ISO 27001 risk criteria: how you score risks and decide what's acceptable
Risk criteria are the rules you score risks by. They say how you rate likelihood and impact, how those combine into a risk level, and the level at which a risk is acceptable without further action. You set them once, before you assess, and use them every time.
This is a short page for now. A fuller guide is coming; until then, the Risk register guide covers the whole assessment.
Why it matters
Clause 6.1.2 of ISO/IEC 27001:2022 asks you to establish and maintain risk criteria, including your risk acceptance criteria and the criteria for performing assessments, so that repeated assessments give consistent, valid and comparable results. Without agreed criteria, two people can score the same risk differently and nobody can say which is right.
What an auditor looks for
- Written criteria for likelihood and impact, with a plain description of each level.
- A stated acceptance threshold, and evidence that it was agreed by the right people.
- Risk scores in the register that actually follow the criteria.
Common mistakes, and how to keep it manageable
- Scoring before agreeing the scales. Set the criteria first, then assess.
- Levels nobody can tell apart. Describe each level in terms your business recognises.
- No acceptance threshold. Without one, you can't show why some risks are treated and others accepted.
How to do it in ClearIMS
- Open Risks > Register and choose Risk matrix definitions to see the scoring criteria you're working to.
- Send them for approval. The owner sends the risk criteria to a named approver.
- If you edit the criteria after sending, the request is withdrawn, so send it again.