Key takeaways
- Define a repeatable risk assessment method, assess information security risks, choose treatment options and controls, compare against Annex A, and produce a Statement of Applicability and risk treatment plan.
- A defined, repeatable risk assessment method is the foundation of ISO 27001.
- Start here: define risk criteria, including acceptance criteria.
Purpose
Define a repeatable risk assessment method, assess information security risks, choose treatment options and controls, compare against Annex A, and produce a Statement of Applicability and risk treatment plan.
Requirement
Requirement summaryThe organization shall define and apply an information security risk assessment process that: a) establishes and maintains information security risk criteria that include: - 1) the risk acceptance criteria; and - 2) criteria for performing information security risk assessments; b) ensures that repeated information security risk assessments produce consistent, valid and comparable results; c) identifies the information security risks: - 1) apply the information security risk assessment process to identify risks associated with the loss of confidentiality, integrity and availability for information within the scope of the information security management system; and - 2) identify the risk owners; d) analyses the information security risks: - 1) assess the potential consequences that would result if the risks identified in 6.1.2 c) 1) were to materialize; - 2) assess the realistic likelihood of the occurrence of the risks identified in 6.1.2 c) 1); and - 3) determine the levels of risk; e) evaluates the information security risks: - 1) compare the results of risk analysis with the risk criteria established in 6.1.2 a); and - 2) prioritize the analysed risks for risk treatment. The organization shall retain documented information about the information security risk assessment process.
Why it matters
A defined, repeatable risk assessment method is the foundation of ISO 27001.
How to implement
- Define risk criteria, including acceptance criteria.
- Identify risks to confidentiality, integrity and availability, with owners.
- Analyse likelihood and consequence, then evaluate against criteria.
- Document the process and keep results.
What evidence you need to provide
Here is what you will typically need to provide for Clause 6.1.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your risk assessment method: how you identify risks, rate likelihood and impact, and decide which risks are acceptable.
Records and examples to show
- A completed risk register with an owner, rating and date for each risk.
- Proof the assessment was repeated, giving consistent results.
- Records of new risks added after changes.
Things you should be able to show or explain
- The risk owner should be able to explain how a risk was rated.
How much to show: A handful of risks.
Common mistakes
- No acceptance criteria.
- Risks with no owners.
- Methods that give different results each time.
- Risks with no owners.
- Tip: Your Statement of Applicability is the document auditors ask about most. Make it tidy!
Policies & documents to have
- Risk assessment and treatment methodology
- Risk Management Policy
FAQ
Can we exclude clause 6.1.2?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
A consistent method, risk owners, sensible results, and an SoA that justifies inclusions/exclusions.