Control 6.1.2Information security risk assessment
Define and apply an information security risk assessment process that establishes and maintains risk criteria — including risk acceptance criteria and criteria for performing assessments — and that ensures repeated assessments produce consistent, valid and comparable results.
The process must identify risks associated with the loss of confidentiality, integrity and availability of information within the scope, identify the risk owners, analyse the risks by assessing consequences and realistic likelihood and determining levels of risk, and evaluate them by comparing against the criteria and prioritising for treatment. The results are retained as documented information.
Two requirements carry most of the weight in practice. Consistent, valid and comparable rules out an assessment that produces different answers depending on who runs it — the usual consequence of scales defined only by adjectives. And risk owners are identified, not the control owners: the person who owns the consequence, who is rarely in the security function and who has to be told they own it.
How to put this in place
A defined risk method is the foundation of the project, and it must be approved before any risk is scored. Scoring first and fixing the criteria later means scoring again.
- Decide the criteria: scales, risk acceptance levels and who may accept risk.
- Write the method so that repeated assessments give comparable results, and approve it before anyone scores a risk.
- Build the asset and service inventory for the scope, with owners.
- Assess risks with the owners and record results in a register.
- Have the risk owners review their scored risks and confirm the results.
Evidence an auditor usually looks for: the approved risk method, the asset inventory, and a risk register with dated results and named owners.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 2 (Assess risk) of the implementation plan, which sets out the work and the gate that closes the phase.
Statement of Applicability TemplateExcel
Each row records the risks that justify a control, and the SoA Approval sheet records the risk assessment the Statement rests on.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-03: the typical form, what auditors accept instead and the gaps they reliably find.
Certification Readiness Self-AssessmentExcel
A blocking item in the readiness assessment, which treats it as needing to be operating before a Stage 2 audit.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.