How to perform compliance risk assessments using ISMS Copilot

Overview

You'll learn how to use ISMS Copilot to conduct comprehensive information security risk assessments aligned with ISO 27001, SOC 2, and other compliance frameworks, from defining methodology through identifying risks, evaluating impacts, and creating risk treatment plans.

Who this is for

This guide is for:

• Security professionals conducting annual risk assessments

• Compliance officers managing risk assessment programs

• Organizations preparing for ISO 27001 or SOC 2 audits

• Risk managers implementing formal risk assessment processes

• Consultants performing client risk assessments

Prerequisites

Before starting, ensure you have:

• An ISMS Copilot account (free trial available)

• Understanding of your organization's information assets and data flows

• Access to system architecture documentation

• Stakeholder availability for risk workshops and validation

Before you begin

Understanding risk assessment fundamentals

Risk assessment vs. risk management

Clarify the terminology:

• Risk assessment: The process of identifying, analyzing, and evaluating risks

• Risk treatment: Selecting and implementing measures to modify risks

• Risk management: The complete process including assessment, treatment, monitoring, and review

Key risk concepts

Understand the building blocks:

• Asset: Anything of value to the organization (data, systems, people, reputation)

• Threat: Potential cause of an unwanted incident (ransomware, insider threat, natural disaster)

• Vulnerability: Weakness that can be exploited by a threat (unpatched software, weak passwords)

• Likelihood: Probability that a threat will exploit a vulnerability

• Impact: Consequence if a risk materializes (financial loss, regulatory penalty, reputation damage)

• Risk: Combination of likelihood and impact (often calculated as Risk = Likelihood × Impact)

• Risk owner: Person accountable for managing a specific risk

Framework requirements

Different frameworks have specific risk assessment requirements:

Step 1: Set up your risk assessment workspace

Create dedicated workspace

1. Log into ISMS Copilot

2. Create new workspace: "Risk Assessment [Year] - [Your Organization]"

3. Add custom instructions:

Risk assessment context:

Organization: [Company name]
Industry: [SaaS, healthcare, fintech, manufacturing, etc.]
Size: [employees, revenue, locations]
Compliance framework: [ISO 27001, SOC 2, NIST, GDPR, multiple]

Information assets:
- Customer data: [types and sensitivity]
- Systems: [critical applications and infrastructure]
- Intellectual property: [products, algorithms, trade secrets]
- Operations: [key business processes]

Risk appetite:
- Regulatory tolerance: [zero tolerance for compliance violations]
- Financial: [maximum acceptable loss per incident]
- Reputation: [brand protection priorities]
- Operational: [acceptable downtime/disruption]

Assessment approach:
- Method: [asset-based, scenario-based, hybrid]
- Risk calculation: [qualitative, quantitative, semi-quantitative]
- Review frequency: [annual, quarterly for high risks]

Preferences:
- Provide practical, framework-aligned guidance
- Reference specific ISO 27001 clauses or SOC 2 criteria
- Suggest realistic threat scenarios for our industry
- Help prioritize based on actual risk, not just compliance boxes

Step 2: Define your risk assessment methodology

Document risk identification approach

Ask ISMS Copilot to help create your methodology:

"Create a risk assessment methodology document for ISO 27001 compliance. Include: methodology purpose and scope, how information assets will be identified, how threats and vulnerabilities will be identified (threat catalogs, vulnerability databases, historical incidents), how risk owners will be assigned, and stakeholder consultation approach."

Define risk evaluation criteria

Create your likelihood and impact scales:

"Define 5-level likelihood and impact scales for information security risk assessment at a [company description]. For likelihood: define levels 1-5 with probability ranges and descriptive criteria. For impact: define levels 1-5 considering financial loss, operational disruption, regulatory penalties, and reputation damage. Provide examples for each level specific to [industry]."

