Version: April 2025
Aligned with: ISO/IEC 27001:2022 (Clause 6.1.2, 8.2, 8.3)
Applies to: All information assets, risk owners, and ISMS stakeholders

Purpose
To define the methodology for identifying, analyzing, evaluating, and treating information security risks across the organization.

1. Risk Assessment Methodology
(Aligned with Clause 6.1.2 – Information security risk assessment)

• Systematic identification of information security risks
• Risk analysis using qualitative and quantitative methods
• Risk evaluation against established criteria and appetite
• Regular review and update of risk assessments

2. Risk Treatment Options
(Aligned with Clause 8.3 – Information security risk treatment)

• Risk mitigation through security controls implementation
• Risk acceptance with formal management approval
• Risk transfer through insurance or outsourcing
• Risk avoidance by eliminating risk sources