Clause 6.1.2 Information security risk assessment
Clause 6.1.2 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Information security risk assessment. The organization must define and use a risk assessment process that sets and keeps risk criteria, covering both acceptance criteria and criteria for carrying out assessments; gives consistent, valid and comparable results when repeated; identifies, within the ISMS scope, the risks that come from information losing its confidentiality, integrity or availability, and names an owner for each; analyses them by judging potential consequences and realistic likelihood and deciding the level of risk; and evaluates them by comparing the analysis with the criteria and ranking them for treatment. Documented information about the process must be retained.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 6.1.2 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 6), in our words, not a statement of the standard and not binding on an assessor.
- A documented risk assessment methodology stating the criteria for accepting risk and the criteria for how assessments are carried out
- A risk register naming each risk, its owner, consequence, likelihood and resulting level
- Evaluation records comparing risk levels with the criteria and prioritizing treatment
- Evidence that repeated assessments use the same scales and give comparable results