What risk assessments are required for ISO 27001, and what should be in them?

Risk assessment sits at the centre of ISO 27001.

ISO/IEC 27001:2022 does not expect an organisation to choose security controls first and then find reasons to justify them. The organisation should understand its information security risks, evaluate those risks, decide which ones need treatment and then determine the controls required to reduce them to an acceptable level.

That makes risk assessment much more than a spreadsheet prepared for an auditor.

A good ISO 27001 risk assessment helps management understand what could go wrong, how likely a security event may be, what the business consequences could be, which controls already reduce the exposure and whether additional action is necessary.

ISO describes ISO/IEC 27001:2022 as the international requirements standard for information security management systems and confirms that the standard helps organisations establish, implement, maintain and continually improve an ISMS. Risk management forms a central part of that approach.

ISO committee guidance states that Clause 6.1.2 requires an organisation to identify information security risks associated with loss of confidentiality, integrity and availability of information within the scope of the ISMS.

UK Cyber Compliance supports this process through an automated and AI-driven ISO 27001 platform that combines guided risk assessment, residual risk tracking, control management and audit-ready information.

UK Cyber Compliance (a part of UK Cyber Security Group) provides these services and has a platform to make certification much easier and cheaper.

The main risk assessment required by ISO 27001

The central requirement is the information security risk assessment.

Your organisation needs a defined process that allows it to identify, analyse and evaluate information security risks consistently.

This process should work across the ISMS scope rather than focusing only on computers.

Information security risk can arise from:

• Employees
• Contractors
• Cloud services
• Applications
• Servers
• Laptops
• Mobile devices
• Physical locations
• Suppliers
• Outsourced services
• Business processes
• Customer information
• Intellectual property
• Administrator accounts
• Network services
• Human error
• Cyber attacks
• Service failures
• Environmental events

The assessment should consider events that could affect confidentiality, integrity or availability.

Confidentiality concerns unauthorised access or disclosure.

Integrity concerns unauthorised or accidental alteration.

Availability concerns access to information and services when authorised users need them.

A single risk may affect more than one of these areas.

For example, stolen Microsoft 365 administrator credentials could allow an attacker to read confidential information, change settings and disrupt services.

That creates confidentiality, integrity and availability concerns within one risk scenario.

What is iso 27001

ISO 27001 is the commonly used name for ISO/IEC 27001:2022, the international requirements standard for an Information Security Management System.

ISO explains that the standard enables organisations to establish a structured approach to protecting information and managing risks relating to the information they own or handle.

The ISMS brings together management responsibility, risk, policies, objectives, security controls, monitoring, internal audit and continual improvement.

ISO 27001 does not simply ask whether a business has antivirus software, a firewall or multi-factor authentication.

It asks why controls are necessary.

That question leads directly back to risk.

A business should understand its exposure first.

It can then determine the security measures that best address that exposure.

Define the ISMS scope before assessing risk

A risk assessment cannot be reliable if nobody knows what sits within the ISMS.

The scope establishes the boundary.

Before assessing risk, identify the people, information, services, systems, suppliers and locations that support the activities covered by your ISMS.

For example, an online service might depend on:

• Customer information
• Microsoft 365
• Cloud hosting
• Developers
• Support staff
• Identity services
• Source code
• Backup services
• Monitoring
• Internet connectivity
• Third-party applications
• Administrators

Assessing only the customer-facing application while ignoring these dependencies would create an incomplete view.

The scope therefore gives the risk assessment its starting point.

Create a documented risk assessment method

ISO 27001 expects risk assessment to follow a repeatable process.

Before assessing individual risks, define how the organisation will perform the assessment.

Your methodology should explain:

• How risks are identified
• How risk owners are assigned
• How likelihood is assessed
• How impact is assessed
• How the overall risk rating is determined
• How risk acceptance criteria work
• Which risks need treatment
• Who can approve acceptance
• How residual risk is calculated
• How often risks receive review
• Which events trigger reassessment
• How evidence remains controlled

The method does not need unnecessary mathematical complexity.

A straightforward scoring system can work perfectly well when everyone understands it and applies it consistently.

