ISO 27001 risk analysis
ISO 27001 requires a documented risk analysis, not a list of opinions. We set the scope, threats, impacts and treatments your team can actually follow.
What we see too often
Many SMBs have a “risk analysis” that is a list of worries. With no method, no assets and no decided treatments, it helps neither leadership nor the auditor.
- risks named by feel, with no link to critical processes
- a copied matrix, never updated, never used to prioritize
- no treatment: everything is “to be monitored”
- leadership never decided what it accepts living with
- no link to Annex A or to what is already in place
What this module is
ISO 27001 risk analysis identifies what threatens your information in a given scope, assesses impact and likelihood, then decides treatments. It is not a fear brainstorm, nor a tool report left in a folder.
The useful deliverable is a register your team can reopen: assets, scenarios, dated decisions, owners. That register drives the other modules, not the other way around.
Where this sits in ISO 27001
The module covers clause 6.1 and the operational cycle 8.2 / 8.3: assess risks, then treat them. It does not walk through all 93 controls one by one.
What this module includes
- Scoping workshop with leadership
- Identification of critical information assets
- Assessment of threats, impacts and likelihood
- Link to existing controls and Annex A
- Prioritized treatments realistic for an SMB
How we work
Scoping and assets
We start from the scope (even if imperfect) and identify critical information assets with the people who know them.
Scenarios and assessment
Threats, impacts, likelihood, controls already in place. A simple, repeatable method, with no mandatory software.
Treatments and priorities
Reduce, transfer, avoid or accept. Each retained risk has a treatment realistic for an SMB, an owner and a date.
Leadership decisions
Workshop record, signatures, what is accepted as-is. Without that, the register stays a technical opinion.
What you receive
- Day-to-day risk register
- Impact and likelihood matrix
- Prioritized risk treatment plan
- Workshop record with leadership decisions
Who it is for
Leaders and IT managers who must justify security priorities to a client, insurer or auditor.
Who it is not for
This module is not a pentest, nor the implementation of every treatment. It does not replace the pre-assessment if you still have no picture of the ISMS.
Typical duration
2 to 4 weeks, depending on the number of processes and systems.
What you need to provide
You provide an approximate system inventory, critical business processes, and time from leadership plus the IT lead. Access to operational teams makes the difference.
What this module does not cover
This module delivers the analysis and treatment plan. It does not implement every control, nor certification.
Frequently asked questions
- Do we need expensive software for risk analysis?
- No. For an SMB, a clear register, a repeatable method and dated decisions are enough. Tools come later if volume requires them.
- Who should attend the workshop?
- Leadership, the IT lead and people who know critical processes. Without them, the analysis stays theoretical.
- Does this replace the pre-assessment?
- No. The pre-assessment photographs the whole ISMS. Risk analysis deepens clause 6.1 and drives treatment.
- Can we buy only this module?
- Yes. Each module is sold separately. You do not have to buy the full programme. The pre-assessment remains the most efficient entry point if you do not yet know where to start.
- Do we have to start with the pre-assessment?
- No, it is not mandatory. The pre-assessment speeds up scoping if you do not yet have a full picture. If you already know what is missing, we can start this module directly.