– privzemanje ali povečanje tveganja, da bi se lahko zasledovale priložnosti,
– odstranitev vira tveganja,
– spreminjanje verjetnosti,
– spreminjanje posledic,
– delitev tveganja z drugo stranko ali strankami (vključno s pogodbami in financiranjem tveganj) in
– ohranjanje tveganja na podlagi utemeljene izbire.
OPOMBA 2: Obravnavanja tveganja, ki se ukvarjajo z negativnimi posledicami, se včasih označujejo kot "ublažitev tveganja",
"odpravljanje tveganja", "preprečevanje tveganja" in "zmanjšanje tveganja".
SIST ISO/IEC 27005 : 2011
OPOMBA 3: Obravnavanje tveganja lahko ustvari nova tveganja ali spreminja obstoječa tveganja.

3.18
deležnik
oseba ali organizacija, ki lahko prizadene, je lahko prizadeta ali meni, da je prizadeta, z določeno
odločitvijo ali dejavnostjo
[ISO Vodilo 73:2009]
OPOMBA: Oseba, ki sprejema odločitve, je lahko deležnik.

4 Struktura tega mednarodnega standarda

Ta mednarodni standard vsebuje opis procesov obvladovanja informacijskih varnostnih tveganj in
njihovih aktivnosti.
Informacije o ozadju so podane v točki 5.

Splošni pregled postopkov obvladovanja informacijskih varnostnih tveganj je podan v točki 6.

Vse aktivnosti obvladovanja informacijskih varnostnih tveganj, predstavljene v točki 6, so opisane v
naslednjih točkah:
vzpostavljanje konteksta v točki 7,
–
ocenjevanje tveganj v točki 8,
–
obravnavanje tveganj v točki 9,
–
sprejetje tveganj v točki 10,
–
obveščanje o tveganjih v točki 11,
–
spremljanje in pregled tveganj v točki 12.
–
Dodatne informacije o aktivnostih obvladovanja informacijskih varnostnih tveganj so predstavljene v
dodatkih. Vzpostavljanje konteksta je podprto z dodatkom A (Opredelitev obsega in mej procesov
obvladovanja informacijskih varnostnih tveganj). Prepoznavanje in vrednotenje dobrin ter ocenjevanje
vplivov so obravnavana v dodatku B. Dodatek C navaja primere tipičnih groženj, v dodatku D pa so
obravnavane ranljivosti in metode za ocenjevanje ranljivosti. Primeri pristopov k ocenjevanju
informacijskih varnostnih tveganj so predstavljeni v dodatku E.

Omejitve za spremembo tveganj so predstavljene v dodatku F.

Razlike v definicijah med ISO/IEC 27005:2008 in ISO/IEC 27005:2011 so prikazane v dodatku G.

Vse aktivnosti obvladovanja tveganj, kot so prikazane v točkah od 7 do 12, so strukturirane na naslednji
način:
Vhodni podatki: Prepoznana je vsaka zahtevana informacija za izvajanje dejavnosti.

Ukrep: Opisana je aktivnost.
Napotki za izvajanje: Dani so napotki za izvajanje ukrepa. Nekateri od teh napotkov morda niso
ustrezni v vseh primerih in so lahko primernejši tudi drugi načini izvajanja ukrepa.

Izhodni podatki: Prepoznana je vsaka informacija, pridobljena po izvedeni aktivnosti.

SIST ISO/IEC 27005 : 2011
5 Ozadje
Da se prepoznajo organizacijske potrebe glede zahtev informacijske varnosti in da se ustvari učinkovit
sistem upravljanja informacijske varnosti (SUIV), je potreben sistematičen pristop k obvladovanju
informacijskih varnostnih tveganj. Ta pristop naj bo primeren za okolje organizacije in zlasti naj bo
usklajen s celotnim obvladovanjem tveganj podjetja. Prizadevanja za varnost naj obravnavajo
tveganja učinkovito in pravočasno, kjerkoli in kadarkoli je potrebno. Obvladovanje informacijskih
varnostnih tveganj naj bo sestavni del vseh aktivnosti upravljanja informacijske varnosti in naj se
uporablja tako za uvajanje kot za tekoče delovanje SUIV.

