ISO 27005:2022 sharpens risk treatment decisions for security teams

At a glance

What this is: ISO 27005:2022 updates the information security risk management process by clarifying the five-step workflow, adding semi-quantitative analysis, and tightening the link between risk treatment and ISO 27001 controls.

Why it matters: For IAM, NHI, and broader security teams, the standard matters because it turns risk treatment into a governed decision process that can be tied to controls, ownership, and residual risk acceptance.

Context

ISO/IEC 27005 is a risk management standard, not a control catalogue. Its job is to help organisations decide what can go wrong, how serious it is, and what treatment is justified before those decisions are folded into an ISMS.

That matters for identity and access governance because risk treatment often depends on which accounts, secrets, sessions, and control owners are in scope. Where organisations manage NHIs, service accounts, or privileged access alongside human identity, the quality of the risk decision is only as strong as the asset inventory and ownership model behind it.

Key questions

Q: How should teams structure an ISO 27005 risk process without turning it into paperwork?

A: Start with a clear sequence for context, identification, analysis, evaluation, and treatment. Keep ownership explicit, attach evidence to each decision, and require residual risk approval after treatment. The process should be repeatable enough for audit, but flexible enough to reflect real business and control conditions.

Q: When should organisations prioritise residual risk acceptance over more controls?

A: Use residual risk acceptance only after treatment options have been evaluated and when the remaining exposure is understood, limited, and explicitly owned. It is appropriate when further control adds little reduction or creates disproportionate cost or friction. The key is documented accountability, not silent tolerance of unresolved exposure.

Q: What breaks when risk treatment is not linked to specific controls?

A: Risk treatment becomes hard to defend because teams can describe a threat but cannot prove how the chosen control changes exposure. Without control linkage, the Statement of Applicability turns into a static list instead of evidence that the organisation has matched risks to mitigations in a coherent way.

Q: How do security teams know whether their ISO 27001 controls are actually working?

A: They know by testing the controls before the external audit. Internal audits, evidence sampling, and control walkthroughs should show that access governance, risk treatment, and documentation all line up. If those checks fail, the issue is usually drift between policy and practice rather than a missing certificate.

Technical breakdown

How ISO 27005:2022 structures risk decisions

ISO 27005:2022 frames risk management as a repeatable sequence: context establishment, risk identification, risk analysis, risk evaluation, and risk treatment. The update matters because it removes ambiguity around when risk acceptance happens, pushing residual risk acceptance after treatment rather than treating it as a loose final step. That sequencing makes the process easier to audit and easier to align with governance structures that assign risk ownership, control ownership, and approval authority. In practice, the standard is less about scoring risk and more about making the decision trail defensible.

Practical implication: map your current risk workflow to the five steps and verify that residual risk acceptance sits with the right owner.

Why semi-quantitative analysis changes the quality of risk treatment

The 2022 update adds semi-quantitative analysis alongside qualitative and quantitative methods. That matters because many security programmes have some measurable likelihood inputs, such as frequency or exposure counts, but still rely on expert judgement for impact. Semi-quantitative analysis lets teams combine those inputs without pretending everything can be measured precisely. For identity-heavy environments, that is useful when comparing risks like privileged account misuse, secret exposure, or third-party access loss, where hard numbers exist in part but not always across the whole scenario.

Practical implication: use semi-quantitative scoring only where your likelihood and impact inputs are explicit enough to survive governance review.

Why ISO 27001 linkage matters for control selection

ISO 27005:2022 tightens the connection between risk treatment and ISO 27001 by requiring security controls used to modify risk to be compared against ISO 27001 Annex A through the Statement of Applicability. That is a governance change, not just a documentation change. It forces teams to show why a control was chosen, how it affects a specific risk, and whether the control set is complete enough to justify the residual position. For NHI and IAM programmes, this is where control mapping becomes decision evidence rather than an afterthought.

Practical implication: make every treatment decision traceable to a control rationale and a documented Statement of Applicability entry.

NHI Mgmt Group analysis

ISO 27005:2022 is really a governance standard for decision quality. The value is not in producing a prettier risk register, but in making risk treatment decisions traceable, owned, and reviewable. That matters because security programmes often confuse activity with governance, especially when controls, exceptions, and residual risk are approved in different places. Practitioner conclusion: treat the standard as a control-evidence framework, not a paperwork exercise.

