ISO 27001 Readiness Checker
Answer 25 structured questions across six readiness areas and receive an indicative score.
Open ISO 27001 Readiness CheckerFree Website Tool
ISO 27001 Risk Score Calculator
Describe a risk, score likelihood and impact, consider existing controls and compare the residual risk using a transparent 5×5 method.
Tool summary
- Method
- Likelihood × Impact
- Assessments
- Inherent and residual
- Storage
- Current browser session
- Access
- Available free
Structured assessment
Build a consistent risk record
Work through five clear steps, then add the result to a professional session register.
Scoring methodology
Customize likelihood and impact labels, rating bands and the acceptance threshold.
Edit likelihood and impact labels
Likelihood
Impact
Step 1
Describe the Risk
Risk statement
Step 2
Assess Inherent Risk
Impact →
Likelihood →
Step 3
Consider Existing Controls
Step 4
Assess Residual Risk
Step 5
Treatment Decision
Session output
Risk Register
Build a working register for this browser tab.
| Risk | Owner | Inherent Risk | Existing Controls | Residual Risk | Treatment | Decision |
|---|
Practical guidance
Use risk scoring consistently
Likelihood × impact provides a transparent comparison method; ISO 27001 does not mandate this exact matrix. Define criteria appropriate to your context, record existing controls, and retain the judgement behind treatment and acceptance decisions.
How the calculation works
The tool multiplies a likelihood value from 1–5 by an impact value from 1–5. The resulting score ranges from 1–25 and is assigned to the rating bands shown in the methodology panel. You can change the labels, band limits and acceptance threshold to reflect an approved method; changing them affects interpretation, not the multiplication formula.
Worked before-and-after example
| Stage | Likelihood | Impact | Score | Decision evidence |
|---|---|---|---|---|
| Inherent risk | 4 — Likely | 5 — Severe | 20 | Administrator account compromise could expose a critical production service. |
| After existing controls | 2 — Unlikely | 5 — Severe | 10 | Phishing-resistant authentication, privileged access workflow and monitored administrative sessions reduce likelihood; impact remains severe. |
The numerical change is not proof that the controls work. Retain the scoring rationale, control evidence, owner decision, treatment action and review date. If the residual score exceeds the approved threshold, record treatment or authorised risk acceptance.