Obvladovanje informacijskih varnostnih tveganj naj bo nenehen proces. Proces naj vzpostavi zunanji
in notranji kontekst, ocenjuje naj tveganja in naj jih obravnava z uporabo načrta za obravnavanje
tveganja za izvedbo priporočil in odločitev. Analize obvladovanja tveganj s stališča, kaj se lahko zgodi
in katere so lahko možne posledice, so potrebne pred odločitvijo, kaj naj se stori in kdaj, da se
zmanjšajo tveganja na sprejemljivo raven.

Obvladovanje informacijskih varnostnih tveganj naj prispeva k naslednjemu:
Tveganja so prepoznana.
–
Tveganja so ocenjena glede na njihove posledice na poslovanje in verjetnost njihovega pojava.
–
Verjetnost in posledice teh tveganj so posredovane in razumljene.
–
Prednostni vrstni red obravnavanja tveganj je vzpostavljen.
–
Prednostni vrstni red ukrepov za zmanjšanje tveganj je izdelan.
–
Deležniki sodelujejo pri odločanju o obvladovanju tveganj in so sproti obveščeni o stanju
–
obvladovanja tveganj.
Spremlja se uspešnost obravnavanja tveganj.
–
Tveganja in proces obvladovanja tveganj se redno spremljajo in pregledujejo.
–
Informacije se zajemajo za izboljšanje pristopa k obvladovanju tveganj.
–
Vodstvo in osebje se izobražujeta o tveganjih in sprejetih ukrepih za njihovo ublažitev.
–
Proces obvladovanja informacijskih varnostnih tveganj se lahko uporablja za organizacijo kot celoto, za
kateri koli ločeni del organizacije (npr. oddelek, fizično lokacijo, storitev), za kateri koli informacijski
sistem ali za obstoječe, načrtovane ali posebne vidike kontrol (npr. načrtovanje neprekinjenega
poslovanja).
SIST ISO/IEC 27005 : 2011
6 Pregled procesa obvladovanja informacijskih varnostnih tveganj

Pogled z vrha na proces obvladovanja tveganj je specificiran v ISO 31000 in je prikazan na sliki 1.

VZPOSTAVITEV KONTEKSTA
OCENJEVANJE
TVEGANJA
IDENTIFIKACIJA TVEGANJA
ANALIZA TVEGANJA
OVREDNOTENJE TVEGANJA
OBRAVNAVANJE TVEGANJA
Slika 1: Proces obvladovanja tveganj

Slika 2 prikazuje, kako se ta mednarodni standard uporablja pri procesu obvladovanja tveganj.

Proces obvladovanja informacijskih varnostnih tveganj je sestavljen iz vzpostavljanja konteksta (točka 7),
ocenjevanja tveganja (točka 8), obravnavanja tveganja (točka 9), sprejetja tveganja (točka 10),
obveščanja o tveganju in posvetovanja (točka 11) ter spremljanja in pregleda tveganja (točka 12).
OBVEŠČANJE IN POSVETOVANJE
SPREMLJANJE IN PREGLED
SIST ISO/IEC 27005 : 2011
VZPOSTAVITEV KONTEKSTA
OCENJEVANJE
TVEGANJA
IDENTIFIKACIJA TVEGANJA
ANALIZA TVEGANJA
OVREDNOTENJE TVEGANJA
TOČKA ODLOČITVE Ne
O TVEGANJU 1
Zadovoljiva ocena
Da
OBRAVNAVANJE TVEGANJA
TOČKA ODLOČITVE
Ne
O TVEGANJU 2
Zadovoljiva obravnava
Da
SPREJETJE TVEGANJA
KONEC PRVE IZVEDBE ALI NADALJNJIH PONOVITEV

Slika 2: Prikaz procesa obvladovanja informacijskih varnostnih tveganj

Kot prikazuje slika 2, se proces obvladovanja informacijskih varnostnih tveganj lahko ponavlja pri
ocenjevanju tveganj in/ali pri aktivnostih obravnavanja tveganj. Ponavljajoči pristop k izvedbi
ocenjevanja tveganj lahko poveča globino in podrobnosti ocenjevanja pri vsaki ponovitvi. Zagotavlja
dobro ravnotežje med skrajšanjem časa in vloženimi napori pri prepoznavanju kontrol, medtem ko še
vedno zagotavlja, da so velika tveganja ustrezno ocenjena.

