Guide 02 · Step 2 of 5

Assess the risk

A risk assessment that produces a list nobody acted on is worse than none, because it is evidence against you.

Independent guidance from Synergy. ISO/IEC 27001 and ISO 22301 are published by ISO/IEC, which has no affiliation with Synergy and has not reviewed this material. This material is provided for informational purposes only and does not constitute compliance or legal advice. Always work from the published text of the standard.

ISO/IEC 27001 does not tell you which risks to care about. It tells you to define a method and then use it consistently — that is clause 6.1.2, and consistency is what gets tested.

This is where the project stops being documentation and starts being an argument about what matters.

The method has to be yours, and it has to be written down

Define, in a document short enough that people actually read it: what counts as an information security risk, how you score likelihood and impact, what risk levels you accept, and who is allowed to accept them. A 3×3 or 5×5 matrix is fine. A bespoke scoring model nobody can reproduce is not.

Start from assets, not from the control list

A risk register built by walking Annex A produces 93 entries and no insight. Build it from what you actually hold and what would hurt if it were lost, altered, or unavailable — then identify which threats and vulnerabilities apply.

• Asset — the information or system, and who owns it by name.
• Threat and vulnerability — what would exploit it, and what makes it exploitable.
• Inherent risk — before controls. This is the number that shows your controls are doing something.
• Treatment decision — mitigate, transfer, avoid, or accept, with the owner and date.