Example output to expect:

Create risk calculation matrix

Define how risk scores are calculated:

"Create a 5×5 risk matrix showing risk scores from likelihood × impact. Color-code risk levels: Low (green, scores 1-6), Medium (yellow, scores 8-12), High (orange, scores 15-16), Critical (red, scores 20-25). This will determine risk treatment priorities."

Establish risk acceptance criteria

Define your organization's risk appetite:

"Define risk acceptance criteria for our risk assessment methodology. For risk levels (Low, Medium, High, Critical), specify: which can be accepted as-is, which require treatment plans, which require executive approval, and which are unacceptable. Consider our [regulatory requirements, industry, customer expectations]."

Step 3: Identify and inventory information assets

Create asset inventory

Start with a comprehensive asset list:

"Create an information asset inventory template for risk assessment including columns: Asset ID, Asset Name, Asset Category (data, system, service, people, facility), Description, Owner, Custodian, Users, Classification (public, internal, confidential, restricted), Location, Dependencies, and Business Criticality. Provide example entries for a [company type]."

Categorize assets

Organize assets logically:

"For our [SaaS platform / healthcare system / fintech application], categorize information assets into: customer/client data, employee data, intellectual property, business systems (CRM, finance, HR), infrastructure (servers, network, cloud), physical assets, and third-party services. For each category, list typical examples relevant to our business."

Classify assets by criticality

Not all assets have equal importance:

"Define asset classification criteria based on: confidentiality requirements (public to highly restricted), integrity requirements (data accuracy criticality), availability requirements (acceptable downtime), and business criticality (impact if compromised or unavailable). Create a classification scheme with 3-4 levels and examples for each."

Upload existing documentation

Leverage what you already have:

1. Upload system architecture diagrams, data flow diagrams, or asset inventories (PDF, DOCX)

2. Ask: "Review this system architecture and extract information assets for risk assessment. Identify: data stores, applications, infrastructure components, third-party integrations, and critical business processes. Create an initial asset inventory from this documentation."

Step 4: Identify threats and vulnerabilities

Identify relevant threats

Use AI to generate threat scenarios:

"For a [industry] organization, identify information security threats across categories: cyber threats (ransomware, phishing, DDoS, data breaches, insider threats), physical threats (fire, flood, theft, unauthorized access), environmental threats (power outage, HVAC failure), human threats (errors, negligence, malicious insiders), and third-party threats (supplier breach, cloud provider outage). Prioritize by relevance to our industry."

Asset-specific threat analysis

For each critical asset, identify applicable threats:

"For our customer database containing [data types], identify specific threats: unauthorized access scenarios, data exfiltration methods, data corruption risks, availability threats (deletion, encryption, system failure), and insider threat scenarios. For each threat, describe: attack vector, threat actor type, and typical motivation."

Identify vulnerabilities

Map vulnerabilities to threats:

"For our environment [describe infrastructure, technology stack], identify common vulnerabilities: technical vulnerabilities (unpatched systems, misconfigurations, weak encryption), process vulnerabilities (lacking procedures, inadequate reviews), physical vulnerabilities (facility access weaknesses), and human vulnerabilities (insufficient training, social engineering susceptibility). Reference CVE databases and OWASP Top 10 where applicable."

Consider industry-specific threats

Get context-aware threat intelligence:

"What are the most significant information security threats facing [healthcare / financial services / SaaS / manufacturing] organizations in 2024-2025? For each threat, provide: prevalence data, typical attack patterns, real-world incident examples, and why this industry is targeted. Prioritize by likelihood and impact."

Step 5: Assess existing controls

Inventory current controls

Document what protections exist:

"We currently have these security controls: [list policies, technical controls, tools, procedures]. Categorize them by: preventive controls (stop incidents from occurring), detective controls (identify when incidents occur), corrective controls (restore normal operations), and deterrent controls (discourage threat actors). Assess their effectiveness."

Evaluate control effectiveness

Controls on paper don't equal working controls:

"For each control [access reviews, encryption, backups, security awareness training], define criteria to assess effectiveness: Is it implemented as designed? Is it operating consistently? Is there evidence of operation? Does it adequately address the risk? Create an effectiveness rating scale (Not Implemented, Partially Effective, Largely Effective, Fully Effective)."

