ISO 27001 Risk Assessment: How to Run One | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001 risk assessment explained: identify assets and threats, score risk, build a risk register, and turn it into your control decisions.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001 risk assessment, explained step by step: how to find what could go wrong, score it, and turn it into the control decisions the rest of your ISMS depends on.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The risk assessment is the engine of ISO 27001. You identify what could go wrong with the information you hold, score each risk by likelihood and impact, and record it all in a risk register. Those results decide which Annex A controls you implement.<\/p>\n <p>Get it right and everything downstream, the Statement of Applicability, the controls, the audit, follows logically. Skip it or fake it, and the whole ISMS rests on nothing.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#why\">Why it is the engine<\/a><\/li>\n <li><a href=\"#process\">The five-step process<\/a><\/li>\n <li><a href=\"#register\">The risk register<\/a><\/li>\n <li><a href=\"#treat\">From risk to treatment<\/a><\/li>\n <li><a href=\"#mistakes\">Mistakes to avoid<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"why\">ISO 27001 risk assessment: why it is the engine of the whole standard<\/h2>\n <p>Almost every other part of ISO 27001 flows from the risk assessment. It decides which controls you need, justifies your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/statement-of-applicability\/\">Statement of Applicability<\/a>, and gives the auditor the logic behind your entire security programme. A risk assessment is the process of working out what could go wrong with the information you hold, how likely it is, and how much it would hurt.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Why it matters<\/div>Annex A is a menu of 93 controls, but your risk assessment is what tells you which to order. Without it, control selection is guesswork, and auditors can tell the difference immediately.<\/div>\n\n <h2 class=\"sec\" id=\"process\">The five-step process<\/h2>\n <p>A sound risk assessment follows a repeatable sequence. You do not need enterprise software to run it, but you do need to run it honestly.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#f4f6ff);border:1px solid #e3e6f5;border-radius:18px;padding:28px 30px;margin:28px 0;box-shadow:0 8px 30px rgba(28,38,122,.07)\">\n <div style=\"font-size:11.5px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">The risk assessment process<\/div>\n <div style=\"font-size:19px;font-weight:800;color:#0e1330;margin-bottom:22px\">Five steps, from assets to the risk register<\/div>\n <svg viewBox=\"0 0 700 120\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Five step ISO 27001 risk assessment process\">\n <g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <defs><marker id=\"ar\" markerWidth=\"9\" markerHeight=\"9\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L7 4 L0 8 Z\" fill=\"#b9bfe0\"\/><\/marker><\/defs>\n <g font-weight=\"800\" font-size=\"12\">\n <circle cx=\"66\" cy=\"42\" r=\"30\" fill=\"#00c2a8\"\/><text x=\"66\" y=\"48\" fill=\"#fff\" font-size=\"18\">1<\/text><text x=\"66\" y=\"92\" fill=\"#0e1330\">Identify assets<\/text>\n <line x1=\"100\" y1=\"42\" x2=\"136\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#ar)\"\/>\n <circle cx=\"178\" cy=\"42\" r=\"30\" fill=\"#3a46c0\"\/><text x=\"178\" y=\"48\" fill=\"#fff\" font-size=\"18\">2<\/text><text x=\"178\" y=\"92\" fill=\"#0e1330\">Spot threats<\/text>\n <line x1=\"212\" y1=\"42\" x2=\"248\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#ar)\"\/>\n <circle cx=\"290\" cy=\"42\" r=\"30\" fill=\"#9d97ff\"\/><text x=\"290\" y=\"48\" fill=\"#1a1a4a\" font-size=\"18\">3<\/text><text x=\"290\" y=\"92\" fill=\"#0e1330\">Score impact<\/text>\n <line x1=\"324\" y1=\"42\" x2=\"360\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#ar)\"\/>\n <circle cx=\"402\" cy=\"42\" r=\"30\" fill=\"#3a46c0\"\/><text x=\"402\" y=\"48\" fill=\"#fff\" font-size=\"18\">4<\/text><text x=\"402\" y=\"92\" fill=\"#0e1330\">Prioritise<\/text>\n <line x1=\"436\" y1=\"42\" x2=\"472\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#ar)\"\/>\n <circle cx=\"514\" cy=\"42\" r=\"30\" fill=\"#1c267a\"\/><text x=\"514\" y=\"48\" fill=\"#fff\" font-size=\"18\">5<\/text><text x=\"514\" y=\"92\" fill=\"#0e1330\">Risk register<\/text>\n <\/g>\n <\/g>\n <\/svg>\n<\/div>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">1<\/span><h4>Identify assets<\/h4><\/div><ul><li>What information and systems you hold<\/li><li>Customer data, code, infrastructure<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">2<\/span><h4>Identify threats<\/h4><\/div><ul><li>What could compromise each asset<\/li><li>Breach, loss, misuse, outage<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">3<\/span><h4>Score likelihood and impact<\/h4><\/div><ul><li>How probable, how damaging<\/li><li>A simple scale is fine<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">4<\/span><h4>Prioritise<\/h4><\/div><ul><li>Rank by combined risk score<\/li><li>Focus effort where it matters<\/li><\/ul><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"register\">The risk register<\/h2>\n <p>The output of the assessment is a risk register: a living record of each identified risk, its score, its owner, and what you plan to do about it. The register is what you carry into the risk treatment stage and what the auditor will review to see that your process is real and maintained.