After reading, you can see what clause 6.1.2 really asks for and prepare the evidence a certification auditor will look at.
Definition
Clause 6.1.2 asks for risk acceptance criteria and for criteria on how assessments are performed. The results must be consistent, valid and comparable, and the risks considered are those to the confidentiality, integrity and availability of information within the scope of the management system.
The standard imposes no method, and since its 2013 edition you are no longer obliged to start from a list of assets. ISO/IEC 27005 offers guidance on how to do the work.
Why it matters
The rest of the management system hangs on this work. The choice of Annex A controls, the Statement of Applicability and the treatment plan all follow from its results, and that is why auditors look at it so early.
How it works
Have the criteria defined and approved first. Within the scope, identify the risks to confidentiality, integrity and availability, and name an owner for each.
Assess the realistic consequences and likelihood, work out the level of risk, compare it with the criteria and rank the results.
Keep documented information on both the process (clause 6.1.2) and the results (clause 8.2). Run it again at your planned intervals and when something significant changes.
A worked case
A 60-person software company scopes its management system to its SaaS platform and approves a 5×5 matrix with an acceptance level of 8. It identifies 32 scenarios, 11 of them above the level.
Those 11 move to the treatment plan, and owners accept the other 21. For the audit, the company hands over the method, the dated results and the minutes of the management approval.
Good practices
- Have top management approve the acceptance criteria. Otherwise the assessor is deciding how much risk the business can take.
- Feed the incident log into each round, since real events are your best calibration.
- Keep dated versions, to show that the process actually repeats.
- Check your results against Annex A afterwards to catch missing controls. It is a safety net and should never become your list of risks.
- Include suppliers and cloud services in the discussion if the scope depends on them.
Common mistakes
- Starting from Annex A and calling the result a risk assessment. That is a control review, and an auditor will see the difference.
- Having no written acceptance criteria, which leaves every acceptance open to challenge.
- Assessing once for the certificate and never again, so that the surveillance audit finds a stale file.
Questions
- Is an asset inventory needed for the risk assessment?
- Clause 6.1.2 has not required one since 2013. Annex A control 5.9 does call for an inventory, however, and many companies still begin from it.
- Which method does ISO 27001 require?
- None. It sets requirements on the criteria and on the results.
- How often must the assessment be done?
- At planned intervals you set yourself and when significant changes occur (clause 8.2). Once a year is common.
- What does a certification auditor want to see?
- The documented process and criteria, the dated results, the owners, and a clear path from the results to the treatment plan and the Statement of Applicability.
- What changed in the 2022 edition?
- The core of clause 6.1.2 stayed the same. Annex A was reorganised into 93 controls in four themes.