ISO 27001 requires the assessment process to produce consistent, valid and comparable results. UK Cyber Compliance also highlights this requirement within its current ISO 27001 risk assessment guidance.

Define likelihood before scoring risks

Likelihood helps the organisation estimate how realistic a security event is.

Avoid simply using labels such as Low, Medium and High without explaining them.

Define what the ratings mean.

You might consider factors such as:

• Previous incidents
• Threat activity
• Exposure to the internet
• Number of users
• Complexity
• Existing safeguards
• Supplier dependence
• Privileged access
• Known vulnerabilities
• Ease of exploitation
• Employee behaviour

The purpose is not to predict the future perfectly.

The aim is to make informed, repeatable decisions.

If two managers assess similar scenarios, your method should help them reach reasonably comparable results.

Define impact in business terms

Impact should reflect what could happen to the organisation if the risk occurred.

Do not limit impact to technical damage.

Information security incidents can affect:

• Customers
• Revenue
• Service delivery
• Contracts
• Regulatory obligations
• Reputation
• Employees
• Suppliers
• Business operations
• Confidential information
• Intellectual property
• Legal commitments

A useful impact scale explains what increasing severity looks like.

For example, a low impact event might cause a minor internal inconvenience.

A higher impact event might interrupt a critical service, expose sensitive customer information or cause a serious contractual failure.

The wording should reflect your organisation.

Risk criteria make scoring consistent

ISO 27001 requires organisations to establish information security risk criteria.

These criteria give structure to decisions.

Assessment criteria explain how you calculate or judge a risk.

Acceptance criteria explain whether management considers the resulting exposure tolerable.

The organisation should approve these criteria before using them widely.

Without common rules, one manager may classify a risk as severe while another manager treats an equivalent problem as minor.

That inconsistency makes risk management difficult to defend during an audit.

Create clear risk acceptance criteria

Risk acceptance criteria answer a simple question:

When can the organisation live with the remaining risk?

UK Cyber Compliance describes acceptance criteria as a consistent way to decide which information security risks can remain and which require further action.

Your criteria should consider:

• Risk rating
• Legal obligations
• Contractual requirements
• Customer commitments
• Senior management authority
• Business criticality
• Duration of acceptance
• Existing controls
• Residual exposure

The organisation should also define who has authority to approve acceptance.

A low residual risk may receive approval from the relevant risk owner.

A serious residual risk might require executive approval.

Some risks should not receive acceptance where legislation or contracts require action.

Write risks as understandable scenarios

Poorly written risk statements make the whole process harder.

Avoid vague entries such as:

“Cyber attack”

“Data breach”

“Cloud risk”

“Human error”

These labels do not explain enough.

A stronger entry might say:

“An employee could disclose Microsoft 365 credentials through a phishing attack, allowing an unauthorised person to access confidential customer email.”

Another could say:

“A failure of the primary cloud hosting provider could make the customer service unavailable for an extended period.”

These statements explain the event and possible outcome.

That makes likelihood, impact, controls and treatment easier to discuss.

What should an ISO 27001 risk assessment contain?

A practical risk record can include:

• Unique risk reference
• Risk description
• Relevant information or asset
• Threat or security event
• Weakness or condition
• Potential consequence
• Confidentiality impact
• Integrity impact
• Availability impact
• Existing controls
• Likelihood
• Impact
• Overall risk rating
• Risk owner
• Treatment decision
• Required action
• Relevant controls
• Action owner
• Target date
• Residual likelihood
• Residual impact
• Residual risk
• Acceptance decision
• Approver
• Review date
• Current status
• Supporting evidence

You do not have to use these exact fields.

The record simply needs enough information for management and an auditor to understand how the organisation reached its decision.

Identify the information or business service at risk

Risk assessment becomes easier when each scenario connects with something meaningful.

That might be:

• Customer information
• Employee information
• Financial records
• Email
• Cloud hosting
• Customer portals
• Backup data
• Source code
• Intellectual property
• Business applications
• Authentication systems

This relationship helps management understand why the risk matters.