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Keep it living<\/div>A risk register is not a one-time deliverable. New systems, new data, and new threats change the picture, so the register should be revisited on a schedule and whenever something material changes.<\/div>\n\n <h2 class=\"sec\" id=\"treat\">From risk to treatment<\/h2>\n <p>Identifying risk is only half the job. For each risk you decide how to treat it: reduce it by applying a control, accept it, avoid it by stopping the activity, or transfer it, for example through insurance. Those decisions become your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-treatment-plan\/\">risk treatment plan<\/a>, which in turn drives your Statement of Applicability.<\/p>\n\n <h2 class=\"sec\" id=\"mistakes\">Mistakes to avoid<\/h2>\n <ul class=\"clean warn\">\n <li><strong>Using a generic template unchanged.<\/strong> A risk assessment that does not reflect your actual business convinces no one.<\/li>\n <li><strong>Over-engineering the scoring.<\/strong> A clear, simple scale beats an elaborate model nobody maintains.<\/li>\n <li><strong>Assessing once and forgetting.<\/strong> A stale register fails at the surveillance audit.<\/li>\n <li><strong>Skipping asset identification.<\/strong> You cannot assess risk to assets you have not listed.<\/li>\n <\/ul>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to a real risk assessment<\/h2>\n <p>The assessment itself is analytical work, but treating the risks depends on controls that actually run, and evaluating them depends on visibility into your systems. When your security is scattered across tools, seeing your real risk picture and proving you have treated it is far harder.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Because access, encryption, logging, monitoring, and cloud posture run on one platform, the risks you identify can be treated and evidenced in the same place, and your risk register maps directly to controls that are genuinely operating. That is why lean teams treat Osto as the default foundation for a risk assessment that holds up.<\/div>\n\n <div class=\"callout\">\n <h3>Turn your risk register into controls that run.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Treat the risks you identify with controls that actually operate, evidenced from one platform and mapped to ISO 27001. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is an ISO 27001 risk assessment?<\/summary><p>It is the process of identifying what could go wrong with the information you hold, scoring each risk by likelihood and impact, and recording the results in a risk register. Those results decide which <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a> controls you implement.<\/p><\/details>\n <details><summary>How do I run an ISO 27001 risk assessment?<\/summary><p>Identify your assets, identify the threats to each, score likelihood and impact, prioritise by combined risk, and record everything in a risk register. Then decide how to treat each risk, which drives your Statement of Applicability.<\/p><\/details>\n <details><summary>What is a risk register?<\/summary><p>A living record of each identified risk, its score, its owner, and the planned treatment. It is the main output of the risk assessment and a document auditors review to confirm your process is real and maintained.<\/p><\/details>\n <details><summary>How is risk assessment linked to control selection?<\/summary><p>Directly. Annex A is a menu of 93 controls; the risk assessment tells you which to select. Every control you include should trace back to a risk, and that logic is recorded in the Statement of Applicability.<\/p><\/details>\n <details><summary>How often should I redo the risk assessment?<\/summary><p>Revisit it on a schedule and whenever something material changes, a new system, new data types, or a new threat. A stale assessment and register are common causes of findings at the surveillance audit.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001 Risk Assessment: How to Run One | Osto ISO 27001 risk assessment, explained step by step: how to\u2026<\/p>\n","protected":false},"author":8,"featured_media":761,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[291],"class_list":["post-760","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-iso-27001-risk-assessment"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/760","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=760"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/760\/revisions"}],"predecessor-version":[{"id":762,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/760\/revisions\/762"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/761"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=760"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=760"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=760"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":760,"date":"2026-08-16T18:19:28","date_gmt":"2026-08-16T18:19:28","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=760"},"modified":"2026-08-16T18:19:28","modified_gmt":"2026-08-16T18:19:28","slug":"iso-27001-risk-assessment","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/iso-27001-risk-assessment\/","title":{"rendered":"ISO 27001 Risk Assessment: How to Run One"},"content":{"rendered":"\n\n\n\n\n\nISO 27001 Risk Assessment: How to Run One | Osto<\/title>\n<meta name=\"description\" content=\"ISO 27001 risk assessment explained: identify assets and threats, score risk, build a risk register, and turn it into your control decisions.