Najprej se vzpostavi kontekst. Nato se izvede ocenjevanje tveganj. Če to zagotavlja dovolj informacij
za uspešno določanje ukrepov, potrebnih za spremembo tveganj na sprejemljivo raven, potem je
naloga končana in temu sledi obravnavanje tveganj. Če informacije ne zadostujejo, bo izpeljana druga
ponovitev ocenjevanja tveganj z revidiranim kontekstom (npr. kriteriji za vrednotenje tveganja, kriteriji
za sprejetje tveganja ali kriteriji vpliva), po možnosti na omejenih delih celotnega obsega (glej sliko 2,
točka odločitve o tveganju 1).

Uspešnost obravnavanja tveganj je odvisna od rezultatov ocenjevanja tveganj.

OBVEŠČANJE O TVEGANJU IN POSVETOVANJE
SPREMLJANJE TVEGANJA IN PREGLED

SIST ISO/IEC 27005 : 2011
Upoštevati je treba, da obravnavanje tveganj vključuje cikličen proces:
ocenjevanja obravnavanja tveganj,
–
odločanja, ali so ravni preostalega tveganja sprejemljive,
–
ustvarjanja nove obravnave tveganj, če ravni tveganj niso sprejemljive, in
–
ocenjevanja uspešnosti te obravnave.
–
Mogoče je, da obravnavanje tveganj ne bo peljalo takoj do sprejemljive ravni preostalega tveganja. V
tem primeru, če je potrebno, je lahko zahtevana druga ponovitev ocenjevanja tveganj s spremenjenimi
parametri konteksta (npr. kriteriji za ocenjevanje tveganja, kriteriji za sprejetje tveganja ali kriteriji
vpliva), kateri sledi nadaljnja obravnava tveganj (glej sliko 2, točka odločitve o tveganju 2).

Aktivnost sprejetja tveganj mora zagotoviti, da vodje organizacije izrecno sprejmejo preostala tveganja.
To je še posebej pomembno, kadar je izvajanje kontrol opuščeno oziroma preloženo, na primer zaradi
stroškov.
Med celotnim procesom obvladovanja informacijskih varnostnih tveganj je pomembno, da se tveganja
in njihova obravnavanja posredujejo – sporočajo ustreznim vodjem in zaposlenemu osebju na
operativni ravni. Že pred obravnavanjem tveganj so informacije o prepoznanih tveganjih lahko zelo
dragocene za upravljanje incidentov in lahko prispevajo k zmanjšanju potencialne škode. Zavedanje
vodij in zaposlenega osebja o tveganjih, naravi kontrol za zmanjševanje tveganj in o področjih v zvezi
z organizacijo pomaga h kar najuspešnejšemu reševanju incidentov in nepričakovanih dogodkov.
Podrobni rezultati vsake aktivnosti procesa obvladovanja informacijskih varnostnih tveganj in obeh
točk odločitve o tveganjih naj se dokumentirajo.

ISO/IEC 27001 določa, da morajo kontrole, ki se izvajajo v okviru področja, meja in konteksta SUIV,
temeljiti na tveganju. Uporaba procesa obvladovanja informacijskih varnostnih tveganj lahko zadovolji
to zahtevo. Pristopov, s katerimi je v posamezni organizaciji mogoče uspešno izvajati proces, je veliko.
Organizacija naj ne glede na pristop uporabi za vsako posamezno uporabo procesa tistega, ki najbolj
ustreza njenim okoliščinam.
V SUIV so vzpostavljanje konteksta, ocenjevanje tveganj, izoblikovanje načrta obravnavanja tveganj in
sprejetje tveganj skupaj del faze "načrtuj". V fazi "izvedi" določenega SUIV so ukrepi in kontrole,
zahtevani za zmanjšanje tveganj na sprejemljivo raven, izvedeni v skladu z načrtom obravnavanja
tveganj. V fazi "preveri" določenega SUIV bodo vodje določili potrebo po revizijah ocenjevanja in
obravnavanja tveganja v luči incidentov in sprememb okoliščin. V fazi "ukrepaj" so izvedeni vsi zahtevani
ukrepi, vključno z izvedbo dodatnih ponovitev procesa obvladovanja informacijskih varnostnih tveganj.

