Information security risk assessment (operational)
8.2
-
Last updated
Mandatory
Catalog reference
Perform information security risk assessments at planned intervals and when significant changes occur, using the defined criteria, and retain the results as documented information.
Narrative — how we satisfy this requirement
The assessment is repeated at the six-monthly Risk review and whenever a platform, a supplier, or a customer commitment changes materially.
Review
On trackNext review is 10/27/2027 — no urgency right now.
- Review cadence
- Every 365 days
- Last reviewed
- Next review due