A Practical Guide to the ISO 27001 Risk Assessment (SME Focus)

Minimalist vector illustration of an SME team performing an ISO 27001 risk assessment with a risk register and risk treatment overview

Running an ISO 27001 risk assessment is the heart of compliance for SMEs and startups. The process does not have to be overwhelming — it is about practical, repeatable, and traceable risk management that supports your ISMS, aligns with Annex A controls, and can help provide evidence a certification audit.

This guide helps SMEs conduct a step-by-step ISO 27001 risk assessment, including defining the risk context, evaluating likelihood and impact, selecting treatment options, tracking residual risk, and mapping controls to the Statement of Applicability (SoA).

Think of it as choosing where to install a new lock on your house: secure the valuables first (high-impact risks) before adding extra locks to low-priority areas.

A clean vector infographic illustrating the nine-step ISO 27001 risk assessment workflow for SMEs, showing a logical, methodical progression from context definition to continuous review.

Why Risk Assessment Matters for SMEs


An ISO 27001 risk assessment is the foundation of your Information Security Management System (ISMS). It ensures your team understands which information assets are critical, what threats and vulnerabilities exist, and which controls are required to reduce information security risk to an acceptable level. For SMEs, this process:

  • Supports compliance: Contributes to evidence for the Statement of Applicability (SoA) and the certification audit.
  • Reduces effort: Focuses resources on the highest-impact risks instead of spreading effort across low-value areas.
  • Strengthens trust: Can help demonstrate to clients, partners, and regulators that risks are identified, assessed, and actively managed.
  • Improves decision-making: Helps leadership prioritise risk treatment actions and allocate resources efficiently.

Think of it as choosing where to install a new lock (control) on your house (asset). You would not put a top-tier smart lock on your garden shed (low-impact risk) before securing the main door that protects valuable items (high-impact risk).

Suggestion: ISO 27001 does not require complex scoring models or enterprise-level tooling. Auditors value a risk assessment that is consistent, clear, and repeatable over one that looks mathematically sophisticated but is difficult to explain.

A minimalist vector illustration of the lock analogy used for SME risk assessment, showing a top-tier lock securing the valuable main door (representing high-impact risk) while the garden shed uses basic security.

Step 1 – Define the Risk Context

Before starting your ISO 27001 risk assessment, your ISMS must define the risk context to ensure the process is relevant, consistent, and auditable. This step establishes the boundaries and rules for how information security risks will be identified, analysed, and evaluated.

Key Components:

  • Scope: Define which systems, processes, and teams are included.
    • Example: Define the systems, applications, and infrastructure included.
  • Risk Criteria: Pre-define how risks will be evaluated to ensure a consistent, repeatable methodology.
    • Example: Define your own likelihood and impact scales (e.g. using a 3x3 or 5x5 matrix).
  • Risk Acceptance Criteria: Set the thresholds for acceptable risk.
    • Example: Define your own acceptable thresholds (e.g. all risks above a specific score require mitigation).

Why It Matters: The ISO 27001 standard requires your risk assessment methodology is tailored, documented, and consistently applied as required under ISO 27001 Clause 6.1.2.

Step 2 – Identify Information Assets

The next stage of your ISO 27001 risk assessment is to identify all information assets that support your business operations. An information asset is anything that stores, processes, or transmits information and could be impacted by a security incident.

Common Asset Categories:

  • Digital assets: Customer databases, SaaS platforms, internal documents, code repositories.
  • Physical assets: Laptops, mobile devices, network equipment, office servers.
  • Intangible assets: Brand reputation, proprietary processes, intellectual property.
  • People assets (optional but often useful): Key roles such as developers, administrators, support engineers.

Suggestion: Keep your asset list practical. Start with high-value systems and data that would cause the greatest business impact if compromised, then expand over time as your ISMS matures.

General Observation: Organisations should ensure asset identification is systematic, up to date, and directly linked to the later steps of risk assessment and the Statement of Applicability.

Step 3 – Identify Potential Threats and Vulnerabilities

After listing your information assets, the next step is to identify the threats and vulnerabilities that could impact them.

  • A threat is anything that could exploit a weakness.
  • A vulnerability is the weakness that makes the asset susceptible.

Common Threat Categories:

  • Human error: Accidental deletion, misconfiguration, weak passwords.
  • External attacks: Phishing, ransomware, credential stuffing, malware.
  • Technical failures: Cloud outages, server crashes, software bugs.
  • Third-party risks: SaaS vendors, Managed Service Providers (MSPs), cloud providers, outsourced partners.
  • Physical threats: Device theft, loss, fire, flood, or environmental damage.

Common Vulnerability Examples:

  • Unpatched systems
  • Lack of MFA
  • Misconfigured cloud buckets
  • Poor access control
  • Missing procedures or documentation
  • Over-privileged accounts

Suggestion: Use a structured ISO 27001 Risk Register Template to document each asset, link threats and vulnerabilities, and ensure full traceability through your risk scoring and treatment steps.

General Observation: Organizations should ensure threats and vulnerabilities are identified consistently and mapped to assets in a repeatable, evidence-based manner.

Step 4 – Evaluate Risk Against Acceptance Criteria

In this ISO 27001 risk assessment step, evaluate each identified risk using a consistent likelihood-and-impact model. This determines whether the risk is acceptable or requires treatment under Clause 6.1.3.

Use a documented methodology (e.g. a simple grid or scoring system) to ensure scoring is repeatable, traceable, and aligned with your Risk Acceptance Criteria. Document every decision clearly – this creates strong audit evidence.

Audit Consideration: A documented methodology helps SMEs and startups demonstrate consistent evaluation during audits. Risks that exceed your acceptance threshold should be transferred to the Risk Treatment Plan.

