Skip to main content
All measures

Measure · ISO 27001 and other standards

Manage ISMS risks and objectives together

Connect one authoritative risk methodology with assessments, treatment, SoA and security objectives. Keep decisions and results traceable in their existing records.

Accountable: ISMS coordinator with risk owners and objective ownersReviewed

Reuse existing records

Reuse the existing ISMS framework, policy, risk register, SoA and task records. The handbook governs the method. The Kopexa guide explains its use in the product without creating a second rule source.

What to do

  1. 1

    Define the method and assess risks

    Set the assessment scope, assessment and acceptance criteria, and a comparable repeatable process in the authoritative method. Identify risks to the confidentiality, integrity and availability of information within the ISMS scope and assign risk owners. Explain potential consequences and realistic likelihood, determine risk levels and compare them with the criteria. Retain traceable assessments and treatment priorities.

  2. 2

    Connect treatment, SoA and consent

    Select treatment based on the assessment and determine all necessary safeguards. Compare them with the complete Annex A to check that nothing necessary has been missed and add your own safeguards when needed. The SoA records inclusion justifications, actual implementation status and justified exclusions. Connect the treatment plan with specific work. Each risk owner explicitly approves the plan and accepts residual risk against the relevant state.

  3. 3

    Manage security objectives with an actionable plan

    Derive objectives from the policy, applicable requirements and risk assessment and treatment results. Make them measurable where practicable. Record planned work, resources, ownership, completion date and result evaluation in the authoritative record. Communicate objectives to participants, monitor them and update them as needed.

  4. 4

    Collect and evaluate results

    For the processes and safeguards being monitored or measured, define the subject, a suitable method and data source. Decide who collects information and when, and who evaluates it and when. The method must support valid, comparable and reproducible results. Retain actual results and record what they indicate about security performance and ISMS effectiveness. Connect necessary follow-up work with existing task records.

Worked example

A team wants to conduct access reviews more reliably

Fictitious example: a risk describes access that is no longer needed. The team uses an applicable risk method, an existing risk register and its existing task records.

Risk and treatment
DecisionThe risk owner reviews the assessment and the specific access-removal plan. Consent to the plan and residual risk is recorded against the applicable state.
EvidenceReasoned assessment, related treatment, SoA decision and explicit consent.
Objective and result
DecisionA security objective identifies the required review state and deadline. The responsible person collects the actual state; a named role evaluates achievement and necessary follow-up.
EvidenceBaseline, objective plan, collection method, actual results and reasoned evaluation.

Record the result

  • Applicable risk criteria and traceable assessments with risk owners, assessment reasoning and priority.
  • Treatment, SoA and specific risk-owner consent to the plan and residual risk.
  • Documented objectives and planning, plus retained measurement and evaluation results and the resulting follow-up work.

Common implementation mistakes

Treating a matrix colour as risk acceptance

A tolerance threshold supports the decision. It does not replace explicit risk-owner consent or compliance with applicable requirements.

Maintaining the same state in multiple lists

Choose one authoritative record for each result. Connect risks, treatment, SoA, objectives and tasks rather than creating independently maintained copies.

Treating a dashboard as an evaluation

Record how the values were obtained and what the responsible person concludes from them. A displayed value alone is not evaluated effectiveness.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards

  • ISO/IEC 27001 · 6.1.2

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The procedure connects maintained assessment and acceptance criteria, comparable repeated assessments and CIA risks within scope with owners, reasoned consequences and likelihoods, risk levels and prioritisation. The user must decide suitable criteria and actually carry out and retain assessments.

    Reference

  • ISO/IEC 27001 · 6.1.3

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    Treatment is connected with necessary safeguards, a complete Annex A comparison, SoA justifications and actual implementation status, the treatment plan and explicit risk-owner consent to the plan and residual risk. Specific decisions and actual treatment remain operational work.

    Reference

  • ISO/IEC 27001 · 6.2

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    Objective planning considers the policy, applicable requirements and risk assessment and treatment. The procedure identifies measurability where practicable, communication, monitoring and updates, as well as work, resources, ownership, completion and result evaluation. Objectives must be defined for the organisation and followed up.

    Reference

  • ISO/IEC 27001 · 9.1

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The procedure defines the subject, suitable method and source, and responsibilities and timing for collection and evaluation. Actual results are retained and assessed for security performance and ISMS effectiveness. A register or software dashboard alone does not evidence this evaluation.

    Reference

Templates for your implementation

Sources and further reading