Information security risk assessment

What the requirement asks

The organization must define and use a risk assessment process that sets and keeps risk criteria, covering both acceptance criteria and criteria for carrying out assessments; gives consistent, valid and comparable results when repeated; identifies risks from loss of confidentiality, integrity and availability of information within the ISMS scope and names their risk owners; analyses them by judging potential consequences and realistic likelihood and deciding the level of risk; and evaluates them by comparing the analysis with the criteria and ranking them for treatment. Documented information about the process must be retained.

What the guidance adds

The risk assessment is expected to be repeatable. The guidance asks for a defined process, consistent criteria, named risk owners, an understanding of consequences and a record of the result. Two teams assessing the same asset should reach a comparable answer, or the method is not defined.

What good looks like

Keep A documented risk assessment methodology with risk acceptance criteria and criteria for performing assessments with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• Risk assessment methodologyA documented risk assessment methodology with risk acceptance criteria and criteria for performing assessments
• Risk assessment methodologyA risk register naming each risk, its owner, consequence, likelihood and resulting level
• Risk assessment methodologyEvaluation records comparing risk levels with the criteria and prioritizing treatment
• Risk assessment methodologyEvidence that repeated assessments use the same scales and give comparable results

The question an assessor will ask

An assessor will ask for A documented risk assessment methodology with risk acceptance criteria and criteria for performing assessments. The test for 6.1.2 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• Acceptance criteria are undefined, so acceptance is decided case by case
• Risks lack named owners
• The method changes every year, so results cannot be compared
• Risks are identified for assets but not tied to loss of confidentiality, integrity or availability

Before the next audit

Before the next audit, test this against one live record: acceptance criteria are undefined, so acceptance is decided case by case.