Guest user Created: Jan 04, 2022 Last commented: Jan 04, 2022

ISO 27005:2018

I trust that you had a relaxed and safe Festive season. As I prepare for my deep dive into Information Security Audit and Risk Management, I have taken your advice and am reading ALL relevant Standards so as to ensure I can respond with confidence in respect to their importance on my journey. I found the following Statement in the “Introduction section of ISO 27005:2018” This document is based on the asset, threat and vulnerability risk identification method that is no longer required by ISO/IEC 27001. There are some other approaches that can be used Please be so kind as to provide your insight to the relevance to an ISO 27001 Risk and ISMS Implementation. Look forward to your valued response.

0 0

Assign topic to the user

Select user

Expert

Rhand Leal Jan 04, 2022

If I understood correctly, you want insight into the relevance of ISO 27005 to currently ISO 27001 based ISMS’s.

Considering that, although the asset, threat, and vulnerability risk identification method are no longer mandatory for ISO 27001, it still continues to be one of the most used approaches, due to its simplicity, so you should keep the ISO 27005 standard in your read list. For other approaches for risk assessment, you should consider also reading ISO 31010, which covers other Risk assessment techniques.

For further information, see:

ISO 27001/ISO 27005 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
ISO 31010: What to use instead of the asset-based approach for ISO 27001 risk identification https://advisera.com/27001academy/blog/2016/04/04/iso-31010-what-to-use-instead-of-the-asset-based-approach-for-iso-27001-risk-identification/

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Jan 04, 2022

Expert Advice Community

ISO 27005:2018

ISO 27005:2018

Assign topic to the user

Comment as guest or Sign in

Suggested Topics

Risk Assessment Method

ISO 27001 Internal Audits

Understanding the core concepts of RPO & RTO - ISO 22301