Identify control gaps

Find where protection is missing:

"For these identified threats [list key threats], map them to our existing controls [list controls]. Identify: threats with no controls (unmitigated), threats with inadequate controls (partially mitigated), and threats with multiple overlapping controls (defense in depth). Highlight control gaps requiring new controls."

Step 6: Evaluate likelihood and impact

Assess likelihood with existing controls

Consider current protections when evaluating likelihood:

"For the threat of [ransomware attack on production systems], assess likelihood considering our existing controls: endpoint protection, email filtering, MFA, backups, security awareness training, network segmentation. Using our 1-5 likelihood scale, what rating is appropriate? Provide rationale referencing control effectiveness."

Evaluate impact scenarios

Quantify potential consequences:

"If [customer database containing PII] was compromised through [unauthorized access], assess impact across dimensions: Financial (breach response costs, regulatory fines, lost revenue), Operational (system downtime, resource diversion), Regulatory (GDPR penalties, regulatory scrutiny), and Reputation (customer trust, brand damage, media coverage). Using our 1-5 impact scale, provide ratings with justification."

Consider multiple scenarios

Risk impacts vary by scenario:

"For our [backup system], evaluate impact of different scenarios: 1) Backups fail during normal operations (discovered during testing), 2) Backups fail and we need to recover from ransomware, 3) Backups are compromised by attacker. For each scenario, assess impact level and explain why they differ despite involving the same asset."

Step 7: Calculate and prioritize risks

Calculate risk scores

Apply your methodology consistently:

"Using our risk matrix (Likelihood × Impact), calculate risk scores for these scenarios: [list 5-10 identified risks with their likelihood and impact ratings]. For each, provide: risk calculation, risk level (Low/Medium/High/Critical), and priority ranking. Show your work."

Create risk register

Document all assessed risks:

"Create a risk register template including columns: Risk ID, Risk Description, Related Asset(s), Threat, Vulnerability, Existing Controls, Likelihood (1-5), Impact (1-5), Inherent Risk Score, Control Effectiveness, Residual Risk Score, Risk Level, Risk Owner, Treatment Decision (Accept/Mitigate/Transfer/Avoid), Treatment Status. Populate with example entries from our assessment."

Prioritize for treatment

Not all risks need immediate action:

"From our risk register, prioritize risks for treatment planning. Consider: risk score, cost of treatment vs. cost of impact, regulatory requirements, customer expectations, trend (increasing or decreasing), and treatment complexity. Create a prioritized treatment backlog with rationale for sequencing."

Step 8: Develop risk treatment plans

Select treatment options

For each risk, choose the appropriate response:

"For these high and critical risks [list risks], recommend treatment strategy: Mitigate (implement additional controls to reduce likelihood or impact), Accept (document acceptance with justification), Transfer (insurance, outsourcing), or Avoid (eliminate the activity causing the risk). For mitigation, suggest specific controls with cost-benefit analysis."

Design mitigation controls

Specify concrete actions:

"For the risk of [unauthorized access to production databases], current controls are [list existing controls], residual risk is High (score 15). Design a mitigation plan including: additional controls to implement (technical and procedural), implementation timeline, resource requirements, responsible party, expected risk reduction (target residual risk level), and implementation cost estimate."

Create treatment roadmap

Sequence risk treatment initiatives:

"From our risk treatment plans, create an implementation roadmap for the next 12 months. Organize by: Quick wins (0-3 months, low effort/high impact), Strategic initiatives (3-6 months, significant investment), Long-term projects (6-12 months, complex or costly). For each initiative, specify: risks addressed, controls to implement, dependencies, resource needs, and success criteria."

Step 9: Map risks to compliance controls

ISO 27001 control mapping

Link risks to Annex A controls:

"For these identified risks [upload or list risks], map them to ISO 27001:2022 Annex A controls that would mitigate them. Create a mapping showing: Risk ID, Risk Description, Applicable Control(s) (e.g., A.8.2, A.8.23), Control Objective, and how the control reduces likelihood or impact. This will support our Statement of Applicability."

