This new version of ISO27005 has two main features: 1) it incorporates ISO31000 risk management framework. So the two main bodies of ISO (i.e. ISO27001 and ISO3100) are more aligned in the definitions of the terms.
Another thing is that Annex is enhanced a bit. More guiding tables about risk ratings are added. It is quite enjoyable to read them.
If consultants in the industry are aligning on those terms on severity, likelihood, risk ratings etc., then consultant reports will be more useful. Currently it is quite a subjective matter to say an item is of a ‘high’ risk level.
Cotakvision Consulting 
Leave a comment