It can also help connect your risk register with asset records and business processes.

Identify the event that could cause harm

Next, describe what could actually happen.

Examples include:

• Account compromise
• Phishing
• Accidental disclosure
• Malware
• Ransomware
• Supplier failure
• Cloud outage
• Hardware failure
• Privilege misuse
• Lost equipment
• Unauthorised access
• Incorrect configuration
• Data deletion
• Physical theft
• Insider misuse

The event should make sense within the ISMS scope.

Do not fill the register with generic events that have little connection with your business.

Record existing controls before deciding the risk level

Your organisation may already have security measures reducing the exposure.

These can include:

• Multi-factor authentication
• Endpoint security
• Access control
• Backups
• Staff awareness
• Security monitoring
• Encryption
• Supplier contracts
• Firewalls
• Vulnerability management
• Business continuity measures
• Physical access controls

Record the controls that genuinely operate.

Do not list controls simply because a policy says they should exist.

Where possible, evidence should demonstrate that the control works.

That could include an access review, backup test, vulnerability report, configuration evidence or monitoring record.

Decide whether you assess inherent and residual risk

Many organisations distinguish between inherent and residual risk.

Inherent risk represents exposure before considering relevant controls.

Residual risk represents what remains after controls operate.

This approach can help management understand the value of existing controls.

However, your method must remain consistent.

If you use both, explain clearly how you calculate each one.

The auditor should be able to follow the reasoning.

Risk treatment follows assessment

Risk assessment tells the organisation how serious an exposure is.

Risk treatment decides what to do next.

ISO/IEC 27001 Clause 6.1.3 covers information security risk treatment.

During this process, the organisation determines the controls necessary to implement the chosen treatment and compares those controls against Annex A to make sure it has not overlooked anything necessary. ISO committee guidance confirms this relationship between assessment results and Annex A.

Possible responses can include:

• Reducing the risk
• Avoiding the activity
• Sharing part of the exposure
• Accepting the residual risk when authorised

The decision should reflect the approved criteria.

Link risk treatment to the Statement of Applicability

The Statement of Applicability, commonly called the SoA, records the organisation’s control decisions.

ISO/IEC 27001:2022 Annex A contains 93 controls organised across four themes. UKAS confirms that the current set contains 93 controls, including 11 that were new when the 2022 edition replaced the earlier arrangement.

The SoA should show:

• Which controls the organisation has determined are necessary
• Why they are necessary
• Whether they have been implemented
• Why any relevant Annex A controls have been excluded

UK Cyber Compliance describes the SoA as the connection between information security risks, treatment decisions and control implementation.

The risk register and SoA should therefore tell the same story.

Residual risk assessment happens after treatment

Once new controls operate, reassess the risk.

This is residual risk.

Suppose an organisation initially identifies a high risk of account compromise.

It then implements multi-factor authentication, stronger access control, security awareness and monitoring.

The likelihood may reduce significantly.

The remaining exposure can then receive another rating.

If the residual risk falls within the approved acceptance criteria, the authorised risk owner may accept it.

If it remains above tolerance, further treatment may be necessary.

This creates a clear chain:

Risk identified.

Risk assessed.

Treatment selected.

Controls implemented.

Residual risk assessed.

Acceptance decision made.

Perform risk assessments at planned intervals

ISO 27001 does not expect a risk register to remain unchanged for years.

Clause 8.2 requires the organisation to perform information security risk assessments at planned intervals and when significant changes occur or are proposed.

UK Cyber Compliance’s current guidance also highlights this requirement.

The organisation decides the appropriate review frequency.

A formal annual review may work for some businesses.

Fast-moving organisations may need more frequent reviews for important systems or services.

The schedule should reflect real business risk rather than exist purely for audit purposes.

Significant change should trigger another assessment

Do not wait for the scheduled review when something important changes.

Triggers can include:

• Launching a new service
• Introducing a major cloud platform
• Changing an important supplier
• Opening another office
• Acquiring another organisation
• Moving infrastructure
• Experiencing a serious security incident
• Discovering an important vulnerability
• Changing customer requirements
• Changing legal obligations
• Introducing remote working
• Major system changes
• Significant audit findings

The organisation should assess how the change affects information security before accepting unnecessary exposure.

