---
notetype: reference
standard: ISO 27001
version: 2022
language: EN
type: clause
id: "C.8.2"
title: "Information security risk assessment"
tags:
- iso27001/2022/EN
- sourcetext
status: active
---
## 8.2 Information security risk assessment

The organization shall perform information security risk assessments at planned intervals or when significant changes are proposed or occur, taking account of the criteria established in [6.1.2a](ISO_27001_OT%206.1.2%20Information%20security%20risk%20assessment.md).

The organization shall retain documented information of the results of the information security risk assessments.