ISO/IEC 27005

Information security risk management - risk identification, analysis, evaluation, treatment.


Short name	ISO 27005
Region	International
Country or scope	International
Sector	General
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ISO 27005

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for ISO 27005.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for ISO 27005 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ISO27005-RISK-ID` Risk and Asset Identification	Risk identification requires determining the assets within scope that could be affected by information security risks; for software systems this means an enumerated inventory of the components in use (ISO/IEC 27005:2022, risk identification guidance, Cl. 7)	Scan
`ISO27005-RISK-AN` Risk Analysis Inputs	Analysing the likelihood and consequences of identified risks requires knowing exactly which versions of software assets are deployed so threats and known vulnerabilities can be matched to them (ISO/IEC 27005:2022, risk analysis guidance)	Scan
`ISO27005-ASSET-ID` Unambiguous Asset Identification	Effective risk assessment depends on assets being unambiguously identifiable so that risks, owners, and treatments can be tied to specific assets rather than vague descriptions (ISO/IEC 27005:2022, asset identification guidance)	Scan
`ISO27005-SUPPLY` Supply Chain Risk Sources	The risk context must account for risk sources arising from external parties and suppliers; assessing supplier-originated risk requires knowing the supplier of each component in the system (ISO/IEC 27005:2022, context establishment and risk source guidance)	Scan
`ISO27005-DOC` Documented Risk Assessment Records	Risk assessment and treatment results must be documented and retained so they can be communicated, reviewed, and audited, which requires formally identified, timestamped machine-readable records of the assessed systems (ISO/IEC 27005:2022, documentation and communication guidance)	Scan
`ISO27005-MON` Monitoring and Review Provenance	Risks and the factors underlying them must be monitored and reviewed over time; comparing successive assessments requires knowing which tool or organization produced each system record and when (ISO/IEC 27005:2022, monitoring and review guidance)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`27005-CL6`	Context Establishment
`27005-CL7-ID`	Risk Identification
`27005-CL7-AN`	Risk Analysis
`27005-CL7-EV`	Risk Evaluation and Prioritisation
`27005-CL8`	Risk Treatment
`27005-CL9`	Risk Acceptance
`27005-CL10`	Risk Communication and Consultation
`27005-CL11`	Monitoring and Review

Policy templates

Written for ISO 27005:

Information Security Risk Management Policy
Risk Treatment and Acceptance Procedure
Risk Communication and Monitoring Procedure

And 22 from the standard set, adapted to ISO 27005.