ISO 27001/Chapter/8.2 Information security risk assessment

The organization shall perform risk assessments at planned intervals or when significant changes occur, using defined criteria, producing consistent results.

Put simply: Re-check risk whenever reality changes—assess on a schedule and after major changes, using consistent criteria.

More specifically, this requires that the organization:

a. Uses defined criteria (risk acceptance, impact/likelihood method, evaluation rules).

b. Identifies and evaluates risks to information and relevant processes/assets consistently.

c. Repeats assessments periodically and triggers them by significant changes (tech, org, suppliers, incidents).