Establishing risk management framework

Text not public. The public view of the draft withholds this unit. The page states its position, what it asks the reader to prepare and the evidence an auditor samples. It does not state the clause text.

What it says, in our words

The public view does not carry this subclause. Its title places it first in the risk process, and the normative reference to ISO/IEC 27005:2022 tells the reader where the framework comes from. The preparation is to show that the framework you already have can take big data as an input: the risk criteria, the method, the roles and the reporting line.

What it means for an ISMS manager

Prepare the artefact this step produces rather than a summary of the step. The seven steps of the risk process are familiar to an ISMS manager, so the value here is the big data lens, not a new process. Take the characteristic that is most present in the estate and walk it through this step end to end. If the walk produces a row an auditor can sample, the preparation is real. If it produces a paragraph, it is not. When the published text arrives, read the subclause against the walk and record what it adds. The record on this site carries the change when it happens, and the watch sends the diff.

What an auditor samples

• The framework document or method the step refers to, with its owner and review date.
• One walked example, from the characteristic to the treated risk, in the organisation's own words.
• The record that shows the step was reviewed, not only performed.
• The reading note for the published subclause, with the date it was compared.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.