ISO/IEC 27004 is about measuring whether the management system and its controls are working. ISO/IEC 27005 is about managing information security risk. Measurement can inform risk decisions, and risk treatment can supply the measures, but the two standards answer different questions.
The short answer, expanded
ISO/IEC 27004 is about measuring whether the management system and its controls are working. ISO/IEC 27005 is about managing information security risk. Measurement can inform risk decisions, and risk treatment can supply the measures, but the two standards answer different questions.
What to do next
The free check turns this answer into a dated reading for your organization. The register gives you the clause or measure behind the answer. If the question is about a customer or a tender, answer with the requirement standard and the certificate, not with a draft.
Run the free check Open the register
Related questions
Do I need both?
27005 is the risk method. 27004 is the measurement method. Most certified organizations need both, under different clauses.
Does 27004 replace 27005?
No. Measurement does not replace risk assessment or treatment.
Where do they meet?
In the risk treatment plan and the effectiveness measures that show whether the treatment worked.