Does ISO 27001 mandate a specific risk assessment methodology?

Practitioners often mistakenly believe that a particular commercial tool or framework, such as OCTAVE, FAIR, or NIST SP 800-30, is explicitly required for ISO 27001 compliance. This is incorrect. The standard's flexibility means organisations must invest time in defining a methodology that genuinely fits their operational context, risk appetite, and regulatory obligations. This involves establishing clear criteria for risk acceptance, impact, and likelihood, and ensuring the methodology is consistently applied across all information assets. A poorly defined or inconsistently applied methodology will lead to an ineffective Information Security Management System (ISMS) and potential non-conformities during certification audits.

A common pitfall is adopting a generic risk assessment methodology without tailoring it to the organisation's specific threats, vulnerabilities, and business processes. This can result in a "tick-box" exercise that fails to identify genuine risks or prioritises irrelevant ones, wasting valuable resources. Another error is failing to document the chosen methodology comprehensively, including its scope, assumptions, and the roles and responsibilities for its execution. Without clear documentation, the methodology cannot be consistently applied, reviewed, or improved, hindering the ISMS's continuous improvement cycle and making it difficult to demonstrate conformity to auditors.