ISO 27001 Clause 8.2: Information Security Risk Assessment requires organisations to conduct information security risk assessments at planned intervals or when significant changes are proposed in the ISMS. These assessments are designed to identify threats and vulnerabilities, allowing senior leadership to make informed decisions and treat risks appropriately. Regular assessments support continual improvement and must be documented.