Section
6.1.2 of the Standard states
the risk assessment process must:
·
Establish
and maintain certain information security risk criteria;
·
Ensure
that repeated risk assessments “produce consistent, valid and comparable
resultsâ€;
·
“Identify
risks associated with the loss of confidentiality, integrity and availability
for information within the scope of the information security management
systemâ€;
·
Identify
the owners of those risks; and
·
Analyse
and evaluate information security risks according to certain criteria.
User questions & answers