Supplier risk assessment may become necessary

ISO 27001’s primary mandatory assessment remains the information security risk assessment.

However, supplier relationships frequently create risks that need structured assessment.

A supplier assessment might consider:

• What information the supplier can access
• Which systems it can access
• Importance of the service
• Security certifications
• Security controls
• Incident notification
• Data protection
• Subcontractors
• Service resilience
• Backup arrangements
• Termination arrangements

Higher-risk suppliers deserve greater scrutiny than suppliers with no meaningful access to information or systems.

The Government’s Cyber Security Breaches Survey 2025 to 2026 found that only 15 per cent of businesses reviewed cyber risks posed by immediate suppliers and only 6 per cent reviewed their wider supply chain.

This makes supplier risk a useful area for many ISO 27001 organisations to strengthen.

Asset-related assessment helps make risks specific

Assets help provide context.

A company may assess risk around:

• Customer databases
• Laptops
• Servers
• Cloud environments
• Microsoft 365
• Source code
• Business applications
• Network equipment
• Paper records
• Critical information

You do not necessarily need a separate risk register for every asset.

Many organisations group related assets around business services or information processes.

The key requirement is to make sure relevant information security risks within the ISMS scope receive proper consideration.

Project and change risk assessments may support the ISMS

New projects can create new exposure.

A project risk review can ask:

What information will the project use?

Who will access it?

Which suppliers are involved?

Will new cloud services appear?

Are new administrator accounts required?

Does the project change the ISMS scope?

Does it create new legal or customer obligations?

Are additional controls necessary?

Embedding information security risk review into project and change management prevents security from becoming something considered only after deployment.

Privacy assessments can support information security risk management

Personal information creates additional obligations.

Where a project or processing activity may create high risks to individuals under UK data protection law, a Data Protection Impact Assessment may also become necessary.

A privacy assessment and an ISO 27001 information security risk assessment serve different purposes.

However, they can inform each other.

For example, both may identify concerns around access, disclosure, retention, suppliers and security controls.

Avoid maintaining disconnected registers that reach contradictory decisions about the same system.

Business continuity risk should connect with availability

Availability forms one of the three fundamental information security properties considered under ISO 27001.

Your risk assessment should therefore consider events that could prevent access to critical information or services.

Examples might include:

• Cloud outages
• Internet failure
• Ransomware
• Hardware failure
• Supplier disruption
• Power loss
• Building loss
• Staff unavailability

Where these scenarios matter, risk treatment may lead to backup, redundancy, alternative working arrangements or tested recovery processes.

Physical information security risk still matters

ISO 27001 is not limited to digital information.

Your assessment may need to consider:

• Office access
• Visitors
• Theft
• Confidential papers
• Equipment
• Server rooms
• Environmental hazards
• Remote working
• Public locations

A business operating entirely through cloud services may have fewer physical infrastructure concerns than an organisation running its own facilities, but physical security still deserves consideration where relevant.

Human risk belongs in the assessment

People can create risk accidentally or deliberately.

Examples include:

• Phishing
• Sending information to the wrong recipient
• Weak access practices
• Privilege misuse
• Lost equipment
• Unauthorised software
• Failure to follow procedures
• Insider activity

Human risk should not automatically lead to blaming employees.

Often the underlying issue involves unclear procedures, poor access controls, inadequate training or insufficient technical safeguards.

The assessment should consider both the event and why it could happen.

Cyber risk remains significant for UK organisations

The UK Government’s Cyber Security Breaches Survey 2025 to 2026 found that 43 per cent of businesses identified a cyber breach or attack during the previous 12 months, equivalent to around 612,000 UK businesses.

The rate increased to 65 per cent among medium businesses and 69 per cent among large businesses.

Phishing affected 38 per cent of businesses.

Despite this exposure, only 30 per cent of businesses reported conducting a cyber security risk assessment during the previous 12 months. Among small businesses, the proportion was 41 per cent.

