ISOISO 27001Implementation and OperationEASYFree question
According to Clause 8.2 of ISO/IEC 27001:2022, when must the organization perform information security risk assessments?
- A.At each surveillance audit or when the certification body requests a new assessment
- B.At planned intervals or when significant changes are proposed or occur
- C.Once a year at the management review or when an incident reaches the regulator
- D.After each internal audit or when the risk register exceeds its agreed threshold
Why B is correct
Clause 8.2 requires risk assessments to be performed at planned intervals or when significant changes are proposed or occur. This keeps the risk picture current rather than allowing it to become a one-time exercise.
Know someone studying for ISO 27001? Send them this one.