ISO 27001 Risk Assessment Example: Link the Scenario, Controls and Evidence

Start with the decision the assessment supports

A useful ISO 27001 risk assessment example explains a credible event, the information affected and the basis for prioritising work. A row labelled “cyberattack” with a red score cannot do that. The reader needs to understand what could happen, why it remains possible and which current safeguards change the exposure. ISO describes ISO/IEC 27001 as an information security management system standard built around managing risk.

This original fictional case follows Marlow Appointments, a cloud appointment service. Its assessment covers customer exports handled by support staff. The decision is whether its current export verification process adequately protects customer data. The assessment date is 8 September 2026; the support lead owns R-32. Findings relate to this workflow, rather than every security risk in the business.

Agree the method before scoring

Marlow uses method RA-M01 revision 2, a one-year assessment horizon and a five-point likelihood and impact scale. Its approved criteria define likelihood 3 as a credible event with a demonstrated route, and impact 4 as substantial customer confidentiality harm requiring executive response. It evaluates impact across confidentiality, integrity and availability, taking the highest relevant consequence rather than averaging away serious harm.

Under Marlow's example rules, scores of 1–6 permit documented owner retention, 8–12 require treatment or reasoned approval, and 15–25 require prompt escalation. These thresholds, multiplication and review periods are organisational choices, not ISO requirements. A binding obligation still applies at a low score. Calibrate the criteria with business owners before assessing individual risks, and preserve the method version so later results remain comparable.

A completed fictional assessment

The table is a completed illustrative extract, not a prescribed register layout. Evidence identifiers refer to invented controlled records. The current assessment takes credit only for safeguards operating on the assessment date.

Test the existing-control claim

An approved instruction establishes the intended process. It does not show that every export followed it. Marlow compares the instruction with case records and interviews the staff who handled the three exceptions. The assessor records the source system, sampling method and evidence location without copying customer information into the general risk register. Access to the original cases stays restricted.

The three weak records show that independent verification was not consistently demonstrated. They do not establish three disclosures, prove that staff skipped checks, or measure the probability of attack. Check whether other evidence explains the exceptions, and distinguish missing proof from confirmed failure. A procedure, training record and completed case each answer a different question; the assessment should show how they were used together.

Explain the rating and uncertainty

The number summarises a judgement; the rationale makes it reviewable. Explain why the event is credible, what limits exposure and which consequence drives the result. Marlow records that staff training provides some protection, while the workflow permits the specific verification bypass. It avoids treating “no reported incidents” as evidence that the bypass cannot be exploited.

NIST's risk assessment guidance provides a useful reference for considering threats, vulnerabilities, likelihood, impact and uncertainty. Its federal guidance is not an additional ISO certification requirement. For this case, Marlow's limited sample prompts wider checking of export types while leaving the current rating visible. Unknowns become investigation actions with owners, rather than quietly receiving the lowest rating.

Keep planned treatment separate

R-32 ends with an evaluation against the acceptance criteria. TP-32 then develops the selected treatment: responsibilities, resources, due dates, necessary controls, approval and checks that the change works. Forecast residual risk belongs with those assumptions. The current score does not fall solely because treatment is planned; buying a tool or scheduling training does not itself justify a reduction.

The risk assessment document overview helps distinguish assessment and treatment records. The wider ISO 27001 management system also connects these decisions to the controls the organisation needs and its Statement of Applicability. Compare the necessary controls with Annex A to check that no necessary control has been overlooked. The Statement of Applicability records those necessary controls, their inclusion justifications and implementation status, and justifications for excluding any Annex A controls. Obtain the risk owners' approval of the treatment plan and their acceptance of the residual information security risks. The EASA source below is an ISO/IEC 27001 crosswalk in an aviation context; its additional aviation requirements are outside this fictional case.

Use the full ISO 27001 template kit to organise the risk register and separate treatment records, adding evidence and rationale fields where your method needs them. The ISO 27001 procedures pack provides Word methods for assessment and treatment; the Excel registers belong to the full toolkit.

Review and approve a usable record

Before approving an assessment, follow the scenario through these checks:

• Name the information, business activity, risk owner and assessment date.
• Separate the threat, exploitable weakness and resulting business consequence.
• Link existing safeguards to dated evidence and state coverage limitations.
• Explain likelihood and impact using the approved criteria and time horizon.
• Record the evaluation, unresolved assumptions and authority for any retention.
• Link proposed actions to treatment planning and define review triggers.

Keep earlier revisions so a reviewer can see what changed and why. A reassessment should identify new evidence, changed assumptions or different exposure. When the export workflow changes, inspect its operation before replacing the previous conclusion. That history makes the register useful for decisions beyond the day it was completed.

For an audit of the supporting evidence, the free audit evidence pack provides a worked trail and an editable evidence log. Use it to connect a sampled case to the source record, the assessment conclusion and any follow-up.