Clause 8.2 Information security risk assessment
Clause 8.2 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Information security risk assessment. Risk assessments must be carried out at planned intervals and whenever significant changes are proposed or happen, using the criteria set in 6.1.2 a), and documented information on their results must be retained.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 8.2 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 8), in our words, not a statement of the standard and not binding on an assessor.
- A schedule of planned risk assessments and evidence they took place
- Assessments triggered by significant changes such as new systems, suppliers or reorganizations
- Retained results of each assessment
- Evidence the 6.1.2 a) criteria were applied