ISO 27001 clause 8.2: Performing security risk assessments
ISO 27001 clause 8.2 concerns performing information security risk assessments. Assess at planned intervals and when significant changes are proposed or occur, using the established criteria, and retain documented results. A well-written assessment method is insufficient if real changes bypass it or assessments are performed inconsistently.
What clause 8.2 requires in practice
Clause 8.2 asks the organisation to carry out information security risk assessments, not just to design a method for them. The assessments take place at planned intervals and also when significant changes are proposed or occur. They apply the criteria set earlier, in the risk assessment process established under clause 6.1.2 a, so results can be compared over time and across the business. The results are kept as documented information.
Two points are easy to miss. First, the trigger is not only the calendar: a new service, supplier, location or major system change can call for an assessment sooner than planned. Second, the clause concerns performing the assessment, whereas how risks are identified, analysed and evaluated is defined elsewhere. The output is a current, retained set of assessment results that shows which risks exist, who owns them and how serious they are judged to be, ready to feed treatment decisions.
Separate the method from its application
Clause 6.1.2 establishes the assessment process, including criteria and ownership. Clause 8.2 applies that process to the organisation’s actual situation. Results should support treatment and acceptance decisions, not merely show that a workshop took place.
Use current information about scope, services, information flows, dependencies and controls. Involve people who understand business consequences as well as technical exposure. An assessor working alone from last year’s asset list may miss changes in contracts, operations or responsibility even if the scoring formula is applied correctly.
Recognise significant changes early
Potential triggers include a proposed new service, major supplier change, acquisition, new operating location or important change in information processing. Define practical routes for such developments to reach the assessment process. The standard does not impose a single reassessment interval or a universal threshold that fits every organisation.
A proposed significant change matters before implementation as well as afterward. Assessing only once a service is live can remove options and leave treatment dependent on expensive rework. Equally, a planned periodic assessment remains useful for changes and trends that may not have triggered a separate project review.
Decide whether the change needs a focused assessment or a broader review. A targeted assessment can be appropriate if it considers relevant interfaces and consequences. Avoid treating every minor adjustment as a full-system exercise or, at the other extreme, using a narrow review to ignore affected dependencies.
Why risk assessment matters to the business
Risk assessment is the evidence base for every security investment. When it is stale, money goes to old problems while new exposures grow unnoticed. When it is repeated whenever the business changes, management can justify its spending, explain decisions to customers and see where attention is needed. Assessment results are also among the first documents a certification or customer assessor asks to see, and unchanged results after a major change draw immediate questions. Doing it well gives the business a shared view of what could harm it, helps owners accept risk knowingly and avoids the surprise of an incident in an area nobody reviewed.
How to implement clause 8.2
Treat assessment as a recurring business activity with clear triggers. One practical way to run it is shown below. Remember that the assessment is a business discussion, so plain language and real examples help owners take part and make better decisions.
- Confirm the criteria you will apply, including how likelihood, consequence and acceptability are judged, so results are comparable.
- Set a regular cycle, and agree the events that bring an assessment forward, such as new suppliers, products, sites or major incidents.
- Involve risk owners and people who know the process, rather than leaving assessment to a security specialist alone.
- Identify risks, analyse them using the agreed criteria and rank them for decision.
- Record the results in a form owners can read, including assumptions made and the owner of each risk.
- Compare results with the previous round to show what changed and why.
- Pass the outputs to the treatment process and retain them under document control.
Illustrative examples
The provider proposes remote delivery for part of a customer service. Before approval, it assesses information handling, authentication, supervision and service availability using its established criteria and relevant customer commitments. The resulting decisions are linked to the rollout rather than added to the register after staff have already moved.
The new provider will remotely access systems supporting production information. The organisation reassesses the exposure, ownership and dependencies, including the consequences of support failure. It compares results with the previous assessment and explains changes in risk, rather than interpreting a different assessor’s scoring style as a genuine reduction.
Evidence and comparability
Retain documented assessment results, including enough context to understand the assessed situation, criteria, evaluation and relevant decisions. A score without its rationale is hard to defend. Link material exposures to responsible owners and the treatment process.
When criteria change, preserve the ability to interpret earlier and later results. A lower score can reflect a changed scale rather than improved protection. Explain significant differences and avoid silently replacing historical records with the latest values. Evidence should help management understand the situation, not simply provide a green dashboard.
Common weaknesses
Typical failures include an annual review that ignores significant interim changes, assessments limited to confidentiality, missing business owners and results that never influence treatment. Another is marking risks “reviewed” without checking the information on which the previous assessment relied.
Connect assessment results to treatment implementation, objectives and management review. Where a significant change is rejected or revised because of the assessment, retain a clear account of that decision. The value lies in better choices, not in the number of rows produced.
Frequently asked questions
Is an annual risk assessment always enough?
No universal annual interval is prescribed. Assess at planned intervals and when significant changes are proposed or occur, considering your criteria and operating needs.
Must every change trigger a complete ISMS reassessment?
Not automatically. A focused assessment can be proportionate, provided it considers the relevant risks, interfaces and consequences using the established criteria.
What evidence should we retain?
Retain documented results that explain the assessed situation, evaluation and relevant decisions. Scores should be understandable and connected to owners and treatment rather than isolated numbers.
Refresh assessments when the exposure changes
Talk to Sterling to reassess a new service or significant change using your established risk criteria, rather than merely updating a register date. Build the relevant knowledge through Risk Management at Sterling Academy. We can also assess whether Effivity ISO & GRC automation software suits the agreed workflow and programme. Certification decisions remain with an independent certification body.