Sign in

ISO 27005

ISO/IEC 27005 Information Security Risk Management — ISO/IEC JTC 1/SC 27

Also known as: ISO/IEC 27005, ISO 27005:2022, ISO IEC 27005

Official site Official change log Subscribe to ISO 27005 (RSS)

This is a paid standard. We publish the fact of a change, its version and date, and a link to the publisher — the text itself is not reproduced.

Current version
ISO/IEC 27005:2022
Published 25 October 2022. source
Status
In force
Next deadline
None announced
Who must comply
All organizations, regardless of type, size or sector, that manage information security risks, in particular to meet the risk requirements of ISO/IEC 27001. source
How it is assessed
It gives guidance, not requirements; the risk process it describes is examined in ISO/IEC 27001 certification audits. source
Written by
Published jointly by ISO and IEC (committee ISO/IEC JTC 1/SC 27, working group 1) as voluntary guidance. source source source
Enforced by
A voluntary standard; it sets no contractual, legal or statutory requirements. source
Last change
None recorded yet

Guidance for the information security risk management process that ISO 27001 requires but does not describe; auditors reach for it when asking how risk assessment was actually performed.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. ISO/IEC 27005:2022 is published on the same day as ISO/IEC 27001:2022; the 2018 edition is withdrawn

Version history

  1. ISO/IEC 27005:2022 Major versionCurrent

    Fourth edition, retitled "Guidance on managing information security risks" and aimed at fulfilling the ISO/IEC 27001 requirements on actions to address risks. source

  2. ISO/IEC 27005:2018 Major version

    Third edition, "Information security risk management", supporting the general concepts of ISO/IEC 27001; withdrawn on 25 October 2022. source

  3. ISO/IEC 27005:2011 Major version

    Second edition. source

  4. ISO/IEC 27005:2008 Major version

    First edition. source

Who it applies to

Any organization that manages information security risks, especially one running an ISO/IEC 27001 ISMS. It is voluntary guidance.

Purpose
Helps organizations fulfil the ISO/IEC 27001 requirements on actions to address information security risks. source
Activities
Information security risk management activities, specifically risk assessment and risk treatment. source
Who it is for
All organizations, regardless of type, size or sector. source
Legal status
ISO standards are voluntary and contain no contractual, legal or statutory requirements; national laws take precedence. source

How compliance is assessed

It gives guidance, not requirements; the risk process it describes is examined in ISO/IEC 27001 certification audits.

Guidance
The document provides guidance; in ISO documents "should" expresses a recommendation and only "shall" expresses a requirement. source source
In ISO/IEC 27001 audits
ISO/IEC 27001 itself requires the assessment and treatment of information security risks, which certification audits check. source source

Enforcement and penalties

A voluntary standard; it sets no contractual, legal or statutory requirements.

Legal force
ISO standards are voluntary and contain no contractual, legal or statutory requirements. source

Documents

  1. Standard ISO/IEC 27005:2022 (catalogue entry; paid standard)
  2. Standard ISO/IEC 27005:2018 (withdrawn edition, catalogue entry)

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to ISO 27005 (RSS)