Table Of ContentISO/IEC 27001:2013 – Mastering Risk Assessment and
the Statement of Applicability
Dr David Brewer
First edition.
© David Brewer, 2021
Whilst every care has been taken in developing and compiling this publication, Dr David
Brewer accepts no liability for any loss or damage caused, arising directly or indirectly in
connection with reliance on its contents except to the extent that such liability may not
be excluded in law.
While every effort has been made to trace all copyright holders, anyone claiming
copyright should get in touch with Dr Brewer at [email protected].
Dr David Brewer has no responsibility for the persistence or accuracy of URLs for
external or third-party internet websites referred to in this book and does not guarantee
that any content on such websites is, or will remain, accurate or appropriate.
Contents
Foreword .......................................................................................................... v
Acknowledgements .......................................................................................... vi
Chapter 1 – Overview and concepts ................................................................ 7
Introduction .................................................................................................. 7
ISO/IEC 27001 requirements ...................................................................... 8
The Statement of Applicability ................................................................... 11
The event-consequence method ............................................................... 14
Risk squares .............................................................................................. 15
Control properties ...................................................................................... 16
Dealing with ISMS risks ............................................................................. 20
Relevant resources .................................................................................... 20
Chapter 2 – Risk assessment ........................................................................ 22
Introduction ................................................................................................ 22
The ISO/IEC 27001 requirement ............................................................... 22
Risk scenarios – events and consequences ............................................. 24
Scales ........................................................................................................ 27
Determination of consequence .................................................................. 28
Determination of likelihood ........................................................................ 29
Determination of inherent risk .................................................................... 32
Risk criteria ................................................................................................ 32
Risk owner ................................................................................................. 33
Schedules and previous results................................................................. 34
Documenting the process .......................................................................... 34
Documenting the results ............................................................................ 34
Risk assessment instructions .................................................................... 34
Chapter 3 – Risk treatment ............................................................................ 36
Introduction ................................................................................................ 36
The ISO/IEC 27001 requirement ............................................................... 36
Treating risk – tell it like a story ................................................................. 38
Layout of a risk treatment plan .................................................................. 39
Writing the story ......................................................................................... 40
Determination of residual risk .................................................................... 41
Risk acceptance ........................................................................................ 42
Previous results ......................................................................................... 42
Documenting the process .......................................................................... 42
Documenting the results ............................................................................ 42
Risk treatment instructions ........................................................................ 42
Chapter 4 – Statement of Applicability........................................................... 44
Introduction ................................................................................................ 44
The ISO/IEC 27001 requirement ............................................................... 44
ISO/IEC 27001:2013 – Mastering Risk Assessment and the Statement of Applicability iii
Content of the SOA.................................................................................... 45
The reference control superset .................................................................. 47
Performing the cross-checking process .................................................... 48
Necessary control statement form ............................................................. 49
Constructing the SOA ................................................................................ 49
Instructions for producing the SOA ........................................................... 51
Chapter 5 – Maintenance and improvements ................................................ 52
Introduction ................................................................................................ 52
Reviews and reassessments ..................................................................... 52
Extending reference control sets ............................................................... 52
Determining your own scenarios ............................................................... 53
Dealing with future ISO/IEC 27001 transitions .......................................... 53
On-line support .......................................................................................... 54
Appendix A – Documented information examples ......................................... 55
A.1 How to use this appendix .................................................................... 55
A.2 Risk assessment process ................................................................... 55
A.3 Risk treatment process ....................................................................... 57
A.4 Risk assessment results ..................................................................... 60
A.5 Risk treatment results ......................................................................... 63
A.6 The on-line Assistant ........................................................................... 73
Appendix B – An example RTP story ............................................................ 76
B.1 Optimum approach .............................................................................. 76
B.2 Reverse engineering approach ........................................................... 77
Appendix C – Control questions .................................................................... 80
Acronyms ..................................................................................................... 105
Compendium of definitions .......................................................................... 106
Bibliography ................................................................................................. 107
Standards publications ............................................................................ 107
Other publications .................................................................................... 108
ISO/IEC 27001:2013 – Mastering Risk Assessment and the Statement of Applicability iv
Foreword
ISO/IEC 27001:2013 is the requirements specification standard for an information
security management system, or ISMS for short. There are requirements for
performing information security risk assessments, risk treatments, and for producing
a “Statement of Applicability”. Reputedly, some organisations have found difficulty
with these requirements because they state what must be done, not how to do it.
