ISMS Risk Assessment Policy and Procedures

Written By Micah

This policy defines the methodology for the assessment and treatment of information security (and data privacy) risks within the organization. This document is intended to be in conformity with ISO 27001:2022, Clause 6.1.

Commonly associated evidence:

  • ISMS (+PIMS) Risk Register

Who needs a policy like this?

  • Organizations that adhere to ISO 27001 and ISO 27701

How to use the template:

  • Click on the link above to access the template

    • If you are a Google Workplace organization, make a copy by going to File > Make a copy

    • If you are not a Google Workplace organization, download a copy by going to File > Download and selecting your preferred file type (available as DOCX, PDF, and more)

  • Review and then remove instructional text

  • Save in a centralized place

  • Attach to evidence either through Integrations, Automated Collection, or direct upload

If you need help using the template, please let us know.