Risk assessment

In ISO terminology risk assessment is the umbrella for three sub-steps: risk identification, risk analysis and risk evaluation (ISO 31000:2018 clauses 6.4.2 to 6.4.4; ISO/IEC 27005:2022 clauses 7.2 to 7.4). Analysis determines likelihood and consequence and thereby the level of risk; evaluation compares that level with the risk criteria to decide which risks need treatment and in what order. Using "risk analysis" as a synonym for the whole activity, as is common in everyday usage, blurs the distinction, and in Danish practice risikovurdering and risikoanalyse are likewise used loosely.

ISO/IEC 27001:2022 separates defining the process from running it. Clause 6.1.2 requires a defined assessment process with established acceptance criteria and criteria for performing assessments, producing consistent, valid and comparable results, identifying risks to confidentiality, integrity and availability within scope, assigning risk owners, and analysing and evaluating those risks. Clause 8.2 then requires assessments to be performed at planned intervals or when significant changes are proposed or occur, with the results retained as documented information. ISO/IEC 27005:2022 describes two identification approaches: an event-based approach working from risk sources and strategic scenarios, and an asset-based approach enumerating assets, threats and vulnerabilities in detail. It also replaced the older term incident scenario with risk scenario.

NIST SP 800-30 Rev. 1 structures assessment as prepare, conduct, communicate and maintain, and places it on the three tiers defined in SP 800-39: organisation, mission or business process, and information system. Its risk model links threat sources, threat events, vulnerabilities and predisposing conditions, likelihood and impact, with example scales in Appendices D to I. The method can be qualitative, semi-quantitative or quantitative; the choice affects precision and cost but not the underlying structure.

Neighbouring activities differ in object and output. A vulnerability assessment lists concrete technical weaknesses but does not by itself rate business risk; threat modelling analyses a design for what could go wrong, typically at development time; a business impact analysis measures impact over time without considering likelihood; and a GDPR data protection impact assessment under Art. 35 rates risk to the rights and freedoms of data subjects rather than to the organisation. A risk assessment consumes all four as inputs. Typical failures are scoring without agreed criteria, registers describing systems instead of business consequences, and one-off assessments never repeated when the environment changes.