There are standards in the ISO/IEC 27xxx series that offer guidance on how to fulfil
the requirements of ISO/IEC 27001. These are descriptive in nature. They describe
how organisations could perform risk assessments and offer advice on how to
construct a Statement of Applicability (SOA). However, they are lacking in worked
examples.
Having assisted many organisations to achieve ISO/IEC 27001 certification, I have
developed and fine-tuned a methodology for fulfilling these requirements. This
methodology is embodied in the IMS-Smart On-Line technology. Its approach to risk
assessment uses events and consequences as advocated in ISO 31000:2018 (Risk
management – Guidelines) and BS 7799-3:2017 (Guidelines for information security
risk management). IMS-Smart defines twelve events and invites the organisations
that use the technology to devise tell-it-like-a-story risk treatment plans for each
event to determine the necessary information security controls. Organisations are
then invited to link phrases in the story text to the ISO/IEC 27001 reference controls,
which in turn assists them to produce the SOA.
This book recasts the IMS-Smart methodology as a series of questions, the answers
to which will construct the risk assessment, the twelve risk treatment plans and the
produce the SOA. The recasting results in an evolution of the IMS-Smart
methodology. There is also some supporting technology that automatically
transforms the answers to the questions into the documented information required
by ISO/IEC 27001 for the organisations risk assessment/treatment results and its
SOA.
The questions fall into two broad categories: those concerning risk and those
concerning controls. The control questions are derived from a superset of the
ISO/IEC 27001 Annex A controls and those which are likely to appear in the new
edition of ISO/IEC 27002, and thereby offers greater value to organisations for
ensuring that no necessary control has been inadvertently overlooked.
David Brewer
ISO/IEC 27001:2013 – Mastering Risk Assessment and the Statement of Applicability v
Acknowledgements
Figures 1-1, 1-3 and 2-2 have been reproduced by kind permission of IMS-Smart
Limited.
Cover photographs:
front cover — Octar the iguana in La Vanille, Mauritius, March 2017 © David
Brewer; back cover — Climbing up to the Mirador View, La Casella, Mauritius,
January 2018 © David Brewer.
ISO/IEC 27001:2013 – Mastering Risk Assessment and the Statement of Applicability vi
Chapter 1 – Overview and concepts
Introduction
ISO/IEC 27001:2013 is the requirements specification standard for an information
security management system, or ISMS for short. Its goal is to assist organisations to
implement the controls necessary to achieve acceptable information security risks.
Although many organisations are exposed to the same threats, their risks are a
function of an organisation’s business, the environment in which it operates and the
technology that it uses, to name but three such factors. Moreover, the person or
group of people who control and direct an organisation (referred in the standard as
“top management”) can have an appetite for risk that differs from that of the top
management of other organisations. The ISO standard therefore sets about
achieving its goal by requiring organisations:
a) to express its risk appetite in terms of criteria for the acceptance of risk; and
b) perform a risk assessment to determine those risks that require treatment.
Risk treatment is the process by which an organisation determines the controls it
deems necessary to modify unacceptable risks such that they meet its risk
acceptance criteria.
Because there will inevitably be a degree of subjectivity in this process, the standard
requires organisations to compare their necessary controls with those in a reference
set of controls to determine whether they have inadvertently omitted anything of
importance.
The standard further requires organisations to produce a “Statement of Applicability”
(SOA) that includes the necessary controls and justifies why any reference control
has been judged unnecessary.
The SOA is an example of what ISO Management System Standards (MSS) refer to
as “documented information”.
The aim of this Chapter is to fully explain these ISO/IEC 27001 requirements and
their relationship to the other requirements of the standard. The Chapter describes
the event-consequence approach to risk assessment and explains why it has been
selected for this book in preference to other methods.
ISO/IEC 27001:2013 – Mastering Risk Assessment and the Statement of Applicability 7
Chapter 1 – Overview and concepts
ISO/IEC 27001 requirements
Clauses 6.1 and 8
The ISO/IEC 27001 requirements for risk assessment and risk treatment are in
Clauses 6.1.2, 6.1.3, 8.2 and 8.3. Clause 6, in common with all other ISO MSS,
such as ISO 9001 (quality) and ISO 14001 (environmental protection), concern
planning the Management System (MS). Since the process of risk treatment is used
to determine the necessary controls, and the controls form part of the MS, Clauses
6.1.2 and 6.1.3 start with the phrase “The organisation shall define and apply …”.