Naslednja preglednica povzema aktivnosti obvladovanja informacijskih varnostnih tveganj,
pomembnih za štiri faze procesa SUIV:

Preglednica 1: Uskladitev SUIV in procesa obvladovanja informacijskih varnostnih tveganj

Procesi SUIV Proces obvladovanja informacijskih varnostnih tveganj
Načrtuj Vzpostavljanje konteksta
Ocenjevanje tveganj
Razvoj načrta obravnavanja tveganj
Sprejetje tveganj
Izvedi Izvedba načrta obravnavanja tveganj
Preveri Nenehno spremljanje in pregledovanje tveganj
Ukrepaj Vzdrževanje in izboljševanje procesa obvladovanja informacijskih
varnostnih tveganj
SIST ISO/IEC 27005 : 2011
7 Vzpostavljanje konteksta
7.1 Splošni opis
Vhodni podatki: Vse informacije o organizaciji, pomembne za vzpostavitev konteksta obvladovanja
informacijskih varnostnih tveganj.

Ukrep: Vzpostavita naj se zunanji in notranji kontekst za obvladovanje informacijskih varnostnih
tveganj, kar vključuje določitev osnovnih kriterijev, potrebnih za obvladovanje informacijskih varnostnih
tveganj (7.2), opredelitev obsega in meja (7.3) ter vzpostavitev ustrezne organiziranosti za izvajanje
obvladovanja informacijskih varnostnih tveganj (7.4).

Napotki za izvajanje:
Bistveno je, da se določi namen obvladovanja informacijskih varnostnih tveganj, saj to vpliva na
celotni proces in posebej na vzpostavitev konteksta. Ta namen je lahko:
– podpora SUIV,
– skladnost z zakonodajo in dokazi o skrbnem pregledu,
– priprava načrta neprekinjenega poslovanja,
– priprava načrta odziva na incidente,
– opis zahtev informacijske varnosti za izdelke, storitve ali mehanizme.

Napotki za izvajanje elementov vzpostavljanja konteksta, potrebnih za podporo SUIV, so obravnavani
v nadaljevanju v spodnjih točkah 7.2, 7.3 in 7.4.

OPOMBA: ISO/IEC 27001:2005 ne uporablja izraza "kontekst". Vendar pa se vse v točki 7 nanaša na zahteve "določiti
obseg in meje SUIV" [4.2.1.a)], "določiti politiko SUIV" [4.2.1.b)] in "določiti pristop k ocenjevanju tveganja
"[4.2.1.c)], določene v ISO/IEC 27001:2005.

Izhodni podatki: Specifikacija osnovnih kriterijev, obsega in meja ter organiziranosti za proces
obvladovanja informacijskih varnostnih tveganj.

7.2 Osnovni kriteriji
7.2.1 Pristop k obvladovanju tveganja

Glede na obseg in cilje obvladovanja tveganja so lahko uporabljeni različni pristopi. Pristop je lahko
drugačen tudi pri vsakem ponavljanju.

Izbere ali razvije naj se primeren pristop k obvladovanju tveganja, ki obravnava osnovne kriterije, kot
so: kriteriji za vrednotenje tveganja, kriteriji vpliva, kriteriji za sprejetje tveganja.

Poleg tega naj organizacija oceni, ali so na voljo potrebni viri za:
– izvajanje ocenjevanja tveganj in vzpostavitev načrta obravnavanja tveganj,
– opredelitev in izvajanje politik in postopkov, vključno z izvajanjem izbranih kontrol,
– spremljanje kontrol,
– spremljanje procesa obvladovanja informacijskih varnostnih tveganj.

