Whom should an organization interview to obtain information regarding information security risks in their respective fields?

The ISO/IEC 27001 risk assessment process requires a comprehensive understanding of risks from all relevant perspectives. Interviewing all interested parties’ members, regardless of their expertise in information security, is crucial for a thorough risk identification. Employees in various roles (e.g., HR, finance, operations), managers, and even external stakeholders possess unique knowledge about the business processes, information assets they handle, and the practical threats or vulnerabilities in their specific domains. This inclusive approach ensures that the risk assessment is not limited to a purely technical viewpoint and captures a holistic picture of the organization's risk landscape, aligning with the standard's requirement to understand the organizational context and stakeholder needs (Clause 4.2).

A. This approach is too narrow and would lead to an incomplete risk register by ignoring operational and process-specific risks known only to non-security personnel.
B. This is also overly restrictive, as it excludes many asset owners and users whose input is vital for identifying vulnerabilities in day-to-day operations.

1. PECB. (2022). ISO/IEC 27001 Lead Implementer Training Course Material. Day 3, Module: "Planning an ISMS implementation based on ISO/IEC 27001," Section on Clause 6.1.2. The material emphasizes that risk identification is a collaborative effort requiring input from asset owners, process owners, and other managers, not just the information security team.

2. ISO/IEC 27005:2022, Information security, cybersecurity and privacy protection — Guidance on managing information security risks. Clause 8.3, "Risk identification." This clause outlines the process of identifying risk sources, events, and potential consequences. Effective execution requires gathering information from individuals knowledgeable about the assets and business processes, which extends beyond formal information security roles.

3. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers. Chapter 11, "Information security risk assessment," pp. 161-163. This text, often used in university curricula, explains that a key step in risk identification is to consult with a wide range of stakeholders, including users and asset owners, to create a comprehensive list of threats and vulnerabilities.