“risk evaluation: process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its significance is acceptable or tolerable”ISO/IEC · ISO/IEC 27005:2022 — Information security, cybersecurity and privacy protection — Guidance on managing information security risks · 2022 · ISO/IEC 27005:2022, 3.2.6 «risk evaluation» — definiție preluată din ISO Guide 73:2009, 3.7.1, modificată («significance» a înlocuit «magnitude»)
Criteria are written before the risks, otherwise the threshold moves to fit the result.
Clause 6.1.2 of ISO/IEC 27001:2022 asks for a process, not a spreadsheet. Item a) asks for written criteria: the risk acceptance criteria and the criteria for performing assessments. Item b) is the one that separates a serious method from improvisation — repeated assessments must produce consistent, valid and comparable results. Then come identification of risks to confidentiality, integrity and availability together with named risk owners; analysis, meaning the potential consequences, the realistic likelihood and the resulting levels of risk; and evaluation, meaning the first comparison against the criteria from item a) and the prioritization for treatment. The detailed guidance sits in ISO/IEC 27005:2022, the fourth edition, which contrasts two ways of identifying risk: the event-based approach, which starts from scenarios and the objectives at stake, and the classic asset-based approach, which starts from an inventory, threats and vulnerabilities. The first is faster and closer to the business, the second more complete and slower.
Consistency is not just a competence test; it is what makes an assessment verifiable. If the result depends on whoever fills in the table, nobody can check anything. With criteria and method fixed in advance, the same process can be rerun a year later, and the differences mean something: the situation changed, not the analyst. Think of an online shop assessing the risk of payment downtime. If the method stays the same, a higher risk level than last year is a real signal, not a change of mood. But how do you build a method that yields the same results in different hands?
The answer to the previous question lies in choosing the starting point. ISO/IEC 27005:2022 puts two paths of risk identification side by side. The event-based approach starts from scenarios and from the objectives they would affect. The asset-based approach starts from an inventory, then ties threats and vulnerabilities to each item. The first is faster and closer to how leadership thinks. The second is slower, but covers corners a scenario can skip. Pick one, write it into the method, and two analysts will walk the same road. A restaurant taking online orders can start from the event "the ordering system goes down on a peak weekend". Or it can start from assets: the server, the app, customer data, each with its own threats. That same choice, written down in black and white, is what makes the result repeatable. But once risks are identified, who decides what is acceptable, and who carries the responsibility?
Why it matters If two analysts in the same organization rank the same risks differently, item b) of clause 6.1.2 has already failed.