ISO 27005 maturity · Cybersecurity risk management
Your cyber risks, measured against ISO 27005 and costed into an action plan.
8 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 8 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
ISO 27005 maturity · Cybersecurity risk management
8 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One ISO/IEC 27005:2022 assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 8 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
It is this mechanism (a level, the next level, and the action linking the two) that turns an observation into a trajectory.
Are risk acceptance criteria defined and applied consistently?
- N1
No formalised criteria. Acceptance decisions are made case by case, with no common reference.
- N2
Criteria exist in a document, but they are little known and application varies across teams.
- N3
Criteria are documented, shared and generally applied. Deviations are occasional.
- N4
Criteria are applied systematically, acceptances are traced and validated at the appropriate level of authority.
- N5
Criteria are reviewed periodically as the context and incidents evolve, with documented tracking of revisions.
Action to move from L2 to L3
Share the acceptance criteria with all risk owners, embed them in the risk record template and check their application during the quarterly review.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon ISO 27005.
What this framework covers
ISO 27005 is the standard that accompanies ISO 27001 on one specific point: how to manage risks. Where 27001 sets the requirements of an information security management system, 27005 explains how to conduct the risk assessment and treatment that feed that system. It cannot be certified. It is applied.
That is precisely what makes it hard to steer. An organisation can claim to follow ISO 27005 without any evidence of how structured, repeatable and continuously improved its practices really are. Are risk acceptance criteria formalised, or decided case by case? Does the assessment cover the whole scope, or only the systems the security team knows well? Are treatment plans followed through, or do they stop at the register?
The 2022 revision also shifted the emphasis: less prescriptive method, more integration with enterprise risk management in the sense of ISO 31000. Concretely, cyber risk is no longer a topic for security experts but a component of overall risk, which must reach the executive committee in language non-technicians can understand. Many organisations have adopted the vocabulary without making that change.
A maturity diagnostic answers a different question from a compliance audit. The audit asks: is this compliant, yes or no. The diagnostic asks: what level of mastery are you at, and which precise actions take you to the next level.
In Datamensio, the framework is ready to use. You can also adapt it to your context: the AI adjusts themes, questions and levels, or builds a tailored variant from your own documents.
Reference standard: ISO/IEC 27005:2022
The themes assessed
Governance and risk management framework
Existence of a formal policy, definition of roles and responsibilities, articulation with corporate governance, resource allocation.
Context and scope definition
Scope of application, assessment criteria, risk acceptance criteria, consideration of interested parties.
Risk identification
Asset inventory, identification of threats and vulnerabilities, information sources used, frequency of reviews.
Analysis and evaluation
Chosen method and its consistency, evaluation of likelihood and impact, distinction between inherent and residual risk, prioritisation.
Risk treatment
Choice of treatment options, selection of measures, formalisation of the plan, acceptance of residual risks at the appropriate level of authority.
Communication and consultation
Reporting to stakeholders, escalation to the executive committee, awareness among business teams, language used.
Monitoring and review
Tracking risk evolution, indicators, triggering of reassessments, integration of incidents and threat intelligence.
Continuous improvement
Lessons learned, method updates, comparison over time, maturity of the framework itself.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Can ISO 27005 be certified?
No. It is a supporting standard that provides guidelines for risk management. Certification applies to ISO 27001, whose risk management framework 27005 feeds.
What is the difference between a maturity diagnostic and a compliance audit?
The audit checks the presence of requirements and concludes with a gap or a conformity. The maturity diagnostic places your practices on a progressive scale and shows the trajectory for improving. The two are complementary: the diagnostic prepares the audit, the audit validates.
How long does the assessment take?
The short version takes 20 to 30 minutes. The full version, in collaborative mode with several contributors, usually spans one to two weeks, most of the time being spent collecting input from the different teams.
Can the framework be adapted?
Yes. You can modify the questions and the levels, add your own themes or start from a blank base. You own the framework: a fundamental difference from tools that impose their grid.
How does this diagnostic relate to NIS2 or DORA?
These regulations impose risk management requirements that rest on the same principles. A solid ISO 27005 diagnostic is a reusable foundation. The transverse roadmap lets you cross the three without duplicating actions.
Do I need technical expertise to answer?
The questions cover management practices, not technical configurations. A risk manager or internal auditor can answer them. Some questions need input from a technical correspondent: collaborative mode lets you assign those questions to the right person.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models involved can be selected, including from European providers.