ISO 27001 Risk Assessment: How to Actually Run One

An iso 27001 risk assessment is the part of the ISMS auditors follow with a finger on the page. Clause 6.1.2 asks you to define criteria, find risks to confidentiality, integrity, and availability inside scope, name owners, analyse likelihood and consequence, then prioritise treatment. Clause 6.1.3 turns that into treatment options, a comparison against Annex A, and the Statement of Applicability. Skip the chain and iso 27001 risk assessment work becomes a spreadsheet nobody can defend.

This sits under the ISO 27001 compliance hub. Packets still does not certify you. A named specialist can run the workshop; management still owns the residual risk.

What an iso 27001 risk assessment must produce

Write the method first: risk acceptance criteria, how you score likelihood and impact, and how you keep two runs comparable. Then inventory information assets in scope, including AI pieces that handle customer data: prompt stores, evaluation sets, model artifacts, GPU or LLM vendors. Identify events that would lose confidentiality, integrity, or availability. Assign a risk owner who can actually change the system, not a shared inbox.

Analyse each risk. Evaluate against your criteria. Prioritise. Keep documented information of the process. That is the standard's shape. ISO publishes the ISO/IEC 27001 overview; buy the text if you need clause wording verbatim.

Treatment follows: avoid, reduce, share, or accept. Determine necessary controls. Compare them to Annex A's 93 reference controls so you did not omit a control type you actually need. Produce the Statement of Applicability with inclusion, implementation status, and exclusion justifications. An iso 27001 risk assessment that never reaches the SoA is unfinished.

AI systems: CIA risks vs ISO 42001 impact

Model poisoning, prompt injection, and training-data leakage are still information security risks. Put them in the iso 27001 risk assessment. Bias, fairness, and effects on people are not the same row. Those belong in an ISO 42001 AI system impact assessment. Share the calendar and the owners. Do not pretend one register satisfies both catalogs.

If enterprise buyers ask AI Act-style questions, the AIMS is the management-system answer. The ISMS remains the answer for access, logging, backup, and suppliers. Official 42001 page: ISO/IEC 42001. Product entry: AI governance.

A workshop that does not fake the register

Do this in a room with engineering, not only GRC. For each in-scope system, ask what data it holds, who can reach production, which vendors sit on the path, and what last broke. Score with the written criteria. If every risk is "medium," your criteria are ornamental. If the founder is the only owner, the iso 27001 risk assessment will fail the first access-review sample.

• Scope and asset list that include AI pipelines.
• Criteria and a repeatable scoring method.
• Register with owners, treatment, and residual risk.
• SoA tied back to those treatments.

Agents can draft rows from inventories. They cannot accept risk for the company. Packets runs this as implementation: workshop, register, SoA, then evidence. Compare a tool-only path on Packets vs Scrut if that is the real alternative.

How often to repeat an iso 27001 risk assessment

Repeat when scope changes: new model in production, new subprocessors, new region, material incident. Also on the planned cycle before internal audit and management review. Comparable results matter. A brand-new scoring scheme every quarter looks like you are hiding movement.

US customers may still ask for a SOC report in parallel. That is attestation work, not this clause. Keep the iso 27001 risk assessment honest for the ISMS first.

Frequently asked questions

Can we buy a template and call the iso 27001 risk assessment done?

You can start from a template. Auditors test whether risks match your actual systems. A generic SaaS pack that never mentions your vector database will not survive interview.

Is ISO 27005 mandatory?

No. 27001 requires a process that meets 6.1.2. ISO 27005 is guidance. Use it if it helps; do not cite it as a second certificate.

Who should own residual risk?

Someone with authority over the asset. Not Packets. Not the auditor. We facilitate. You accept.

Where do we start this week?

Freeze scope. List AI and production assets. Run one workshop. Score a free audit score if you want a second view, then contact Packets if you need a specialist in the room.

Related reading: risk management frameworks and ISO 27001 at Packets.