ISO27001 – Clause 8.2- Risk assessment

Clause 8.2 is one of the most important clauses in the standard, as it forms the basis for all other information security controls.

Risk management is the cornerstone of information security in any organization.

ISO 27001:2022 places particular emphasis on the importance of this notion through clause 8.2 – “Information security risk assessment”.

This specific section requires organizations to identify and assess their risks. (Please note that this is dealt with in the next clause 8.3).

Concept of risk analysis according to Clause 6.1.2

Risk analysis, as defined in clause 6.1.2, is the basis for information security risk assessment.

This analysis involves identifying potential risks that could compromise the security of the organization’s information, and assessing their severity.

We have defined the process above so that it is systematic and enables us to understand the nature of the risks, their origin, and their potential impact on the organization.

From theory to practice

One of the most critical aspects of clause 8.2 of ISO 27001:2022 is to carry out information security risk assessments in a planned and systematic way.

Whereas clause 6.1.2 laid the foundations for the development of the risk assessment method, clause 8.2 focuses on its practical implementation.

We’ve planned and written our method, now we need to do the risk analysis.

Frequency of risk assessment

Planning involves defining precise intervals for risk assessment, while remaining flexible to accommodate ad hoc assessments in response to significant changes within the organization.

This approach ensures that risk assessment is not only a recurring and regular exercise, but also sufficiently agile to adapt to changes in the organization and its internal and external environment.

So, when we talk about carrying out a new risk assessment in the event of any significant change within the organization, we mean, for example, the introduction of new information systems, changes in the threat environment, or structural modifications within the company.

That said, at the very least, risk analysis should be carried out once a year!

Retention of analysis results

Another fundamental aspect of clause 8.2 is the retention of risk analysis results.

This is not just a requirement for compliance reasons; it serves a more practical purpose of enabling the organization to track the evolution of risks over time, understand the effectiveness of the treatment measures put in place, and provide a basis for future assessments.

This historical information is useful for continually refining the organization’s approach to risk management.

Why is this so crucial?

Assessing information security risks is not a one-off task; it’s an ongoing process that requires constant vigilance and adaptation.

Clause 8.2 of ISO 27001:2022 recognizes this need by establishing a framework for systematic and repeated risk assessment. This enables organizations not only to respond to existing threats, but also to prepare for future challenges.

By implementing the guidelines in clause 8.2, organizations can ensure proactive risk management, thereby strengthening the security of their information and, by extension, their overall integrity and reputation. This is essential for any organization concerned with protecting its information assets in today’s complex and rapidly changing information security landscape.

Success criteria

To determine whether we have met clause 8.2 of ISO27001:2022, here are some questions an auditor might ask:

1. When was your last risk analysis and when is the next one planned?
2. How does the new risk analysis result compare with the last one performed?
3. Where are the risk analysis results from recent years stored?