ISO 27005:2022 10.3: Communication and consultation

Input: what the risk processes found about risks, why they arise, what they would do and how likely they are. Action: communicate information on risks and the controls treating them to, or gather it from, internal and external interested parties. Trigger: 27001 requires such communication (7.4 covers its communication part). Output: interested parties' perceptions and continuing understanding of the process and results. The aim is agreement on managing risks through exchanging information with risk owners and others, covering whether risks exist and their nature, form, likelihood, consequences, significance, treatment and acceptance. Ownership can be deliberately blurred and owners reluctant, so a defined procedure informs people of their ownership; owners approve plans and accept residual risk, so two-way communication between them and ISMS staff matters. Sensitive risk information is shared on a need-to-know basis in consultation with owners, avoiding publicity for sensitive risks and weaknesses. Perceptions differ with assumptions, needs and concerns, so they, and perceived benefits, are identified, documented and understood; involving parties in developing criteria and methods builds ownership and acceptance of findings, and commitment where they are managers. Communication aims to assure outcomes, collect risk information, share results and plans, reduce breaches arising from misunderstanding, support owners, gain new knowledge, coordinate responses to limit incident consequences, give owners and legitimately interested parties a sense of responsibility, and raise awareness. Plans cover normal operations and emergencies, the activity runs continually, a committee can coordinate major owners, communications may go voluntarily or by requirement to third parties such as regulators or partners, and the public relations or communications unit is involved, crucially in crisis communication.