Internal risk assessments should be performed regularly to address changing personnel and an evolving IT environment. An assessment should also be conducted whenever substantial changes are made to a company’s environment or its personnel.
Threats change as an environment grows and measures that were previously sufficient to protect IT resources may need to be updated to ensure a secure infrastructure.