A risky business: ISO 31000 and 27005 unwrapped

Abstract

Although risk management should be a core element of any information security strategy, it is neither a well-understood nor widely employed discipline today. But what might help is the arrival of two complementary ISO standards – ISO 31000 for generic corporate risk management and ISO 27005 for information security risk management. Cath Everett explores how organisations can benefit from these standards, by looking at what the core principles of both standards are, how they are likely to prove useful and what organisations need to think about if going down this route. And she concludes that the first thing you need to do is take risk seriously. While risk management should be a core element of any information security strategy – and, indeed, awareness of its importance is starting to mount – it remains neither a well-understood nor widely employed discipline today.