These figures demonstrate why a structured risk process matters.

Businesses cannot make informed security decisions when they have not identified what they are trying to protect or where their main exposure sits.

Use ISO/IEC 27005 when you need deeper risk guidance

ISO/IEC 27005:2022 provides additional guidance for information security risk management.

ISO states that it supports implementation of an ISMS based on ISO/IEC 27001 and provides a structured approach to identifying, assessing and treating information security risks.

It also addresses the broader risk management cycle, including:

• Assessment
• Treatment
• Communication
• Monitoring
• Review

You do not need ISO/IEC 27005 certification to achieve ISO 27001.

It is guidance that can help organisations strengthen their risk process.

Who needs iso 27001 certification

ISO 27001 can support organisations across technology, professional services, healthcare, education, finance, manufacturing, charities, government supply chains and many other sectors.

ISO states that ISO/IEC 27001 can apply across economic sectors and allows organisations to adapt risk management according to their own needs.

Certification often becomes useful when:

• Customers request independent assurance
• Contracts require stronger security governance
• Tenders include ISO 27001
• Sensitive information forms an important part of operations
• Supply chains require security assurance
• Management wants a structured ISMS
• The business wants independent assessment of its security governance

An organisation can implement ISO 27001 without pursuing certification.

Certification adds independent external assessment.

What is ISO 27001 Certification?

ISO 27001 certification provides independent assurance that an organisation’s ISMS conforms with ISO/IEC 27001 within the defined certification scope.

ISO publishes the standard but does not certify individual organisations.

Independent certification bodies carry out certification assessments.

ISO notes that certification from an accredited conformity assessment body can provide additional confidence because an accreditation body has independently confirmed the certification body’s competence.

Within the UK, UKAS accredits certification bodies for ISO/IEC 27001. Current UKAS arrangements use ISO/IEC 27006-1:2024 for bodies providing ISMS certification.

ISO 27001 Certification Levels

ISO 27001 does not have official bronze, silver, gold or similar certification levels.

An organisation defines its ISMS scope and demonstrates conformity with the standard within that scope.

The external certification journey normally includes:

• Stage 1 assessment
• Stage 2 assessment
• Surveillance activity
• Recertification

Risk management should operate throughout this cycle.

An auditor may review how risks have changed since the previous assessment, whether risk treatment actions have progressed and whether the risk register still reflects the real organisation.

Continual improvement matters more than an artificial certification band.

How the Certification Works

The organisation begins by understanding its business context and defining the ISMS scope.

It identifies interested parties and relevant requirements.

Management then defines its information security risk criteria and risk assessment methodology.

The organisation identifies risk scenarios and assigns risk owners.

Likelihood and impact receive assessment according to the agreed criteria.

Management compares the resulting exposure against its risk acceptance criteria.

Risks requiring treatment receive appropriate actions.

The organisation determines the necessary controls and compares those controls against Annex A.

The Statement of Applicability records those control decisions.

Control owners implement the required measures.

Risk owners then assess the residual exposure.

The organisation gathers evidence, conducts internal audits and completes management review.

An independent certification auditor examines whether the ISMS meets ISO/IEC 27001 and whether the organisation operates its risk processes effectively.

The risk assessment therefore provides a foundation for much of the certification audit.

What will an auditor want to see?

An auditor may ask to see:

• Risk assessment methodology
• Risk criteria
• Risk acceptance criteria
• Current risk register
• Risk ownership
• Treatment decisions
• Risk Treatment Plan
• Evidence of implemented controls
• Residual risk ratings
• Acceptance approvals
• Review records
• Evidence of reassessment following significant change
• Links between risks and the SoA
• Internal audit findings
• Management review evidence

The auditor may select one risk and follow it from beginning to end.

They might ask:

How did you identify this risk?

Why did you assign this likelihood?

How did you determine the impact?

What existing controls reduce it?

Why did you choose this treatment?

Which control addresses it?

How do you know the control works?

What residual risk remains?

Who approved that remaining exposure?

A good risk register makes those questions easy to answer.

Which UK-based firms offer ISO 27001 consultancy services?

