ISO/IEC 27005:2008

Information technology -- Security techniques -- Information security risk management

ISO/IEC 27005:2008 provides guidelines for information security risk management. It supports the general concepts specified in ISO/IEC 27001 and is designed to assist the satisfactory implementation of information security based on a risk management approach. Knowledge of the concepts, models, processes and terminologies described in ISO/IEC 27001 and ISO/IEC 27002 is important for a complete understanding of ISO/IEC 27005:2008. ISO/IEC 27005:2008 is applicable to all types of organizations (e.g. commercial enterprises, government agencies, non-profit organizations) which intend to manage risks that could compromise the organization's information security.


General information

  • Current status : Withdrawn
    Publication date : 2008-06
  • Edition : 1
    Number of pages :
  • :
    ISO/IEC JTC 1/SC 27
    IT Security techniques
  • 03.100.70
    Management systems
    35.030
    IT Security

Got a question?

Check out our FAQs


Customer care
+41 22 749 08 88

Opening hours: 09:00-12:00, 14:00-17:00 (UTC+1)

You may be interested in:

Keep up to date with ISO

Sign up to our newsletter for the latest news, views and product information