Title: ISO 27001 risk assessment and register example

> An original small risk register for a fictional hosted service. Follow the assumptions, treatment choices and evidence instead of copying an unexplained score.

Source: https://aegentra.co.uk/knowledge/iso-27001-risk-assessment-example  
Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT.  
Published: 2026-10-18  
Updated: 2026-10-21  
Licence: public web content; cite the source URL.

Practical guide / United Kingdom

# ISO 27001 risk assessment and risk register: a worked example

An original small risk register for a fictional hosted service. Follow the assumptions, treatment choices and evidence instead of copying an unexplained score.

By [Harry Sidhu](https://aegentra.co.uk/about#director) — ISO 27001 Lead Implementer · Director and Principal Consultant, AegentraPublished 18 October 2026 · Updated 21 October 2026

Researched 18 October 2026. Examples are original fictional learning aids, not client results or legal advice.

## Begin with an objective and a boundary

The fictional company needs its hosted scheduling service to remain available and protect customer information. Development, operation and support are within the proposed ISMS scope. Before scoring risks, the team agrees its assessment criteria, who can accept risk and what information it needs to make a decision. The example does not prescribe a scoring scale for every organisation.

## Describe a scenario, not just a category

“Cyber attack” gives a decision-maker little to act on. Describe how an event could affect the scoped service, what existing controls are known to do and what remains uncertain. Keep the source of an assumption visible. A threat, a vulnerability, a consequence and a control are related concepts, not interchangeable labels.

## Compare treatment choices

Treatment is not necessarily a new tool. Consider whether to change the activity, reduce the risk, share aspects of it or retain it through the appropriate decision process. Record the rationale and approval. The register should link to the selected controls and the SoA, but it is not itself the SoA.

## Evaluate the remaining risk using evidence

After an action, assess what changed and what did not. Assigning MFA does not by itself resolve every privileged-access scenario; a backup does not establish recovery capability until relevant evidence exists. The authorised owner needs enough information to make an acceptance decision, including limits and outstanding actions.

## Keep the register connected to change

Review when the product, suppliers, obligations or operating evidence change. In this example, a new support integration could change access assumptions and introduce another supplier dependency. A calendar review can be useful, but it should not be the only trigger. This starter record is not a complete assessment methodology or client deliverable.

## A working record to discuss.

| Risk scenario | Evidence or uncertainty | Treatment decision to evaluate | Owner and review trigger |
| --- | --- | --- | --- |
| An unnecessary support privilege exposes customer records. | Privileged account list exists; contractor access is not reconciled. | Reconcile access, limit privileges and verify a review process before reassessing. | Service owner; after reconciliation or a support-role change. |
| A deployment interrupts the scheduling service. | Planned releases are approved; emergency-path evidence is missing. | Test the emergency approval and rollback arrangements, with recorded results. | Engineering owner; after a failed change or process revision. |
| A hosting incident prevents timely recovery. | Backups report success; restoration within business needs is unproven. | Run an authorised recovery exercise and assess the observed outcome. | Operations owner; after the exercise or a hosting change. |

[Download the original working record (CSV)](https://aegentra.co.uk/downloads/iso-27001-risk-register-working-example.csv)
Starter example only. Adapt it to the agreed scope and use the applicable standards and qualified judgement.

## Check the primary sources.

[ISO: ISO/IEC 27001](https://www.iso.org/standard/27001)

## Choose the next step.

[Scope an ISMS implementation](https://aegentra.co.uk/services/govern/iso-27001)

[Link decisions to the SoA](https://aegentra.co.uk/knowledge/iso-27001-statement-of-applicability-example)

[Develop information-security risk skills](https://aegentra.co.uk/academy/iso-27005-risk-manager)

[Compare broader risk-management courses](https://aegentra.co.uk/academy/iso-31000)