In this article the results obtained by the analysis of the plan of a Management System Information Security (ISMS) phase according to the ISO / IEC 27001 are highlighted, with their respective implementation guide ISO / IEC 27003, compared to development and adapting COBIT 5 as the risk methodology, using the APO12 process, particularly in the risk assessment phase; then a model for the conformity of the proposed standard.