SOC 2 criteria alignment

Connect risks to Trust Services Criteria:

"Map our risk assessment results to SOC 2 Common Criteria. For each risk category [access control risks, change management risks, availability risks, etc.], identify: relevant Common Criteria control objectives (CC1-CC9), specific controls that address the risk, and what evidence demonstrates risk mitigation. This supports our SOC 2 system description."

Justify control selection

Demonstrate risk-based approach:

"For our Statement of Applicability, document why we selected these ISO 27001 controls [list controls]. For each control, reference: which identified risks it addresses (Risk IDs), risk scores before the control, expected risk reduction, and why this control is appropriate for our context. This proves control selection is risk-driven, not arbitrary."

Step 10: Document and communicate findings

Create executive summary

Report to leadership:

"Create an executive risk assessment summary for leadership including: assessment scope and methodology, total risks identified by level (Critical: X, High: Y, Medium: Z, Low: W), top 10 risks requiring immediate attention, key risk themes or patterns, recommended treatment investments, residual risk after planned treatments, and comparison to previous assessments (if applicable). Target: 2-page executive overview."

Develop technical risk report

Detailed findings for practitioners:

"Create a comprehensive risk assessment report including: executive summary, methodology documentation, asset inventory, threat and vulnerability analysis, risk evaluation results, complete risk register, risk heat map visualization, treatment recommendations with cost estimates, implementation roadmap, and appendices (likelihood/impact scales, control catalog). Format for ISO 27001 audit submission."

Present to stakeholders

Communicate to different audiences:

"Create three versions of risk assessment communication: 1) C-level presentation (5 slides: key findings, top risks, budget ask), 2) Technical team briefing (control implementation details, responsibilities), 3) Board risk committee report (governance, risk appetite alignment, oversight requirements). Tailor messaging and detail level for each audience."

Step 11: Plan monitoring and review

Establish risk monitoring

Risks change over time:

"Design a risk monitoring program including: which risk indicators to track (threat intelligence, incident frequency, control failures, vulnerability scan results), monitoring frequency (continuous, monthly, quarterly), triggers for reassessment (new threats, major changes, significant incidents), reporting schedule to management, and responsibility assignments."

Schedule periodic reviews

Keep the risk assessment current:

"Create a risk review calendar: annual comprehensive reassessment (ISO 27001 requirement), quarterly reviews of high and critical risks, monthly threat intelligence updates, ad-hoc reviews triggered by [major system changes, new regulations, significant incidents, M&A activity]. Document review procedures and deliverables for each review type."

Track risk treatment progress

Ensure plans become reality:

"Design a risk treatment tracking mechanism including: treatment plan status (Not Started, In Progress, Completed), milestones and deadlines, blockers or issues, budget consumption, risk score reduction achieved, and expected completion dates. Create dashboard format for monthly management reviews."

Common risk assessment mistakes

Next steps after risk assessment

You've completed your compliance risk assessment:

• ✓ Risk methodology documented and approved

• ✓ Information assets identified and classified

• ✓ Threats and vulnerabilities cataloged

• ✓ Existing controls evaluated

• ✓ Risks assessed with likelihood and impact scores

• ✓ Risk register created and prioritized

• ✓ Treatment plans developed

• ✓ Findings documented and communicated

• ✓ Monitoring and review processes established

Continue with implementation:

• Use risk treatment plans to guide control implementation

• Update Statement of Applicability with risk justifications

• Begin collecting evidence of risk monitoring and treatment

• Schedule quarterly risk reviews for high and critical risks

Getting help

• Upload documentation: Learn how to upload system diagrams and documentation for asset identification

• Verify risk scenarios: Understand how to prevent AI hallucinations when validating threat intelligence

• Best practices: Review how to use ISMS Copilot responsibly for risk assessment quality