3Decide

ISO 27001Risk Assessment

ISO 42001Risk Assessment

Risk Assessment

Purpose

A versioned assessment of risk: criteria, method, likelihood, consequence, residual and review trigger.

Role

ISO/IEC 27001 Clauses 6.1 and 8 (with ISO/IEC 27005) and ISO/IEC 42001 Clauses 6.1 and 8.2 require a repeatable risk-assessment process. Gemara Risk catalogues name exposures; they do not yet record the assessment instance that produced them, including AI impact-assessment inputs.

This page is a stub: fields, examples and schema are still to be specified.

Links upstream

• Organisation Context
• Governed Resource
• AI System
• Impact Assessment
• Threat
• Risk

Links downstream

• Applicability Profile
• Management Objective
• Management Review
• Policy

Related factors

• Govern Sensitive Activities
• Build a Governance Twin
• Continuous Governance
• Governance is Version Controlled

References

• ISO/IEC 27001 Analysis — ISO/IEC 27005 overlay and Clause 6.1
• ISO/IEC 42001 Analysis — Clauses 6.1 and 8.2
• ISO/IEC 27001 Guidance Catalog (iso27001-6.1.2)
• Risk