Control 8.2Information security risk assessment
Perform information security risk assessments at planned intervals, or when significant changes are proposed or occur, taking account of the criteria established in 6.1.2. Retain documented information of the results.
The distinction between this clause and 6.1.2 is the distinction between designing a process and running it. 6.1.2 requires a defined process producing consistent, comparable results; 8.2 requires it to be applied, repeatedly, and at the right moments.
“When significant changes are proposed or occur” is the trigger organisations implement least well. An annual assessment satisfies “planned intervals” and misses the point: a new product line, an acquisition, a migration to a new platform, a major supplier change each alter the risk picture, and an assessment that catches up with them twelve months later informed no decision.
Note that the change trigger includes proposed changes. The assessment is meant to inform the decision, not to document it afterwards.
How to put this in place
The risk assessment must be repeated, not done once. Changes and time make an old assessment misleading.
- Set the intervals for reassessment and the events that trigger it.
- Repeat the assessment using the approved method.
- Compare results with earlier ones and with the criteria.
- Record dated results with owners.
- Report changes to risk owners and the management review.
Evidence an auditor usually looks for: dated assessment results at the planned interval and after significant changes.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 2 (Assess risk) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-11: the typical form, what auditors accept instead and the gaps they reliably find.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.