ISO 27005 Risk Management: Set Your Risk Criteria and Appetite (Free Template)

Two people score the same risk. One says high, the other says medium, and neither is wrong, because nobody wrote down what "high" means. In this episode we write those rules for one fictional company: a scope, an impact scale, a likelihood scale, a 5x5 matrix with four bands, and an acceptance rule that says who can say yes. First in a plain spreadsheet, then in GRCompliance, and we count every keystroke, click and tab switch. Standards: ISO 31000:2018 (clause 6.3.4), ISO/IEC 27005:2022 (clause 6.4) and ISO/IEC 27001:2022 (clause 6.1.2). Free risk criteria template (5 tabs: Scope, Impact, Likelihood, Matrix, Acceptance): https://drive.google.com/file/d/14Lsg... Measured in this episode Spreadsheet: 1,573 keystrokes, 66 clicks, 8 tab switches GRCompliance (rules already entered): 11 clicks, 0 keystrokes, 0 tab switches This walkthrough uses GRCompliance Premium. Chapters 0:00 Nobody wrote down what "high" means 0:34 ISO 31000, ISO 27005 and ISO 27001 1:43 Our fictional company: LaTorre LTD 1:54 Spreadsheet: scope and context 2:54 Spreadsheet: the impact scale 4:07 Spreadsheet: the likelihood scale 4:56 Spreadsheet: the matrix and four bands 6:06 Spreadsheet: acceptance criteria and tolerances 7:10 The same rules in GRCompliance (demo, read-only) 8:20 Scoring a risk with the shared scales 8:56 Recap and next episode GRCompliance-Core is free and self-hosted: https://github.com/Sectutor/GRComplia... LaTorre LTD is a fictional company. Series: Risk management, done for real.