After reading, you can set up a repeatable assessment, from scope to approved results, using recognised methods.
Definition
ISO 31000 splits assessment into three activities: identification, analysis and evaluation. NIST SP 800-30 organises the same work around a cycle: prepare, conduct, communicate and maintain.
Two starting points are common. You can begin with what must be protected, an asset-based approach, or with what could happen, an event-based one. ISO/IEC 27005 describes both for information security.
Why it matters
Budgets and priorities rest on these results, so they cannot depend on who happened to hold the pen that week.
For anyone pursuing certification, clause 6.1.2 of ISO/IEC 27001 is explicit: repeated assessments must produce consistent, valid and comparable results.
How it works
Scope comes first: which activities, sites and systems. Then write down the criteria, meaning the scales and the level at which a risk becomes acceptable. Doing this before the workshop keeps the discussion honest.
Identify risks with the people who do the work, drawing on past incidents, audit results and known threats. Analyse each one with the controls that exist today, then compare the result with your criteria to see what gets treated first.
Record the results along with the reasoning, and get them approved. Repeat at planned intervals and whenever something significant changes.
A worked case
An online shop limits its first assessment to order taking. In a two-hour workshop, sales, logistics and IT list 14 scenarios.
One of them, “payment service down during the sale week”, gets impact 4 out of 5, based on €1,900 of sales an hour, and likelihood 2. The score of 8 sits under the acceptance level of 9, so the managing director accepts it and asks for a fresh look before the next sale.
Good practices
- Write the method down before the first workshop, and keep it short enough to repeat.
- Bring in people from the business. Security staff know the threats; they rarely know what a lost day costs.
- Count a control only if you have seen it work. A backup nobody has restored should not lower a score.
- Compare your scales with real incidents once a year to see whether they were realistic.
- Use the same method for at least two cycles before changing it, so that you can compare the results.
Common mistakes
- Copying a list of risks from elsewhere. It feels complete, yet it says nothing about your business.
- Trying to assess the whole company at once. The work drags on for months, and the results are stale when they arrive.
- Keeping management out of the acceptance decision, which leaves the assessor carrying a risk they have no authority to accept.
Questions
- Should an assessment be qualitative or quantitative?
- Qualitative scales are faster and suit most companies. Estimates in money help when a large investment decision depends on the result.
- How long does a risk assessment take?
- A single process can fit into a few workshops. A whole company usually takes weeks.
- Is there one mandatory method?
- No. ISO/IEC 27001 sets requirements on the results. ISO/IEC 27005, NIST SP 800-30 and EBIOS RM are all recognised ways of getting there.
- What triggers a new assessment?
- Your planned interval, or a significant change such as a new system, a new supplier, a merger or a serious incident.
- What does the assessment produce?
- A prioritised list of evaluated risks, which feeds the risk register and the treatment plan.