ISO/IEC 27001 Risk Assessment Toolkit
A Risk Methodology That Produces Consistent, Comparable Results
The scales, 5×5 matrix and acceptance thresholds Clause 6.1.2 requires, documented, not improvised.
The core problem
If your scoring lives in one analyst's head, it will not survive an audit
Clause 6.1.2 demands a process that produces consistent, valid, and comparable results, meaning two different analysts working the same asset list must arrive at comparable scores. Most teams cannot show that: no written scale definitions, no defensible matrix, and acceptance thresholds reverse-engineered after the scores are already on the page. This is the most common source of Clause 6.1 nonconformities. You need a documented method an auditor can trace from asset to risk to control, not an ad-hoc spreadsheet.
By the numbers
The figures your methodology has to pin down
The approach
Asset-based, because certification bodies expect a traceable path
ISO/IEC 27001 does not prescribe a single methodology, but for organizations pursuing certification the asset-based model is the practical choice. It starts from a defined inventory, pairs each asset with plausible threats and vulnerabilities, scores likelihood and impact, and links the result to specific Annex A controls. Certification bodies expect to see that path, asset to risk to control to Statement of Applicability, with the least friction. This toolkit is built around that model from first asset to final SoA.
What is inside the toolkit
The payoff
What you can do once you have worked through it
Answer the auditor's scoring question with documented criteria
When an assessor asks how you scored a specific risk, you reference written definitions and threat intelligence instead of analyst intuition.
Set thresholds as a policy decision, not after the fact
Define and get sign-off on acceptance criteria before assessment begins, closing the most common Clause 6.1 stage-one finding.
Keep your register and SoA telling the same story
Trace every treatment decision in both directions so gaps between what you plan and what you have done never surface as audit exposure.
Handle controls you cannot yet deploy without leaving risk unmanaged
Document interim measures, score actual current exposure honestly, and build reassessment triggers into the register.
Stand up the whole process from copy-ready templates
Drop the four templates into a spreadsheet or GRC tool with their logical traceability intact, rather than designing structure from scratch.
Why it holds up
Grounded in the standard, not generic risk theory
Frequently asked questions
Yes. Clause references, control counts, and the four Annex A themes reflect our understanding of ISO/IEC 27001:2022 as of publication. Confirm current clause language and control numbering against the published standard and your certification body before you rely on them.
No toolkit can. This is provided for informational and educational purposes and does not constitute legal or compliance advice. It gives you a defensible, documented method; your certification outcome depends on your own implementation and your assessor's review.
Yes. The toolkit treats service assets, cloud infrastructure, connectivity, and managed services as first-class entries, and walks through justified exclusions such as physical media controls where no portable media is in scope.
No. The templates are designed to be copied directly into a spreadsheet or a GRC tool. A well-structured spreadsheet with consistent fields is auditable and practical.
Both. It is written for practitioners starting or rebuilding their risk process who need a repeatable method rather than an ad-hoc one, with the exact gaps that generate nonconformities flagged throughout.
ISO/IEC 27001 Risk Assessment Toolkit