Academy learning group 2 · Academy module (not an ISO clause) M03 · Chapter 3 of 8
Assess risk using explicit criteria
About 6 minutes · ISO/IEC 27001:2022 with Amd 1:2024 context
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Describe the scenario before calculating the rating.
Explore the anchors
Name the affected information and business outcome.
Concept matching activity
Match this task or description to its concept:
Estimate exposure using stated criteria.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and distinctions
- Apply the process and collect evidence
- Risk-method selection and an audit work programme
Concepts and distinctions
A risk scenario connects a source of harm, a vulnerable condition, an affected service and a consequence. “Phishing” is a threat label; “a stolen support credential enables unauthorized learner-record export” is closer to a decision-ready scenario. Distinguish inherent assumptions from the effect of existing controls and explain how the organization estimates likelihood and consequence.
Qualitative scales can support prioritization when their definitions are consistent. Multiplying arbitrary ordinal labels does not create a measured financial probability. Quantitative estimates also need defensible inputs, time horizons and uncertainty. Comparing two ratings is useful only when the assumptions and criteria are understood. Business owners help interpret consequences that a technical scanner cannot determine.
Apply the process and collect evidence
Define assessment criteria, ownership and review triggers before populating a register. Record evidence supporting the scenario and the safeguards already operating. Reassess when data sensitivity, exposure, business dependency or control effectiveness changes. A register should lead to treatment and ownership decisions, not simply become a catalogue of technical weaknesses.
Risk-method selection and an audit work programme
ISO/IEC 27005 is risk-management guidance, not a substitute for the ISMS requirements standard or a mandatory scoring formula. Establish consequence and likelihood criteria, acceptable uncertainty and risk-acceptance authority. Qualitative severity categories need consistent definitions; numerical loss estimates need justified assumptions. A legal-services firm may prioritize confidentiality of client files while also assessing availability of court-deadline records. Assess the actual service consequences rather than assuming every asset has the same criticality.
Convert risk priorities into an audit programme covering important processes over time. A particular audit plan then specifies objectives, criteria, scope, schedule, locations, interviewees, team assignments and sampling. Consider past findings, material changes and supplier dependencies when allocating time. Risk-based selection increases attention to significant uncertainty; it does not authorize silently excluding applicable requirements. Confirm auditor competence in the technologies and organizational processes being examined.
| Concept | What to remember |
|---|---|
| Asset and consequence | Name the affected information and business outcome |
| Likelihood | Estimate exposure using stated criteria |
| Uncertainty | Record assumptions and evidence limits |
Worked example
A scanner gives two systems the same technical severity. One holds public study notes; the other processes restricted learner records and is reachable from an untrusted network. Validate both findings and compare business consequence, reachability, identity permissions and operating controls. Equal scanner severity does not establish equal business risk. Record uncertainty and ask the appropriate owners to make treatment decisions under the agreed criteria.
Check your understanding
Two findings have the same scanner severity. What should determine the business-risk comparison?
Show explanation
Exposure consequences existing controls and the agreed assessment criteria. Technical severity is one input to a contextual business-risk assessment.
Source and study boundary
Official standard overview. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.