ISO 27005:2022
ISO 27005:2022 is a compliance framework from International with 7 domains and 45 controls that map to 58 other frameworks. The largest domains are Leveraging related ISMS processes – ISO 27005:2022 (13 controls), Information security risk assessment process – ISO 27005:2022 (11 controls), Context establishment – ISO 27005:2022 (8 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Context establishment – ISO 27005:2022
| Code | Title |
|---|---|
| iso-27005-2022::6.1 | Organizational considerations |
| iso-27005-2022::6.2 | Identifying basic requirements of interested parties |
| iso-27005-2022::6.3 | Applying risk assessment |
| iso-27005-2022::6.4 | Establishing and maintaining information security risk criteria |
| iso-27005-2022::6.4.1 | General |
| iso-27005-2022::6.4.2 | Risk acceptance criteria |
| iso-27005-2022::6.4.3 | Criteria for performing information security risk assessments |
| iso-27005-2022::6.5 | Choosing an appropriate method |
Information security risk assessment process – ISO 27005:2022
| Code | Title |
|---|---|
| iso-27005-2022::7.1 | General |
| iso-27005-2022::7.2 | Identifying information security risks |
| iso-27005-2022::7.2.2 | Identifying risk owners |
| iso-27005-2022::7.3 | Analysing information security risks |
| iso-27005-2022::7.3.1 | General |
| iso-27005-2022::7.3.2 | Assessing potential consequences |
| iso-27005-2022::7.3.3 | Assessing likelihood |
| iso-27005-2022::7.3.4 | Determining the levels of risk |
| iso-27005-2022::7.4 | Evaluating the information security risks |
| iso-27005-2022::7.4.1 | Comparing the results of risk analysis with the risk criteria |
| iso-27005-2022::7.4.2 | Prioritizing the analysed risks for risk treatment |
Information security risk management – ISO 27005:2022
| Code | Title |
|---|---|
| iso-27005-2022::5.1 | Information security risk management process |
| iso-27005-2022::5.2 | Information security risk management cycles |
Information security risk treatment process – ISO 27005:2022
| Code | Title |
|---|---|
| iso-27005-2022::8.1 | General |
| iso-27005-2022::8.2 | Selecting appropriate information security risk treatment options |
| iso-27005-2022::8.5 | Producing a Statement of Applicability |
| iso-27005-2022::8.6 | Information security risk treatment plan |
| iso-27005-2022::8.6.1 | Formulation of the risk treatment plan |
| iso-27005-2022::8.6.2 | Approval by risk owners |
| iso-27005-2022::8.6.3 | Acceptance of the residual information security risks |
Leveraging related ISMS processes – ISO 27005:2022
| Code | Title |
|---|---|
| iso-27005-2022::10.1 | Context of the organization |
| iso-27005-2022::10.2 | Leadership and commitment |
| iso-27005-2022::10.3 | Communication and consultation |
| iso-27005-2022::10.4 | Documented information |
| iso-27005-2022::10.4.1 | General |
| iso-27005-2022::10.4.2 | Documented information about processes |
| iso-27005-2022::10.4.3 | Documented information about results |
| iso-27005-2022::10.5 | Monitoring and review |
| iso-27005-2022::10.5.1 | General |
| iso-27005-2022::10.5.2 | Monitoring and reviewing factors influencing risks |
| iso-27005-2022::10.6 | Management review |
| iso-27005-2022::10.7 | Corrective action |
| iso-27005-2022::10.8 | Continual improvement |
Operation – ISO 27005:2022
| Code | Title |
|---|---|
| iso-27005-2022::9.1 | Performing information security risk assessment process |
| iso-27005-2022::9.2 | Performing information security risk treatment process |
Terms and definitions – ISO 27005:2022
| Code | Title |
|---|---|
| iso-27005-2022::3.1 | Terms related to information security risk |
| iso-27005-2022::3.2 | Terms related to information security risk management |
Your Compliance Coverage
If you comply with ISO 27005:2022, you already cover:
ISO 14004:2016
29%
13 controls mapped
Compare →ISO 31000:2018
22%
10 controls mapped
Compare →ISO 13485:2016
20%
9 controls mapped
Compare →+ 55 more: ISO 19011:2018 (18%), ISO 27701:2019 (18%)
See all 58 mapped frameworks ↓Maps to 58 other frameworks
What is ISO 27005:2022 and who does it apply to?
ISO 27005:2022 is a compliance framework from International with 7 domains and 45 controls. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ISO 27005:2022 actually require?
ISO 27005:2022 has 45 controls organised across 7 domains. The largest domains are Leveraging related ISMS processes – ISO 27005:2022 (13 controls), Information security risk assessment process – ISO 27005:2022 (11 controls), Context establishment – ISO 27005:2022 (8 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ISO 27005:2022 do I already cover?
ISO 27005:2022 maps to 58 other compliance frameworks. The top mapping partners are ISO 14004:2016 (29% coverage), ISO 31000:2018 (22% coverage), ISO 13485:2016 (20% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement ISO 27005:2022?
Start your ISO 27005:2022 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 27005:2022 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 45 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required