ISOISO 27001Implementation and OperationEASYFree question
How does ISO/IEC 27001:2022 Clause 8.2 frame the timing of operational risk assessments?
- A.Assessments occur only after the certification audit
- B.Assessments occur at planned intervals and also when significant changes are proposed or occur
- C.Assessments occur exactly every 90 days as mandated by ISO
- D.Assessments occur only when requested by a customer
Why B is correct
Clause 8.2 requires risk assessments at planned intervals or when significant changes are proposed or occur. The standard does not impose a universal fixed frequency; the organization sets the interval while also responding to significant change.
Know someone studying for ISO 27001? Send them this one.