Information security risk assessment

Plain-language summary

Actually performing the risk assessment defined in 6.1.2 — at planned intervals and whenever significant change is proposed or happens — and keeping the results.

What the clause is really asking

Clause 6.1.2 defines the method; 8.2 requires you to run it. The assessment must be performed at planned intervals (most organisations choose annually) and when significant changes are proposed or occur — a new system, a new site, a new supplier handling your data, a merger, a major incident, a new threat such as a ransomware campaign in your sector, or a change in law. It must use the criteria from 6.1.2 so results stay comparable across cycles, and documented information of the results must be retained. The clause exists to stop the risk register being a certification artefact: a register dated three years ago with no revisions is the clearest signal an auditor sees that the ISMS is not operating. Incidents and audit findings are the richest source of new or re-scored risks, and a mature ISMS shows them flowing into the register within weeks.

What auditors look for

Auditors look at dates and triggers. When was the assessment last run in full, what changed between cycles, and which events triggered interim assessments? They pick a significant change from the year — the new cloud platform, the office move, the big incident — and ask to see the risk assessment that followed it. They compare the current register with the previous version to see risks added, re-scored or retired, and check the scores were produced with the 6.1.2 criteria rather than re-estimated by feel. They also look for the assessment being an input to management review.

Typical evidence

Dated risk assessment results for each cycle (versions of the risk register or assessment reports); records of interim assessments triggered by change or incidents; a defined review interval and a list of change triggers; evidence the results fed treatment (8.3) and management review (9.3.2); risk owner participation records.

How to comply — recommendations

Diarise the full assessment annually, ideally two months before management review so results are fresh for it. Write the change triggers into the method and into the change-planning form from 6.3 so a significant change automatically raises the question 'does this need a risk assessment?' After every incident and every internal audit, spend thirty minutes updating the register — new risks, changed scores, retired risks — and version it. Keep each year's register as a dated file; the comparison between versions is the evidence the auditor wants.

Common nonconformities

Risk assessment performed once for certification and never repeated; no defined interval; significant changes (new systems, suppliers, incidents) not followed by reassessment; results not retained or earlier versions overwritten; scores produced without reference to the 6.1.2 criteria; results not used in management review.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.