Key takeaways
- Perform risk assessments at planned intervals and when significant changes happen.
- Risks change.
- Start here: repeat risk assessments at planned intervals.
Purpose
Perform risk assessments at planned intervals and when significant changes happen.
Requirement
Requirement summaryThe organization shall perform information security risk assessments at planned intervals or when significant changes are proposed or occur, taking account of the criteria established in 6.1.2 a). The organization shall retain documented information of the results of the information security risk assessments.
Why it matters
Risks change. Regular reassessment keeps the ISMS current.
How to implement
- Repeat risk assessments at planned intervals.
- Reassess when significant changes occur.
- Keep records of results.
- Feed results into treatment.
What evidence you need to provide
Here is what you will typically need to provide for Clause 8.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your risk assessment schedule and triggers for extra assessments (such as big changes).
Records and examples to show
- Your latest risk assessment results, recorded in the risk register.
- Records of assessments done after significant changes.
Things you should be able to show or explain
- Be able to explain when the last assessment was done and why.
How much to show: The last two assessments.
Common mistakes
- Assessment not repeated.
- Big changes not assessed.
- Risk assessment done once at certification and never repeated.
- Changes not triggering reassessment.
- Tip: Re-run your risk assessment whenever something big changes, not just yearly.
Policies & documents to have
- Risk assessment and treatment methodology
- Risk Management Policy
FAQ
Can we exclude clause 8.2?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Assessments actually repeated and recorded.