1Why compare them?
A frequent training question is whether an EBIOS RM analysis complies with ISO 27005. Club EBIOS says yes. ISO/IEC 27005:2022 outlines cybersecurity risk management—context establishment, risk identification, analysis, evaluation, and treatment—and introduces a risk-assessment process consistent with ISO 31000, without prescribing a specific method. EBIOS RM supplies a compatible method that covers all these principles, using a compliance approach for non-deliberate risks and a scenario approach for deliberate risks.
2Table de correspondance du vocabulaire
A Rosetta Stone between the two terminologies:
| EBIOS RM | ISO 27005:2022 |
|---|---|
| Partie prenante | Interested party |
| Scope and security baseline | Context establishment |
| Strategic scenario | Event-based approach |
| Operational scenario | Supporting-asset approach |
| Feared event | Consequence |
| Intermediate event | Intermediate consequence |
| Business value | Bien primaire |
| Supporting asset | Supporting asset |
| Risk source | Risk source |
| Niveau de menace | Niveau de danger |
| PACS | Risk treatment plan |
| Impact | Consequence criteria |
| Security need | Security objective |
| Severity | Severity |
| — (not explicitly named) | Trigger |
3Process alignment
| ISO 27005:2022 | EBIOS RM | Compatibility |
|---|---|---|
| 1. Context establishment | Workshop 1 — scope and security baseline | Aligned except for likelihood: ISO recommends probability- or frequency-based scales, while EBIOS RM lets users choose their assessment method. |
| 2. Risk identification | Workshop 1 (feared events) + Workshop 2 (RS/TO pairs) + Workshop 3 (FE/RS/BV relationship) | Aligned, with two nuances: ISO includes unintentional sources, covered by the EBIOS RM baseline, and distinguishes attackers' short- and long-term objectives, which EBIOS RM does not separate. |
| 3–4. Risk analysis and evaluation | Workshop 2 (relevance) + Workshop 1 (severity) + Workshop 4 (likelihood) + Workshop 5 (acceptance matrix) | Fully aligned. |
| 5. Risk treatment | Workshop 5 — treatment options, CSIP, and residual-risk acceptance | Fully aligned—both prioritise risk reduction. |
| Communication | Integrated continuously into every workshop, not a separate activity | Aligned—EBIOS RM provides graphical reporting tools such as radar charts and scenario diagrams. |
| Surveillance & revue | Strategic and operational cycles | Not fully aligned—continuous monitoring is not directly implemented, although Club EBIOS add-ons are available. |
4Migrer depuis EBIOS 2010
For organisations that have already used EBIOS 2010 or MEHARI:
Reusable elements
Supporting assets, with attention to scope; essential assets, which become business values; and existing scales. The security framework incorporates the security baseline.
Partially reusable elements
Threat sources become risk sources; unintentional aspects are covered by the baseline. Feared events shift from automatic construction to a business-oriented expression.
Changement de vision
Collaboration expands to include decision-makers and business teams, deliverables become faster and more actionable, and continuous improvement is introduced. EBIOS 2010 identified simple, detailed risks; EBIOS RM builds complex, contextualised risks.