ISO 31000 gives guidelines for managing any kind of risk, and an organization cannot be certified to it. ISO/IEC 27001 sets the requirements for an information security management system, and an organization can be certified to it. ISO/IEC 27005 links the two by applying risk guidance to information security.
| Topic | ISO 31000 | ISO/IEC 27001 |
|---|---|---|
| What it is | Guidelines for managing any kind of risk | Requirements for an information security management system |
| Certifiable | No. ISO says it cannot be used for certification | Yes. Organizations can be certified |
| Edition | Edition 2, February 2018 | Edition 3, October 2022 |
| Best for | One risk language across the organization | A certifiable information security program |
How they fit together
ISO 31000 is the general method for thinking about risk: set the context, assess, treat, monitor and communicate. ISO/IEC 27001 is a management system for information security, and risk is a core input to it. ISO/IEC 27005:2022 supports the concepts in 27001 and adapts ISO 31000 guidance for information security risk, which is why it is the natural bridge.
Practitioner note: Teams sometimes ask which one to implement. They are not alternatives. If a customer wants a certificate for information security, that is ISO/IEC 27001. If you want one risk language across security, finance, operations and projects, that is ISO 31000. For the wider comparison, including COSO ERM and NIST, read the framework comparison.