The international standard ISO/IEC 27005 is part of the ISO 27000 series of standards. In 2008 it was published by Joint Technical Committee JTC1 established by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its official title is "Information technology — Security techniques — Information security risk management".

ISO 27001 requires organisations to identify and assess IT security risks as well as to implement appropriate security controls. By complying with ISO 27005 you meet these requirements: ISO 27005 includes a description of the entire risk management process, the individual risk analysis steps, and information on establishing the process. However, ISO 27005 does not provide a specific risk management methodology; every organisation needs to define its own approach depending on the scope of the Information Security Management System (ISMS), the industry etc. Since ISO 27005 is to be used in conjunction with ISO 27001, certification is not possible.