Framework overlap

Does ISO 31000:2018 cover ISO 27005?

You hold ISO 31000:2018 and have been told to do ISO 27005. Here is how much overlaps, control by control.

50% of ISO 27005 you already have

ISO 31000:2018 already covers about 50% of ISO 27005, leaving 13 of 26 controls as genuinely new work.

Already covered 5 Likely covered 8 New work 13

What is genuinely new work

Nothing in ISO 31000:2018 reaches these. This is the list to scope.

7.5
Threat assessment
7.7
Likelihood estimation
7.8
Consequence estimation
8.5
Control effectiveness review
ISO27005-03
Risk culture and communication
ISO27005-04
Stakeholder requirements for risk
ISO27005-09
Risk scenario development
ISO27005-13
Residual risk acceptance
ISO27005-14
Risk transfer and insurance
ISO27005-15
Control implementation and monitoring
ISO27005-16
Risk monitoring procedures
ISO27005-17
Risk reporting and communication
ISO27005-20
Management review of risk program
Show the 13 you already have
9.1
Risk communication and consultation
ISO27005-06
Risk identification methods
ISO27005-07
Risk analysis and evaluation
ISO27005-11
Risk treatment options and selection
ISO27005-12
Risk treatment plan development
8.3
Statement of Applicability linkage
ISO27005-01
Risk management policy and scope
ISO27005-02
Risk governance structure
ISO27005-05
Risk management integration
ISO27005-08
Risk criteria and thresholds
ISO27005-10
Risk interdependency analysis
ISO27005-18
Risk register maintenance
ISO27005-19
Continuous improvement of risk processes

How this is calculated

Already covered means a mapping runs from a control in ISO 31000:2018 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition