How to score Copilot risk under ISO 31000

A European board does not need Copilot mapped to every framework as a slogan. It needs four artefacts that share a score: a process (ISO 31000), a legal duty (GDPR), an operational profile (NIST CSF 2.0), and an ISMS risk assessment plus SoA (ISO/IEC 27001:2022). This scan produces those from 25 answers. It does not certify them.

ISO 31000:2018 — process, not a logo

Identify the Copilot risks, analyse them from your answers, evaluate against an EU residency appetite, treat with a dated 90-day plan, then monitor through a named owner. Four enterprise risks sit on that spine: extra-EU processing, disclosure through Copilot, accountability failure, and unbounded expansion. Inherent is High on all four. Current is what you answered. Residual is what remains if the plan is executed — not what you hope remains.

NIST CSF 2.0 — Current vs Target, not a maturity colour

The Organizational Profile is a Community Profile for Copilot. Govern, Identify and Protect are core. Detect and Respond are partial. Recover is out of scope — a blank Recover cell is not a fail. Current vs Target is shown at category level with an implementation tier (1–4) and a gap list. It is not a full-enterprise Current Profile and not a certification.

ISO/IEC 27001:2022 Clause 6.1 — risk assessment, then treatment

Clause 6.1.2 requires defined, comparable, repeatable criteria. This scan publishes three matrices on the same 5×5 scale: the score lookup (every cell is likelihood × impact with a band), current positions, and residual positions after a 90-day plan. Likelihood and impact are automated from the 25 answers: L = 1 + round(4 × weighted control-gap) for that scenario’s questions; I = inherent floor + 1 per open impact driver. Residual re-runs the same engine with treatment questions closed. There is no analyst override. Score 1–4 Low, 5–9 Medium, 10–16 High, 17–25 Critical. Six Copilot scenarios cover extra-EU processing, disclosure through Copilot, evidential integrity, unbounded expansion, privileged identity, and Microsoft as an ICT supplier whose defaults move residual risk.

Clause 6.1.3 is treatment: Avoid, Modify, Share or Retain, compared with Annex A, then residual. Share is not used — you remain controller. Residual is not accepted until the risk owner signs in the ISMS. High and Critical on extra-EU processing and oversharing sit outside the default European appetite.

ISO/IEC 27001:2022 — Statement of Applicability, not a logo

Annex A is a catalogue of safeguards. A CISO does not need Copilot mapped to “ISO 27001” as a slogan. They need a SoA extract: which controls apply to Copilot, whether they are implemented, partial or not implemented, and what is deliberately not applicable.

This scan can evidence organizational and technological safeguards — suppliers and cloud (A.5.19, A.5.21, A.5.23), classification and labelling (A.5.12–13), access and authentication (A.5.15, A.5.17, A.8.2, A.8.5), DLP (A.8.12), logging (A.8.15), privacy (A.5.34). Physical (A.7), backup, cryptography and secure development are not in the Copilot SoA. A blank A.7 cell is not a fail.

Paste the SoA table into the ISMS. Do not treat a self-assessment score as an audit finding or a certificate.

Inherent, current, residual

Inherent risk for Copilot is High on all four board risks. The product can leave the EU Data Boundary, it can see everything a user can already open, and Microsoft will keep changing defaults. Current risk is what your configuration and paperwork actually are. Residual risk is what remains if you execute a dated treatment plan — not what you hope remains.

The scanner is still a self-assessment. It does not certify ISO 31000, ISO 27001 or GDPR. It groups your 25 answers into four board risks (ISO 31000), six ISMS scenarios (Clause 6.1), a CSF 2.0 Current vs Target profile, and a Copilot-scoped ISO 27001 SoA so you can paste, not retype.