#iso27001/2022/EN
# Clause 8.2: Information security risk assessment

The organization shall perform information security risk assessments at planned intervals or when significant changes are proposed or occur, taking account of the criteria established in [6.1.2a](ISO_27001_OT%206.1.2%20Information%20security%20risk%20assessment.md).

The organization shall retain documented information of the results of the information security risk assessments.