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">ISO 27001 risk assessment, explained step by step: how to find what could go wrong, score it, and turn it into the control decisions the rest of your ISMS depends on.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The risk assessment is the engine of ISO 27001. You identify what could go wrong with the information you hold, score each risk by likelihood and impact, and record it all in a risk register. Those results decide which Annex A controls you implement.<\/p>\n <p>Get it right and everything downstream, the Statement of Applicability, the controls, the audit, follows logically. Skip it or fake it, and the whole ISMS rests on nothing.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#why\">Why it is the engine<\/a><\/li>\n <li><a href=\"#process\">The five-step process<\/a><\/li>\n <li><a href=\"#register\">The risk register<\/a><\/li>\n <li><a href=\"#treat\">From risk to treatment<\/a><\/li>\n <li><a href=\"#mistakes\">Mistakes to avoid<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"why\">ISO 27001 risk assessment: why it is the engine of the whole standard<\/h2>\n <p>Almost every other part of ISO 27001 flows from the risk assessment. It decides which controls you need, justifies your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/statement-of-applicability\/\">Statement of Applicability<\/a>, and gives the auditor the logic behind your entire security programme. A risk assessment is the process of working out what could go wrong with the information you hold, how likely it is, and how much it would hurt.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Why it matters<\/div>Annex A is a menu of 93 controls, but your risk assessment is what tells you which to order. Without it, control selection is guesswork, and auditors can tell the difference immediately.<\/div>\n\n <h2 class=\"sec\" id=\"process\">The five-step process<\/h2>\n <p>A sound risk assessment follows a repeatable sequence. You do not need enterprise software to run it, but you do need to run it honestly.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#f4f6ff);border:1px solid #e3e6f5;border-radius:18px;padding:28px 30px;margin:28px 0;box-shadow:0 8px 30px rgba(28,38,122,.07)\">\n <div style=\"font-size:11.5px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">The risk assessment process<\/div>\n <div style=\"font-size:19px;font-weight:800;color:#0e1330;margin-bottom:22px\">Five steps, from assets to the risk register<\/div>\n <svg viewBox=\"0 0 700 120\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Five step ISO 27001 risk assessment process\">\n <g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <defs><marker id=\"ar\" markerWidth=\"9\" markerHeight=\"9\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L7 4 L0 8 Z\" fill=\"#b9bfe0\"\/><\/marker><\/defs>\n <g font-weight=\"800\" font-size=\"12\">\n <circle cx=\"66\" cy=\"42\" r=\"30\" fill=\"#00c2a8\"\/><text x=\"66\" y=\"48\" fill=\"#fff\" font-size=\"18\">1<\/text><text x=\"66\" y=\"92\" fill=\"#0e1330\">Identify assets<\/text>\n <line x1=\"100\" y1=\"42\" x2=\"136\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#ar)\"\/>\n <circle cx=\"178\" cy=\"42\" r=\"30\" fill=\"#3a46c0\"\/><text x=\"178\" y=\"48\" fill=\"#fff\" font-size=\"18\">2<\/text><text x=\"178\" y=\"92\" fill=\"#0e1330\">Spot threats<\/text>\n <line x1=\"212\" y1=\"42\" x2=\"248\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#ar)\"\/>\n <circle cx=\"290\" cy=\"42\" r=\"30\" fill=\"#9d97ff\"\/><text x=\"290\" y=\"48\" fill=\"#1a1a4a\" font-size=\"18\">3<\/text><text x=\"290\" y=\"92\" fill=\"#0e1330\">Score impact<\/text>\n <line x1=\"324\" y1=\"42\" x2=\"360\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#ar)\"\/>\n <circle cx=\"402\" cy=\"42\" r=\"30\" fill=\"#3a46c0\"\/><text x=\"402\" y=\"48\" fill=\"#fff\" font-size=\"18\">4<\/text><text x=\"402\" y=\"92\" fill=\"#0e1330\">Prioritise<\/text>\n <line x1=\"436\" y1=\"42\" x2=\"472\" y2=\"42\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#ar)\"\/>\n <circle cx=\"514\" cy=\"42\" r=\"30\" fill=\"#1c267a\"\/><text x=\"514\" y=\"48\" fill=\"#fff\" font-size=\"18\">5<\/text><text x=\"514\" y=\"92\" fill=\"#0e1330\">Risk register<\/text>\n <\/g>\n <\/g>\n <\/svg>\n<\/div>\n\n <div class=\"checkgrid\">\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">1<\/span><h4>Identify assets<\/h4><\/div><ul><li>What information and systems you hold<\/li><li>Customer data, code, infrastructure<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">2<\/span><h4>Identify threats<\/h4><\/div><ul><li>What could compromise each asset<\/li><li>Breach, loss, misuse, outage<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">3<\/span><h4>Score likelihood and impact<\/h4><\/div><ul><li>How probable, how damaging<\/li><li>A simple scale is fine<\/li><\/ul><\/div>\n <div class=\"checkarea\"><div class=\"h\"><span class=\"num\">4<\/span><h4>Prioritise<\/h4><\/div><ul><li>Rank by combined risk score<\/li><li>Focus effort where it matters<\/li><\/ul><\/div>\n <\/div>\n\n <h2 class=\"sec\" id=\"register\">The risk register<\/h2>\n <p>The output of the assessment is a risk register: a living record of each identified risk, its score, its owner, and what you plan to do about it. The register is what you carry into the risk treatment stage and what the auditor will review to see that your process is real and maintained.