### 6.1.2 Information security risk assessment

The organization shall define and apply an information security risk assessment process that:

a\) establishes and maintains information security risk criteria that include:
	1\) the risk acceptance criteria; and
	2\) criteria for performing information security risk assessments;

b\) ensures that repeated information security risk assessments produce consistent, valid and comparable results;

c\) identifies the information security risks:
	1\) apply the information security risk assessment process to identify risks associated with the loss of confidentiality, integrity and availability for information within the scope of the information security management system; and
	2\) identify the risk owners;

d\) analyses the information security risks:
	1\) assess the potential consequences that would result if the risks identified in 6.1.2 c)1) were to materialize;
	2\) assess the realistic likelihood of the occurrence of the risks identified in 6.1.2 c)1) ; and
	3\) determine the levels of risk;

e\) evaluates the information security risks:
	1\) compare the results of risk analysis with the risk criteria established in 6.1.2 a); and
	2\) prioritize the analysed risks for risk treatment.

The organization shall retain documented information about the information security risk assessment process.  