Step 5 – Select Risk Treatment (Accept, Avoid, Mitigate, Transfer)

After evaluating each risk, choose the appropriate ISO 27001 risk treatment option. The four commonly recognised approaches are:

  1. Accept: Tolerate low-impact risks that fall within your Risk Acceptance Criteria.
  2. Avoid: Stop or change activities that create unacceptable or high-risk exposure.
  3. Mitigate: Apply security controls to reduce likelihood or impact (aligning controls to Annex A).
  4. Transfer: Shift part of the risk to a third party, such as through insurance or cloud provider SLAs.

Document every treatment decision in your Risk Register. These records provide direct input into your Statement of Applicability (SoA) and form required audit evidence for ISO 27001 Clause 6.1.3.

Step 6 – Map Controls to Risks

Link each treated risk to appropriate Annex A controls.

  • Treat Annex A as a menu of possible controls.
  • Justify why each selected control is included.
  • Document why non-applicable controls are excluded.

Using a Statement of Applicability (SoA) template can help ensure consistent justification and alignment with identified risks.

Step 7 – Assign Control Owners

Assign ISO 27001 control owners for each security control, giving responsibility to the role that naturally manages it:

  • Engineering: technical configurations, access control, logging
  • Operations: supplier management, onboarding / offboarding
  • IT / Security: device management, monitoring, incident response
  • CEO / Founder: risk approval, leadership commitments

Document ownership in your Risk Register or Statement of Applicability to ensure accountability and maintain audit evidence.

Step 8 – Track Residual Risk

After implementing treatments, record the ISO 27001 Residual Risk – the risk that remains after controls are applied.

Example:

  • Original Risk: High risk of data loss from staff error
  • Control: Mandatory security training
  • Residual Risk: Medium (risk reduced but not eliminated)

General Observation: Organisations should confirm that ISO 27001 residual risks remain within your Risk Acceptance Criteria. Update your Risk Register accordingly.

Step 9 – Continuous Review and Improvement

Risk management under ISO 27001 is ongoing and requires continuous review and improvement for SMEs:

  • Update likelihood, impact, and treatment decisions as risks evolve.
  • Adjust controls to address new or evolving threats or business context.
  • Document all updates to provide clear audit evidence.

When to Review Your Risk Assessment

To ensure your risk assessment remains effective and compliant:

  • Annually (Minimum): Conduct a formal management review at least once per year.
  • Quarterly: Align reviews with internal management or board meetings.
  • After Major Changes: Immediately review if there are:
    • New major systems (e.g. migration to a cloud platform)
    • Significant incidents (e.g. cyber attacks or data breaches)
    • Regulatory changes (e.g. updates to EU GDPR or other relevant laws)

Why It Matters: Clearly defined review intervals are an essential part of demonstrating that your ISMS is actively maintained, consistent, and responsive to risk, aligning with ISO 27001 requirements.

Common SME Risk Assessment Mistakes to Avoid

Minimalist vector infographic comparing an optimized SME risk assessment checklist with a 'Mistakes Checklist' (like unassigned risks, unlinked controls, and neglecting third parties), illustrating how to avoid complex dependency.

Avoid these common mistakes when running an ISO 27001 risk assessment for your organisation:

  • Overcomplicating scoring – keep likelihood and impact evaluation simple, consistent, and traceable.
  • Ignoring ownership – unassigned risks often lack follow-through and audit evidence.
  • Treating the assessment as one-time – continuous monitoring ensures risks remain controlled.
  • Not linking risks to controls – every identified risk should have a mitigation path documented in the Statement of Applicability.
  • Neglecting third-party risks – suppliers, contractors, and cloud services must be considered.

Tools and Templates for SMEs

Use these ISO 27001 risk management templates to simplify and standardise your process:

These templates are tools designed to structure your documentation; however, the responsibility for accurately implementing and maintaining your ISMS, including defining your unique scope and criteria, rests solely with your organisation.

TL;DR: SME-Friendly Risk Assessment Workflow

  1. Identify information assets.
  2. List threats and vulnerabilities.
  3. Evaluate risk against Risk Acceptance Criteria.
  4. Select Risk Treatment (Accept, Avoid, Mitigate, Transfer).
  5. Map risks to Annex A controls.
  6. Assign clear ownership.
  7. Document everything in a risk register.
  8. Monitor residual risk and feed into your ISMS continuous improvement cycle.

Key Takeaways

  • SMEs do not need enterprise-level complexity – clarity, repeatability, and evidence are sufficient.
  • A structured risk register simplifies Statement of Applicability development and audit preparation.
  • Linking risks to Annex A controls demonstrates compliance logic.
  • Clear ownership, documentation, and periodic review maintain ongoing audit readiness.
  • Templates accelerate implementation, save time, and reduce errors.

Next Steps: Enhance your ISO 27001 risk management process with practical ISO 27001 risk management templates.

Next Article: In ISO/IEC 27001:2022 Annex A Controls Explained for SMEs – Practical Overview, we focus on the most critical ISO 27001 controls for SMEs, explaining their purpose, practical implementation, and how they tie into your ISMS.

Related Guides

Explore these ISO 27001 resources to help your SME build a practical, lean ISMS:

Start Here: Complete Guide

C. Risk, Statement of Applicability, and Annex A Controls – Detailed Guides by Topic

Please Note: This article provides general information only and does not constitute legal, regulatory, or compliance advice. Using our products or following this guidance cannot guarantee certification, improved business outcomes, or regulatory compliance. Organisations remain responsible for ensuring all actions meet certification and compliance requirements.