The most important change is the explicit shift from risk scoring to risk ownership. By moving residual risk acceptance after treatment, the standard reinforces that a risk decision is incomplete until someone accountable has approved the outcome. This is especially relevant where human identity, privileged access, and non-human identities intersect, because ownership gaps are where control gaps become persistent. Practitioner conclusion: ensure every material risk has a named owner and an approval path.

ISO 27005:2022 sharpens the link between risk and control architecture. The Statement of Applicability is no longer a static compliance artefact sitting beside risk management. It becomes the bridge between analysis, treatment, and the control set that actually changes exposure. That is useful for teams that need to explain why one identity control was accepted, substituted, or deferred while another was prioritised. Practitioner conclusion: use the standard to connect risk rationale to specific control decisions.

For NHI and identity programmes, the standard exposes a common weakness: incomplete asset-to-owner mapping. Risk treatment cannot be defensible if service accounts, API keys, certificates, and delegated access paths are not clearly inventoried and tied to accountable owners. The article's update does not solve that problem, but it makes the gap harder to hide. Practitioner conclusion: if ownership is unclear, the risk process is already failing upstream.

Named concept: residual risk accountability. ISO 27005:2022 makes residual risk a governed decision point rather than an implied outcome of mitigation. That gives security teams a better way to justify acceptance, but it also raises the bar for evidence, especially when controls are distributed across cloud, IAM, and compliance teams. Practitioner conclusion: document who accepted what risk, why, and against which control set.

What this signals

Residual risk accountability: ISO 27005:2022 pushes teams to treat acceptance as a named governance decision rather than an implied end state. That will matter most where cloud access, NHI ownership, and control exceptions are distributed across different teams, because ambiguity in ownership usually turns into ambiguity in treatment.

For identity-led programmes, the practical question is no longer whether a control exists, but whether the organisation can explain why that control was chosen for that risk and who signed off on the remaining exposure. The standard rewards evidence-based governance, not control theatre.

For practitioners

• Define the five-step risk workflow Align your internal method to context establishment, risk identification, risk analysis, risk evaluation, and risk treatment so decisions are consistent and auditable.
• Separate treatment from acceptance Record residual risk acceptance only after treatment decisions are made, and assign a named owner who can justify the outcome.
• Use semi-quantitative inputs where evidence exists Combine measurable likelihood signals with expert impact judgement only when your scoring model can explain both inputs clearly.
• Map treatments to Annex A controls Link each treatment choice to the relevant ISO 27001 Annex A controls and document the rationale in the Statement of Applicability.
• Review asset and owner inventories Verify that accounts, secrets, certificates, and third-party access paths are tied to accountable owners before you rate the risk as acceptable.

Key takeaways

• ISO 27005:2022 makes risk treatment more defensible by tightening the sequence from analysis to treatment to residual acceptance.
• The update matters because it improves decision quality when identity, access, and control ownership span multiple teams.
• Teams that cannot map risks to named owners and specific controls will struggle to justify their residual risk position.

Key terms

• Information Security Risk Management: The process of identifying, analysing, evaluating, and treating risks that could affect information assets, services, or business continuity. In ISO 27005, it is a repeatable governance method that helps teams decide what to accept, what to reduce, and what to document.
• Residual Risk: Residual risk is the risk that remains after controls are applied. In identity-heavy environments, it often reflects over-permissioning, stale accounts, and exceptions that were accepted but never truly removed, which means the real exposure can be higher than the documented policy baseline.
• Statement of Applicability: A Statement of Applicability lists the security controls an organisation has selected, excluded, or adapted for its ISMS. It matters because it forces explicit justification, which makes audit discussions easier and exposes weak control decisions that were previously implied or undocumented.
• Semi-Quantitative Analysis: A risk analysis method that combines numeric elements with expert judgement. It sits between purely qualitative scoring and full statistical modelling, which makes it useful when security teams need more consistency than opinions alone but lack enough data for precise quantification.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity decisions to broader security governance.