We are currently implementing the ISO27001, I have a question regarding the documentation of the risk assessement.

We choose EBIOS to be our risk assessement method, and I found some templates of the mandatory documents in the ISO 27001 context and in the EBIOS context, they are very different from each other.

My question is: do I need to produce two types of documents even though they have the same content, or the EBIOS documents are sufficient in this situation?

  • Can you be more specific about these required documents? – ack__ Mar 21 '17 at 11:06
  • Precisely these three documents : "Risk assessment and risk treatment methodology", "Risk treatment plan", "Risk assessment report". – Farid-tsl Mar 21 '17 at 11:14

To fulfil this aspect of chapter 6 in the norm you need to document that you have an objective way to assess risk and which method you choose to do so. The results from the risk assessment should be reproducible (i.e. if I do a risk assessment and you do a risk assessment of the same process, we need to end up with the same risk 'scores').

Which method you use and how you document it, an auditor will not care. As long as you achieve what I described above and you can explain why that specific method is adequate for your organization.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.