Information security risk assessment

What the requirement asks

Risk assessments must be carried out at planned intervals and whenever significant changes are proposed or happen, using the criteria set in 6.1.2 a), and documented information on their results must be retained.

What the guidance adds

The risk assessment is expected to run at planned intervals and when significant change is proposed. The guidance asks for the trigger, the method, the result and the link to treatment. An assessment that is refreshed only for the audit is a snapshot, not a process.

What good looks like

Keep A schedule of planned risk assessments and evidence they took place with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• Operational risk assessmentA schedule of planned risk assessments and evidence they took place
• Operational risk assessmentAssessments triggered by significant changes such as new systems, suppliers or reorganizations
• Operational risk assessmentRetained results of each assessment
• Operational risk assessmentEvidence the 6.1.2 a) criteria were applied

The question an assessor will ask

An assessor will ask for A schedule of planned risk assessments and evidence they took place. The test for 8.2 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• Assessments happen only annually and ignore significant changes
• Results are overwritten rather than retained
• Different criteria are used from those defined
• Change triggers are not defined

Before the next audit

Before the next audit, test this against one live record: assessments happen only annually and ignore significant changes.