Clause 8 concerns operations, and here ISO/IEC 27001 specifies the requirements
for repeated risk assessments and for implementing the controls. It is necessary to
repeat the risk assessment at planned intervals (and when significant changes are
proposed or occur) to maintain the effectiveness of the controls, particularly in
response to new threats and changes in business operations.
An output of Clause 6.1.3 is the risk treatment plan. There are two generally
accepted interpretations of this term. One is that it is a project plan for implementing
the controls determined by the process of risk treatment. The other, which is used in
this book, is that it is a plan for how the controls are intended to work together (e.g.,
their temporal, logical and physical relationship to one another) to modify risk. The
former interpretation is transient: once implemented the plan assumes an historical
significance. The latter interpretation has a permanency about it: the plan should
always show how the controls are intended to work together, just like a building
plan.
Relationship to other clauses
Figure 1-1 shows a schematic representation of the ISO/IEC 27001 requirements.
The headings in blue are common to all MSS. Those in red are specific to ISO/IEC
27001 and represent those that specifically concern information security.
Figure 1-1 Schematic representation of the ISO/IEC 27001 requirements
Understanding your organisation and its business, cultural and societal contexts is
key to establishing an effective ISMS. The mantra should be one of moulding the
standard around the organisation, not the other way round. From this, and
knowledge about the needs and expectations of interested parties, and the
information that is within scope of the ISMS, the organisation can begin the process
of identifying its information security risks.
ISO/IEC 27001:2013 – Mastering Risk Assessment and the Statement of Applicability 8
Chapter 1 – Overview and concepts
Although Figure 1-1 shows the requirements in a cyclic arrangement, and the
Establish, Implement, Maintain and Improve labels are reminiscent of the Deming
Cycle (PLAN-DO-CHECK-ACT), the order in which the requirements are presented
in the standard do not imply the order in which they are to be implemented. Thus,
although Clause 8.2 requires organisations to repeat risk assessments when certain
criteria are met, there is no corresponding requirement to repeat the risk treatment
process. This is because such a requirement is unnecessary. The inputs to the risk
treatment process are the outputs of the risk assessment process. Suppose a
reassessment of risk produces results that necessitate a change in risk treatment. If
those changes are not made, the requirements of Clause 6.1.3 are no longer
fulfilled, thereby creating a nonconformity. Moreover, since the requirements of
Clause 10.1 are to correct nonconformities, it too becomes nonconformant until the
necessary modifications are made by repeating the risk treatment process. In turn,
this corrects both nonconformities. This process is the self-healing property of a
management system. Over time it ensures that all documented information
corresponds to reality.
There are other examples of this non-cyclic behaviour:
There will be aspects of the Information security policy (Clause 5.2) that
cannot be known until the information security controls have been
determined (e.g., the organisation’s access control and backup policies)
There are sixteen requirements for the organisation to retain or maintain
documented information scattered throughout the standard, yet the
requirements for the control of documented information are in Clause 7.5.
Why risks and opportunities?
Risk is defined as “the effect of uncertainty on objectives” and comes from another
ISO standard, ISO 31000 (Risk management — Principles and guidelines). There is
a note to the definition which states that an “effect is a deviation from the expected –
positive or negative”. By way of further explanation, it is the effect that can be
positive or negative, not the deviation. Thus, there can be a beneficial side to risk,
and is the reason why ISO MSS refer to “risks and opportunities”. However, risk only
makes a small contribution to the opportunities that an organisation can seize upon
and exploit. Other opportunity sources include reputation, innovation, market
position, market demand, etc. Indeed, organisations create and seize opportunities
to fulfil their objectives and in doing so encounter risks which must be managed.
There is another note to the definition of risk, which states that risk is often
expressed in terms of a combination of the consequences of an event and the
associated likelihood of occurrence.
The objective of RA/RT
The objective of risk assessment and risk treatment is to determine the necessary
controls. It is important not to lose sight of this objective. Organisations should
therefore not become obsessed with striving for accuracy or identifying every
conceivable risk. Once such efforts fail to determine any new necessary controls, it
is time to stop.
ISO/IEC 27001:2013 – Mastering Risk Assessment and the Statement of Applicability 9
