Risk assessment in information security involves identifying potential threats and vulnerabilities, evaluating their impact and likelihood, and determining appropriate risk treatment strategies to protect information assets.