These activities could also be found in the related ISO 27005 standard, which describes a so-called information security risk management (ISRM) process. [7] have analyzed said standard along with 4 other standards and derived generic phases of information security (risk) management, which are listed in table 2.