The organization shall perform risk assessments at planned intervals or when significant changes occur, using defined criteria, producing consistent results.
Put simply: Re-check risk whenever reality changes—assess on a schedule and after major changes, using consistent criteria.
More specifically, this requires that the organization:
a. Uses defined criteria (risk acceptance, impact/likelihood method, evaluation rules).
b. Identifies and evaluates risks to information and relevant processes/assets consistently.
c. Repeats assessments periodically and triggers them by significant changes (tech, org, suppliers, incidents).