OPOMBA: Glej tudi ISO/IEC 27001:2005 (točka 5.2.1) v zvezi z zagotavljanjem virov za izvajanje in delovanje SUIV.

7.2.2 Kriteriji za vrednotenje tveganja

Za vrednotenje informacijskih varnostnih tveganj organizacije naj se razvijejo kriteriji za vrednotenje
tveganja ob upoštevanju naslednjega:
SIST ISO/IEC 27005 : 2011
– strateške vrednosti poslovnih informacijskih procesov,
– kritičnosti vključenih informacijskih dobrin,
– pravnih in regulativnih zahtev ter pogodbenih obveznosti,
– operativne in poslovne pomembnosti razpoložljivosti, zaupnosti in celovitosti,
– pričakovanj in dojemanj deležnikov ter negativnih posledic za dobro ime in ugled.

Poleg tega se lahko kriteriji za vrednotenje tveganja uporabljajo za določitev prednostnih nalog pri
obravnavanju tveganja.
7.2.3 Kriteriji vpliva
Kriteriji vpliva naj se razvijejo in določijo glede na stopnjo škode ali stroškov organizacije, ki jih
povzroči informacijski varnostni dogodek, ob upoštevanju naslednjega:
– ravni razvrstitve prizadete informacijske dobrine,
– kršitev informacijske varnosti (npr. izguba zaupnosti, celovitosti in razpoložljivosti),
– škodljivih dejavnosti (notranjih ali tretjih strank),
– izgube poslovne in finančne vrednosti,
– kršitev načrtov in rokov,
– oškodovanja ugleda,
– kršitev pravnih regulativnih ali pogodbenih zahtev.

OPOMBA: Glej tudi ISO/IEC 27001:2005 [točka 4.2.1.d)4] v zvezi s prepoznavanjem kriterijev vpliva izgube zaupnosti,
celovitosti in razpoložljivosti.

7.2.4 Kriteriji za sprejetje tveganja

Kriteriji za sprejetje tveganja naj se razvijejo in določijo. Ti kriteriji so pogosto odvisni od politike
organizacije, njenih ciljev ter ciljev in interesov deležnikov.

Organizacija naj opredeli svoje lestvice za ravni sprejemljivosti tveganja. Pri razvoju naj se upošteva
naslednje:
– kriteriji za sprejetje tveganja lahko vključujejo več pragov z želeno ciljno ravnjo tveganja, vendar z
zagotavljanjem, da višji vodstveni delavci v opredeljenih okoliščinah sprejmejo tveganje nad to
ravnjo,
– kriteriji za sprejetje tveganja se lahko izrazijo kot razmerje med ocenjenim dobičkom (ali drugo
poslovno koristjo) in ocenjenim tveganjem,
– za različne razrede tveganja se lahko uporabijo različni kriteriji za sprejetje tveganj, na primer,
tveganj, ki so lahko rezultat neupoštevanja predpisov ali zakonov, ni mogoče sprejeti, medtem ko
se lahko dovoli sprejem velikih tveganj, če je to določeno kot pogodbena obveznost,
– kriteriji za sprejetje tveganja lahko vključujejo zahteve za prihodnje dodatne obravnave, na primer,
tveganje je lahko sprejeto, če je odobrena in sprejeta zaveza, da se bo ukrepalo za njegovo
zmanjšanje na sprejemljivo raven v določenem časovnem obdobju.

Kriteriji za sprejetje tveganja se lahko razlikujejo glede pričakovanje, kako dolgo bo tveganje obstajalo,
na primer, tveganje je lahko povezano z začasno ali kratkoročno aktivnostjo. Kriteriji za sprejetje
tveganja naj se vzpostavijo glede na naslednje:
– poslovne kriterije,
– pravne in regulativne vidike,
– operacije,
SIST ISO/IEC 27005 : 2011
– tehnologije,
– finance,
– družbene in humanitarne dejavnike.

OPOMBA: Kriteriji za sprejetje tveganja, ki ustrezajo "kriterijem za sprejem tveganja in prepoznavanje sprejemljive ravni
tveganja", so določeni v ISO/IEC 27001:2005, točka 4.2.1.c)2).