UK organisations can obtain support from information security consultancies, compliance specialists, managed service providers and platform-led ISO 27001 services.

When selecting support, look for a provider that helps you understand your risks rather than simply filling a spreadsheet with generic entries.

Useful support can include:

• ISMS scope
• Risk methodology
• Impact criteria
• Likelihood criteria
• Risk acceptance
• Risk identification
• Treatment planning
• Control selection
• Statement of Applicability
• Residual risk
• Audit evidence
• Internal audit readiness
• Management review preparation

UK Cyber Compliance provides ISO 27001 support through an automated and AI-driven platform.

Its current guidance describes guided risk assessment, residual risk tracking, control management, real-time compliance visibility and audit-ready reporting.

The platform also connects risk treatment decisions with controls and the Statement of Applicability.

Technology can make the process faster and easier to manage, but management still owns the decisions.

Avoid copying generic risks into your register

Generic risk libraries can provide useful ideas.

They should not replace thinking.

A business that copies 100 risks from a template may end up with a larger register but a poorer understanding of its real exposure.

Ask:

Could this happen here?

What would actually cause it?

What information would it affect?

What would the business impact be?

Which controls currently operate?

Would management tolerate the remaining exposure?

A smaller register of meaningful risks can provide much greater value than a huge collection nobody understands.

Keep risk ownership with the business

Information security risk does not belong exclusively to IT.

Risk owners should normally have enough authority and business knowledge to make decisions about the exposure.

A service owner may understand the impact of a system outage better than the security team.

HR may own risks around employee information.

Finance may own risks around financial systems.

Senior management may own significant strategic risks.

Information security professionals can support assessment and treatment.

Business owners should remain involved in decisions.

Keep the risk register current

Risk changes.

A secure service today may develop exposure after a major technology change.

A low-risk supplier can become critical if the organisation expands its use of the service.

A control may stop operating effectively.

A new legal obligation can change impact.

A serious incident can reveal that previous assumptions were wrong.

Reviewing the risk register keeps the ISMS aligned with the real business.

The register should be a management tool rather than an archive.

A practical ISO 27001 risk assessment checklist

Before certification, check that:

• Your ISMS scope is clear
• Your methodology is documented
• Likelihood criteria are defined
• Impact criteria are defined
• Risk acceptance criteria are approved
• Risks relate to real business scenarios
• Confidentiality receives consideration
• Integrity receives consideration
• Availability receives consideration
• Risk owners are assigned
• Existing controls are recorded accurately
• Risk ratings follow the approved method
• Unacceptable risks receive treatment
• Controls connect with treatment decisions
• The SoA reflects the control decisions
• Residual risks receive assessment
• Acceptance decisions have appropriate approval
• Review dates exist
• Significant changes trigger reassessment
• Evidence supports important control claims
• Management understands significant risks

If several of these points remain unclear, strengthen the process before the external audit.

Risk assessment should help the business make better decisions

The purpose of ISO 27001 risk assessment goes far beyond certification.

It helps management understand where information security effort matters most.

A strong assessment process gives the organisation a consistent way to identify exposure, compare priorities and decide where action is necessary.

It also creates a clear reason for security controls.

Instead of saying, “We use this control because ISO requires it,” the organisation can say, “We use this control because it reduces this identified business risk.”

That distinction makes the ISMS much stronger.

ISO/IEC 27001:2022 provides the requirements.

ISO/IEC 27005:2022 can provide additional risk management guidance.

UK Cyber Compliance helps bring the process together through an automated and AI-driven platform connecting risk assessment, acceptance criteria, treatment, residual risk, controls, evidence and the Statement of Applicability.

The strongest ISO 27001 risk assessments remain clear, repeatable and connected to the organisation.

They explain what could happen.

They show why it matters.

They record who owns the risk.

They demonstrate what controls reduce it.

They show what exposure remains.

Most importantly, they give management enough information to make a defensible decision about what to do next.

UK Cyber Compliance is here to help

For more information, please do get in touch.

Please check out our Free Cyber Insurance

Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,

If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks.