ISO 27001 risk register: how to assess information security risks
Your risk register is the list of things that could go wrong with the information your ISMS protects, how likely and how bad each one is, and who owns it. It's the engine of ISO 27001: the risks you find decide which controls you need, and the controls you choose are justified by the risks they treat.
If you only have time to do one thing properly, do this. A good risk register makes the Statement of Applicability, the policies and the audit much easier. A weak one makes all of them harder to defend.
Why it matters
The risk register serves clause 6.1.2 of ISO/IEC 27001:2022 (information security risk assessment) and feeds clause 6.1.3 (risk treatment). In summary, the standard asks you to:
- Set risk criteria first: how you'll score likelihood and impact, and the level at which a risk is acceptable without further action.
- Identify risks to the confidentiality, integrity and availability of information in your scope, and give each one an owner.
- Analyse and evaluate each risk against your criteria, so you know which to treat first.
- Get consistent, comparable results when you repeat the assessment, and keep the results as documented information.
Clause 8.2 then expects you to repeat the assessment at planned intervals and whenever something significant changes. The register isn't a one-off exercise.
What an auditor looks for
- Criteria that exist and are used. The scoring scale and acceptance level are written down, approved, and actually applied to the scores in the register.
- Coverage of your scope. The risks reflect your real services, systems, locations and suppliers. A register copied from a template, full of risks that don't apply, is easy to spot.
- Named owners. Each risk has an owner with the authority to decide how it's treated, usually a manager, not "IT".
- A clear trail to treatment. Every risk above your acceptance level has a treatment, and the controls in your Statement of Applicability trace back to the risks.
- Evidence it's kept up to date. Review dates, recent changes, and new risks after incidents or changes to the business.
Common reasons it fails: scores that don't follow the stated criteria; owners who don't know they own anything; no reassessment since the register was first written; or risks so vague ("cyber attack") that no one could say whether the treatment works.
A worked example
This illustrative example is for a fictional company.
| Field | Example |
|---|---|
| Risk | Customer data in the production database is exposed through a stolen admin password |
| Asset | Production database (customer bookings) |
| Owner | Head of Engineering |
| Likelihood | 3 of 5: phishing attempts are frequent; admin accounts are few |
| Impact | 5 of 5: personal data of every customer; contract and UK GDPR consequences |
| Score | 15, above the acceptance level of 10 |
| Treatment | Reduce: enforce multi-factor authentication on admin accounts, restrict admin access to managed devices, alert on new admin sign-ins |
| Residual | Likelihood 1, impact 5, score 5: accepted by the owner |
Notice that the risk names the thing, the cause and the consequence, so you can tell whether the treatment addresses it.
Common mistakes, and how to keep it manageable
- Too many risks. Fifty precise risks you actually manage beat three hundred generic ones. Group similar risks where the treatment is the same.
- Writing risks as controls. "No MFA" is a gap, not a risk. Write what could happen ("account takeover leads to data exposure") and let MFA be the treatment.
- Scoring by gut feel. Keep your criteria short and concrete, with examples for each level, so two people scoring the same risk get the same answer.
- Copying asset details into risk text. Link the risk to the asset record rather than re-describing it, so a change to the asset doesn't leave the register out of date.
- Forgetting to revisit. Set a review date for each risk, and reassess after incidents, new suppliers or new services.
How to do it in ClearIMS
- Start from the draft. The onboarding chat drafts a first set of risks from what you tell it about your business. They're drafts until a named person approves them.
- Open the Risk register and work through the drafts: remove ones that don't apply, add ones that are missing, and make each one specific.
- Give every risk an owner and score it against your risk criteria.
- Plan treatments for risks above your acceptance level. ClearIMS drafts treatments for you to review (see Treatment plans).
- Owners accept their own risks. Accepting a risk and approving its treatment is a separate step from editing it, done by the risk owner. The AI never approves anything.
Related pages
- Treatment plans: what happens to each risk next.
- Statement of Applicability: the controls your treatments rely on.
- Assets: what your risks are about.
- Exceptions: when a risk is knowingly accepted outside the norm.