ISO 27001 risk analysis
ISO 27001 risk analysis that stands by the audit
The risk analysis is the heart of your ISMS and the first thing the auditor looks at. We carry out the analysis together with your team and provide a risk register, treatment plan and Declaration of Applicability that are aligned with each other.
- A one-day workshop with your key stakeholders
- Method according to ISO 27005, which you can repeat yourself every year
- Ready within three weeks, at a fixed price
Trusted by 500+ companiesISO/IEC 27001:2022 and ISO 27005Also useful for NIS2
The lines of communication with Nestor Security were short. The organization is pragmatic and a down-to-earth party to do business with.
Pascal KamphuisCorpoflow
Schedule a no-obligation consultation
One of our ISO 27001 experts will contact you within one working day. We will discuss your situation, the approach and the costs.
How can we help you?
Response from an ISO 27001 consultant within one working day. Free of charge and without sales talk.
Find out why 500+ Companies trust Nestor Security for IT security and compliance
In this respect, our approach is different from the alternatives.
You can also create a risk analysis yourself, using a template or software. These are the differences that make a difference during the audit.
| Nestor Security | Create your own template | Compliance platform | |
|---|---|---|---|
| Starting point | Your own processes, systems and suppliers | A generic list from a template | A standard library in the software |
| Method | Fixed criteria according to ISO 27005, repeatable | Often no established criteria | The standard method of the supplier |
| Team involvement | A workshop with your key stakeholders | Often a single colleague behind a spreadsheet | Fill out by your own team |
| Link with Annex A | Every measure can be traced back to a risk | Often apart from each other | Automatic pairing, without verification |
| Declaration of Applicability | With supporting evidence per measure | Often without any substantiation | Standard texts |
| During the audit | Built on what auditors test | A common source of deviations | Depending on your own interpretation |
| Costs | Fixed price, known in advance | No costs, but a lot of hours | Annual license |
From loose concerns to a register with priorities
After the risk analysis, you know where your biggest risk lies, who is responsible for it, and what measures you should take first. Everything is documented as required by the standard.
- Risk method with criteria for probability, impact and acceptance
- Risk register with owner and risk level per risk
- Risk management plan with measures and planning
- Declaration of Applicability with supporting documentation per measure
Is reducedCriticism
Is reducedHigh
Is being sharedMiddle
Is acceptedLow
This is how your risk analysis works
In four steps and on average three weeks. We primarily require knowledge of your own processes from your team, not the standard ones.
Method and criteria
- Risk methodology tailored to your organization, according to ISO 27005
- Criteria for opportunity, impact and risk acceptance
- Definition of processes, information and systems within the scope
Workshop with your team
- A day with management, IT and process owners
- Threats and vulnerabilities per process and information medium
- Classification based on availability, integrity, and confidentiality
Analysis and evaluation
- Probability and impact per risk, with a risk owner
- Comparison with your acceptance criteria
- Priorities in a row
Treatment Plan and Declaration of Applicability
- Measures per risk, linked to Annex A
- Evidence per measure in the Declaration of Applicability
- Agreement of the risk owners on the residual risk
- Transfer, so that you can repeat the analysis yourself annually
Ready for the audit
Your risk analysis meets the clauses 6.1.2, 6.1.3 and 8.2 of the standard. Repeat the analysis every year, and also in the event of major changes such as a new core system, a takeover or a new important supplier.
Also the basis for the Cyber Security Act
Since August 15, 2026, the Cyber Security Act has applied to more than 8,000 organizations. The law requires measures based on a risk analysis, and managers must be able to assess the results. A risk analysis according to ISO 27001 lays the foundation for this.
Success story of Effectory
Feedback analytics developers with a team of more than 250 people
Months before a project with ISO 27001 and ISO 27701
New security measures implemented
Success during the external audit
The challenge
Effectory processes sensitive employee data for over 1,200 organizations. The challenge was to continuously strengthen the information security system and have it grow with the high demands of customers, without disrupting daily services.
The approach
In close collaboration, we have refined the management system for both ISO 27001 and ISO 27701. With a dedicated point of contact, responsibilities have been clearly defined, processes secured, and the organization prepared for the external audit to achieve certification.
The outcome
Within 6 months, Effectory achieved ISO 27001 certification without any bottlenecks. Security is now demonstrably in order for customers, security questionnaires are answered more quickly, and a solid, future-proof foundation is in place.
Nestor Security conducted the internal audits for both ISO 27001 and ISO 27701 for us. They really strike the right chord for us with a great combination of quality and feasibility. They are pragmatic, think along well with our needs, and the audits are well-organized.
Wouter BuzingCISO, Effectory
Where risk analyses are carried out on beaches during the audit
A risk analysis from a template is quick to create, but rarely convincing. Auditors immediately see whether the analysis applies to your organization, and whether each measure in the Declaration of Applicability can be traced back to a risk.
With a template
Quick to fill out, difficult to defend
Met Nestor Security
Recognizable, substantiated and repeatable
Need help with the rest of your ISMS too?
The risk analysis is often the first step. We also guide the full implementation, from a baseline assessment to certification, on average in 4 to 5 months.
Don't just take it from us
You are in good company with Nestor.
The communication lines with Nestor Security were short. The organization has a pragmatic mindset and is a down-to-earth party to do business with. As a result, the process went smoothly and fairly quickly.
We prefer to work together as much as possible regionally and like to hold meetings face-to-face. When you look at partners in the North, there are still a few left, and Nestor Security stands out above the rest.
Nestor Security has provided the internal audits of ISO 27001 and ISO 27701 for us. They really hit the mark for us with a good combination of quality and practicality. They are pragmatic, think well with our needs, and the audits are well-managed.
Your questions answered
FAQs
Do you work with software?
That is not necessary. We deliver the register in a format that you can manage yourself, such as Excel, or we work in the GRC tool that you already use. You are not dependent on a license to keep track of your own risk analysis.
What does ISO 27001 require from the risk analysis?
Clause 6.1.2 requires a documented process with criteria for risk acceptance and for performing the analysis. The results must be repeatable and comparable. For each risk, you identify an owner, estimate the probability and impact, and determine the risk level.
Clause 6.1.3 then requests a treatment plan and a Declaration of Applicability, with the agreement of the risk owners on the residual risk.
What is the Declaration of Applicability?
The Declaration of Applicability, also known as the VvT or Statement of Applicability, is a summary of all 93 measures from Annex A. For each measure, you specify whether it is applicable, why, and whether it has already been implemented.
Auditors use the VvT as a roadmap for their sampling, so the justification must be consistent with your risk analysis.
What determines the price of a risk analysis?
Especially the scope and the number of processes and systems we take on board. After the initial consultation, you will receive a fixed price, so you know in advance what to expect.
How much time does the risk analysis cost our team?
Especially the one-day workshop with management, IT, and the key process owners. In addition, we request a brief intake and an hour-long follow-up session. We will carry out the finalization.
How often do we need to perform the risk analysis?
With planned breaks, in practice at least annually, and in addition to major changes. Think of a new core system, a move to the cloud, or a new important supplier.
Because we define the method and criteria, you can perform that repetition yourself.
Can we use the risk analysis for NIS2 as well?
Yes. The Cyber Security Act requires measures that align with your risk analysis, and an analysis according to ISO 27001 is a good basis for this. We immediately incorporate the topics from the law, such as suppliers and incident reporting, into the workshop.
A risk analysis that convinces the auditor
Schedule a free consultation. You will receive a response within one business day and a fixed price after the consultation.
Schedule a no-obligation consultationSee what you get
Fixed price in advanceReady within three weeksAccording to ISO 27005