Več informacij je na voljo v dodatku A.

7.3 Obseg in meje
Organizacija naj opredeli obseg in meje obvladovanja informacijskih varnostnih tveganj.

Obseg procesa obvladovanja informacijskih varnostnih tveganj je treba opredeliti, da se zagotovi, da se
pri ocenjevanju tveganj upoštevajo vse ustrezne dobrine. Poleg tega je treba prepoznati meje [glej tudi
ISO/IEC 27001:2005, točka 4.2.1.a)], ki naslavljajo tista tveganja, ki lahko izhajajo iz teh meja.

Zberejo naj se podatki o organizaciji, da se določita okolje, v katerem deluje, in njegov pomen za
proces obvladovanja informacijskih varnostnih tveganj.

Pri določanju obsega in meja naj organizacija upošteva informacije o naslednjem:
– strateških poslovnih ciljih, strategijah in politikah organizacije,
– poslovnih procesih,
– funkcijah in strukturi organizacije,
– pravnih, regulativnih in pogodbenih zahtevah, ki veljajo za organizacijo,
– politiki informacijske varnosti organizacije,
– celovitem pristopu organizacije k obvladovanju tveganja,
– informacijskih dobrinah,
– lokacijah organizacije in njihovih geografskih značilnostih,
– omejitvah, ki vplivajo na organizacijo,
– pričakovanjih deležnikov,
– družbeno-kulturnem okolju,
– povezavah (tj. izmenjavi informacij z okoljem).

Poleg tega naj organizacija zagotovi utemeljitev za kakršno koli izključitev iz obsega.

Primeri obsega obvladovanja tveganja so lahko IT-aplikacija, IT-infrastruktura, poslovni proces ali
opredeljen del organizacije.
OPOMBA: Obseg in meje obvladovanja informacijskih varnostnih tveganj se nanašajo na obseg in meje SUIV, zahtevane v
ISO/IEC 27001:2005, točka 4.2.1.a).

Dodatne informacije so na voljo v dodatku A.

7.4 Organiziranost za obvladovanje informacijskih varnostnih tveganj
Organiziranost in odgovornosti za proces obvladovanja informacijskih varnostnih tveganj naj se
postavijo in vzdržujejo. V nadaljevanju so podane glavne vloge in odgovornosti te organiziranosti:
– razvoj procesa obvladovanja informacijskih varnostnih tveganj, primernega za organizacijo,
– prepoznavanje in analiza deležnikov,
SIST ISO/IEC 27005 : 2011
– opredelitev vlog in odgovornosti vseh strank, tako znotraj kot zunaj organizacije,
– vzpostavitev zahtevanih odnosov med organizacijo in deležniki ter tudi povezav v organizaciji s
funkcijami obvladovanja velikega tveganja (npr. obvladovanje operativnega tveganja) in povezav
z drugimi projekti ali aktivnostmi,
– opredelitev poti stopnjevanih odločitev,
– specifikacija zapisov, ki se hranijo.

To organiziranost naj potrdijo ustrezni vodje organizacije.

OPOMBA: ISO/IEC 27001:2005 zahteva ugotavljanje in zagotavljanje virov, potrebnih za vzpostavitev, izvedbo, delovanje,
spremljanje, pregledovanje, vzdrževanje in izboljševanje SUIV [5.2.1)]. Organiziranost za obvladovanje tveganja
se lahko šteje za enega od virov, ki jih zahteva ISO/IEC 27001:2005.

8 Ocenjevanje informacijskih varnostnih tveganj

8.1 Splošni opis ocenjevanja informacijskih varnostnih tveganj

OPOMBA: Aktivnost ocenjevanja tveganj se v ISO/IEC 27001:2005 navaja kot proces.

Vhodni podatki: Vzpostavljeni osnovni kriteriji, obseg in meje ter organizacija za proces obvladovanja
informacijskih varnostnih tveganj.

Ukrep: Tveganja naj se prepoznajo, količinsko ali kakovostno opredelijo ter prednostno razvrstijo
glede na kriterije za vrednot
...