Templates and records · ISO 27001 · Clause 6.1.2

ISO 27001 information security risk assessment template

The analysis that identifies what could compromise the confidentiality, integrity or availability of information, who answers for each risk and how much it weighs.

In one sentence

The information security risk assessment identifies risks to confidentiality, integrity and availability, gives each one an owner, rates its likelihood and consequences and compares them with acceptance criteria set in advance; ISO/IEC 27001 requires the process to be documented (6.1.2) and its results retained (8.2).

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27001 · Clause 6.1.2 Clauses follow ISO/IEC 27001:2022; those beginning with “A.” are Annex A controls, required to the extent that the statement of applicability includes them.
Type of information: Mandatory record A documented process (6.1.2) and results to be retained (8.2)
Who fills it in: Information security manager with the risk owners Each risk has an owner with the authority to decide how it is treated
When: At least once a year And whenever relevant changes occur: a new service, a critical supplier, a serious incident
How long it is kept: Set by the organisation ISO/IEC 27001 sets no periods: it asks you to decide on the retention and disposition of documented information (7.5.3). Covering the three-year certification cycle lets you show the history at recertification.

What the standard requires

What ISO 27001 demands and what it leaves to your judgement

The standard asks you to define an assessment process with risk acceptance criteria and criteria for performing it, so that repeated assessments produce consistent, comparable results. Within that process you must identify the risks, name their owners, assess consequences and likelihood, determine the level and prioritise.

It prescribes no method. Since 2013 it has not required starting from assets: you can work by scenarios, by processes or by assets. ISO/IEC 27005 offers guidance, but it is neither certifiable nor mandatory.

The assessment is repeated at planned intervals and when significant changes occur (8.2). What is retained are the results of every run, not just the latest version.

Read it in context: Planning, in the ISO 27001 Academy

Structure

Fields the template should include

Acceptance criteria and likelihood and impact scales
Risk identifier and description (threat and vulnerability, or scenario)
Asset, process or service affected
Property affected: confidentiality, integrity or availability
Risk owner
Existing controls
Likelihood, impact and level of risk
Decision: accept or treat
Assessment date and version

Example

Example: one risk from the annual assessment

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Risk	R-07 · Prolonged outage at the platform’s hosting provider
Service affected	Cloudline SaaS platform (fictitious)
Property	Availability
Owner	Operations director
Existing controls	Daily backups in another region; contract with a 99.9% service level
Rating	Likelihood 2 out of 5 · Impact 5 out of 5 · Level 10, high
Acceptance criterion	Risks at level 6 or below are accepted
Decision	Treat · moves into the treatment plan as action T-07
Date	Annual assessment, 2 September 2026

At the audit

Mistakes auditors commonly flag

There are no written acceptance criteria, or they are set after seeing the results.
Risks with no owner, or with “IT” as the owner of all of them.
The assessment is not repeated after a serious incident or a change of supplier.
The previous version is overwritten on update: no result is left to retain.
Scales change from one year to the next and results are no longer comparable.

In Kimobox

How this record is kept in Kimobox

1Each risk is logged with its asset, its treatment and its owner.
2The owner of each risk and each asset is assigned directly in the system.
3Every version of the assessment is kept, and after a significant incident it is updated from the corrective action itself.

Frequently asked questions

What people ask us before getting started

Do you have to start from the asset inventory?

It has not been mandatory since the 2013 edition, although many companies still do it because it helps them not to miss anything. You can assess by scenarios or by processes, as long as the results are consistent and comparable.

What is the risk owner?

The person with the authority and accountability to manage a risk. They approve the treatment plan and accept the residual risk, and they are usually a business manager rather than the IT technician.

Keep your ISO 27001 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO/IEC 27001:2022 — Information security management systems. Requirements ISO/IEC · 25 October 2022
ISO/IEC 27005:2022 — Guidance on managing information security risks ISO/IEC · October 2022