ISO 27005

ISO 27005 is the internationally recognised standard for Information Security Risk Management and is often used to support ISO 27001 management systems. It does not specify or recommend any risk management methods. It involves a steady process that consists of a structured sequence of activities. Where a high degree of sophistication is required in regards to information security projects e.g. UK Smart Metering infrastructure project, an ISO 27005 level of information security risk management is expected. We have extensive experience when conducting risk assessment and management at this level.

Key Themes of Information Security Risk Management

• Establishing a risk management context.
• Assessing relevant information quantitatively or qualitatively.
• Addressing any risks properly.
• Keeping the stakeholders informed throughout the process.
• Delivery of products and services in an organised and consistent fashion.
• Monitoring and reviewing risks, uncertainty treatments, obligations, and criteria responding to significant changes appropriately.
• Trade facilitation while complying with regulations and legislation.

‍

Its main objective is to improve Information Security Risk Management in any company ororganisation. Additionally, it implies a specific methodology for each information security problem. The standard mainly applies to companies, although it is useful for any type of organisation that wants to improve its Information Security Management System (ISMS). Companies and organisations with ISMS problems may focus on the individual factors, such as the actual scope of the ISMS or commercial sector of the industry itself, rather than applying the entire methodology of the standard.

Benefits of ISO 27005

The skills gained from this certification can be used to support the effective implementation of an information security risk management process in an organisation. Additionally, the knowledge acquired can be used to responsibly manage an information security risk management process and ensure compliance with legal and regulatory requirements. The certificate can also provide the ability to manage an information security and risk management team, as well as the ability to support an organisation to align its ISMS objectives with ISRM process objectives.