ISO 27001 risk assessment template: what it must include and how to use it
An ISO 27001 risk assessment template is the tool where an organization identifies risks to the confidentiality, integrity and availability of its information, assigns each risk an owner, estimates impact and likelihood, calculates a risk level and compares it with risk acceptance criteria defined in advance. The standard (clause 6.1.2) does not mandate a format: it requires a repeatable, documented process, and a well-designed Excel workbook is enough for most small and mid-sized organizations.
What does ISO/IEC 27001:2022 require for risk assessment?
Clause 6.1.2 requires you to define and apply an information security risk assessment process. In short, that process must:
- Set risk acceptance criteria and criteria for performing assessments.
- Produce consistent, comparable results when repeated.
- Identify risks of losing confidentiality, integrity and availability within the ISMS scope.
- Assign an owner to each risk.
- Analyze consequences and realistic likelihood, and determine the risk level.
- Evaluate and prioritize risks for treatment.
Clause 8.2 also requires repeating the assessment at planned intervals or when significant changes occur, and keeping the results as documented information. Risk treatment (clause 6.1.3) uses these results to select controls and feed the Statement of Applicability.
Minimum columns of an ISMS risk register
| Column | Why it matters |
|---|---|
| Risk ID | Traceability to the treatment plan and the Statement of Applicability |
| Process or asset | Places the risk within the scope |
| Risk scenario | Describes what could happen (a threat exploiting a vulnerability) |
| Threat and vulnerability | Lets you justify the analysis to the auditor |
| Affected property (C, I, A) | Confidentiality, integrity or availability |
| Existing controls | The analysis considers what is already in place |
| Impact and likelihood | Scales defined in your criteria (for example, 1 to 4) |
| Level and category | Calculated result compared with acceptance criteria |
| Risk owner and treatment | Who decides and which option: mitigate, transfer, avoid or accept |
How is the risk level calculated?
The most common method in smaller organizations multiplies impact by likelihood on 1–4 scales, giving levels from 1 to 16. Your criteria define from which level a risk is medium, high or critical; for example medium from 6, high from 9 and critical at 16. What matters is not the exact formula but that it is documented, approved and applied the same way every time.
A heat map summarizes how many risks fall into each impact and likelihood combination, helping management see where to focus.
Scenario-based or asset-based?
ISO/IEC 27001:2022 does not require starting from an asset inventory. Many organizations assess risk scenarios per process because it is faster and easier to understand; others prefer an asset-based approach because it connects directly to the inventory. Pick one, document it in your methodology and keep it consistent.
Common mistakes auditors find
- Risks without an owner, or with a generic owner such as "IT".
- Impact and likelihood scales without written definitions.
- Copying another company's risks without adapting them.
- Not recording existing controls, which inflates risk levels.
- Assessing once and never repeating after significant changes.
Template: the NexoDocs risk matrix
The NexoDocs risk matrix is a macro-free Excel workbook with scenario-based and asset-based approaches, configurable criteria, automatic level and category calculation, a heat map, an ISMS risks register and an exceptions register. You can download a reduced version for free (10 scenarios, heat map and criteria) to try it before buying the full toolkit.
Frequently asked questions
Does ISO 27001 require a risk matrix in Excel?
No. It requires a defined, applied and documented risk assessment process. Excel is a practical way to document it, but other tools work too.
Which impact and likelihood scale should I use?
A 1–4 or 1–5 scale is the most common in smaller organizations. What matters is that every value has a written, approved definition.
How often should the risk assessment be updated?
At planned intervals (for example, once a year) and whenever significant changes affect the organization, technology or threats.
Does a template guarantee passing the audit?
No. Certification depends on how the ISMS is implemented and on an audit by a certification body; a good template organizes the work and leaves clear evidence.
Related guides
- ISO 27001:2022 mandatory documents: list by clause
- ISO 27001 Statement of Applicability (SoA): what it is and how to write it
- What is an ISMS and how do you implement it with ISO 27001?
Updated: 2026-10-20