I'm in the process of defining a risk assessment methodology for a company that would like to be aligned with ISO 27001. The standard states clearly that the aim is the protection of CIA (confidentiality, integrity, availability).
Do I have in my risk methodology to give scores for the consequences for each asset/process compared to confidentiality, integrity and availability separately or is it enough to give a single score for each asset/process. In most of the approved tools I have the treat it a single score for the consequences.
Is NOT scoring the consequences independently for each of CIA the right approach?