---
notetype: reference
standard: ISO 27001
version: 2022
language: EN
type: clause
id: "C.6.1.2"
title: "Information security risk assessment"
tags:
- iso27001/2022/EN
- sourcetext
status: active
---
### 6.1.2 Information security risk assessment

The organization shall define and apply an information security risk assessment process that:

a\) establishes and maintains information security risk criteria that include:
	1\) the risk acceptance criteria; and
	2\) criteria for performing information security risk assessments;

b\) ensures that repeated information security risk assessments produce consistent, valid and comparable results;

c\) identifies the information security risks:
	1\) apply the information security risk assessment process to identify risks associated with the loss of confidentiality, integrity and availability for information within the scope of the information security management system; and
	2\) identify the risk owners;

d\) analyses the information security risks:
	1\) assess the potential consequences that would result if the risks identified in 6.1.2 c)1) were to materialize;
	2\) assess the realistic likelihood of the occurrence of the risks identified in 6.1.2 c)1) ; and
	3\) determine the levels of risk;

e\) evaluates the information security risks:
	1\) compare the results of risk analysis with the risk criteria established in 6.1.2 a); and
	2\) prioritize the analysed risks for risk treatment.

The organization shall retain documented information about the information security risk assessment process.  