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Keep it living<\/div>A risk register is not a one-time deliverable. New systems, new data, and new threats change the picture, so the register should be revisited on a schedule and whenever something material changes.<\/div>\n\n <h2 class=\"sec\" id=\"treat\">From risk to treatment<\/h2>\n <p>Identifying risk is only half the job. For each risk you decide how to treat it: reduce it by applying a control, accept it, avoid it by stopping the activity, or transfer it, for example through insurance. Those decisions become your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-treatment-plan\/\">risk treatment plan<\/a>, which in turn drives your Statement of Applicability.<\/p>\n\n <h2 class=\"sec\" id=\"mistakes\">Mistakes to avoid<\/h2>\n <ul class=\"clean warn\">\n <li><strong>Using a generic template unchanged.<\/strong> A risk assessment that does not reflect your actual business convinces no one.<\/li>\n <li><strong>Over-engineering the scoring.<\/strong> A clear, simple scale beats an elaborate model nobody maintains.<\/li>\n <li><strong>Assessing once and forgetting.<\/strong> A stale register fails at the surveillance audit.<\/li>\n <li><strong>Skipping asset identification.<\/strong> You cannot assess risk to assets you have not listed.<\/li>\n <\/ul>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to a real risk assessment<\/h2>\n <p>The assessment itself is analytical work, but treating the risks depends on controls that actually run, and evaluating them depends on visibility into your systems. When your security is scattered across tools, seeing your real risk picture and proving you have treated it is far harder.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Because access, encryption, logging, monitoring, and cloud posture run on one platform, the risks you identify can be treated and evidenced in the same place, and your risk register maps directly to controls that are genuinely operating. That is why lean teams treat Osto as the default foundation for a risk assessment that holds up.<\/div>\n\n <div class=\"callout\">\n <h3>Turn your risk register into controls that run.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Treat the risks you identify with controls that actually operate, evidenced from one platform and mapped to ISO 27001. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is an ISO 27001 risk assessment?<\/summary><p>It is the process of identifying what could go wrong with the information you hold, scoring each risk by likelihood and impact, and recording the results in a risk register. Those results decide which <a href=\"https:\/\/www.osto.one\/resources\/glossary\/annex-a-controls\/\">Annex A<\/a> controls you implement.<\/p><\/details>\n <details><summary>How do I run an ISO 27001 risk assessment?<\/summary><p>Identify your assets, identify the threats to each, score likelihood and impact, prioritise by combined risk, and record everything in a risk register. Then decide how to treat each risk, which drives your Statement of Applicability.<\/p><\/details>\n <details><summary>What is a risk register?<\/summary><p>A living record of each identified risk, its score, its owner, and the planned treatment. It is the main output of the risk assessment and a document auditors review to confirm your process is real and maintained.<\/p><\/details>\n <details><summary>How is risk assessment linked to control selection?<\/summary><p>Directly. Annex A is a menu of 93 controls; the risk assessment tells you which to select. Every control you include should trace back to a risk, and that logic is recorded in the Statement of Applicability.<\/p><\/details>\n <details><summary>How often should I redo the risk assessment?<\/summary><p>Revisit it on a schedule and whenever something material changes, a new system, new data types, or a new threat. A stale assessment and register are common causes of findings at the surveillance audit.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>ISO 27001 Risk Assessment: How to Run One | Osto ISO 27001 risk assessment, explained step by step: how to\u2026<\/p>\n","protected":false},"author":8,"featured_media":761,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[291],"class_list":["post-760","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-iso-27001-risk-assessment"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/760","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=760"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/760\/revisions"}],"predecessor-version":[{"id":762,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/760\/revisions\/762"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/761"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=760"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=760"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=760"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}