ISO 27001:2022 Clause 8.2 Information Security Risk Assessment Explained

In this guide you will learn how to implement ISO 27001 Clause 8.2 Information Security Risk Assessment and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.

Key Takeaways

ISO 27001 Clause 8.2 requires organisations to execute the information security risk assessment process defined in Clause 6.1.2. While the earlier clause covers the planning and methodology, Clause 8.2 is about the operational “Do” phase. You must actively identify, analyse, and evaluate risks at planned intervals or whenever significant changes occur. This ensures that your understanding of the threat landscape remains current and that your controls are prioritised based on actual risk rather than guesswork.

FREE ISO 27001 Clause 8.2 Training Video

What is ISO 27001 Clause 8.2?

ISO 27001 clause 8.2 focuses on executing the Information Security Risk Assessment. While clause 6.1.2 covers the planning stages, 8.2 is about putting that plan into action. The standard requires organisations to define, implement, and actively carry out a risk assessment process. Crucially, this process must generate and maintain documented evidence of the assessment, typically through a risk register.

Definition

ISO 27001 defines ISO 27001 Clause 8.2 as:

The organisation shall perform information security risk assessments at planned intervals or when significant changes are proposed or occur, taking account of the criteria established in 6.1.2 a). The organisation shall retain documented information of the results of the information security risk assessments.

ISO 27001:2022 Clause 8.2 Information Security Risk Assessment

How to implement ISO 27001 Clause 8.2

Implementing ISO 27001 Clause 8.2 requires a structured approach to identifying and evaluating security threats. By following this 10-step framework, you ensure that your risk assessment process is consistent, valid, and produces comparable results that satisfy certification requirements.

1. Define the Risk Assessment Methodology

• Establish a formalised, repeatable framework for identifying and scoring risks.
• Ensure the methodology accounts for both the likelihood of occurrence and the potential impact on the business.
• Document the process within your Information Security Management System (ISMS) to ensure consistency across different departments.

2. Establish Risk Acceptance Criteria

• Define clear thresholds for what constitutes an acceptable level of risk for the organisation.
• Align these criteria with the board’s risk appetite and regulatory obligations.
• Use these benchmarks to decide which risks require immediate mitigation and which can be formally accepted.

3. Conduct Asset Identification and Valuation

• Populate a comprehensive Asset Register including hardware, software, and data assets.
• Assign asset owners who are responsible for the security and classification of each item.
• Identify the value of these assets in terms of Confidentiality, Integrity, and Availability (CIA).

4. Identify Threats and Vulnerabilities

• Identify potential threats to your assets, such as cyber attacks, physical theft, or accidental data loss.
• Assess technical vulnerabilities, including unpatched software, weak MFA configurations, or overly permissive IAM roles.
• Review previous security incidents and industry-specific threat intelligence to inform your findings.

5. Analyse Potential Impacts and Likelihood

• Evaluate the consequences of a threat exploiting a vulnerability, focusing on financial, legal, and reputational damage.
• Determine the likelihood of these events occurring based on current control effectiveness.
• Ensure that the impact analysis considers the specific operational context of each asset.

6. Calculate and Categorise Risk Levels

• Apply your chosen scoring system to determine the raw risk level for each identified threat.
• Categorise risks into tiers, such as Low, Medium, High, or Critical, to facilitate prioritisation.
• Validate that the calculated scores accurately reflect the reality of the technical environment.

7. Compare Risks Against Acceptance Criteria

• Review the calculated risk scores against the predefined acceptance thresholds.
• Identify any risks that exceed the organisation’s appetite and require formal treatment.
• Prioritise the remediation effort based on the severity of the gap between the actual and acceptable risk level.

8. Formulate the Risk Treatment Plan

• Select appropriate treatment options: mitigate, transfer, avoid, or accept the risk.
• Define specific technical or organisational controls to reduce risks to an acceptable level.
• Ensure every treatment action has an assigned owner and a clear deadline for implementation.

9. Document the Information Security Risk Assessment Report

• Compile all findings, scoring, and decisions into a formalised report.
• Provide evidence of the assessment for internal stakeholders and external ISO 27001 auditors.
• Store the report within a controlled document environment to maintain a clear audit trail.

10. Schedule Periodic Reviews and Trigger Events

• Set fixed intervals for regular risk reviews, typically annually or bi-annually.
• Define trigger events for ad-hoc assessments, such as major infrastructure changes or new service launches.
• Ensure that the risk assessment process is integrated into the management review cycle.