Risk identification

Text not public. The public view of the draft withholds this unit. The page states its position, what it asks the reader to prepare and the evidence an auditor samples. It does not state the clause text.

What it says, in our words

The public view does not carry this subclause. Its position, after the framework and before analysis, is the same position identification takes in the 27005 process. The eight characteristics and the threat statements in clause 5.2 are the material the identification step works on.

What it means for an ISMS manager

Prepare the artefact this step produces rather than a summary of the step. The seven steps of the risk process are familiar to an ISMS manager, so the value here is the big data lens, not a new process. Take the characteristic that is most present in the estate and walk it through this step end to end. If the walk produces a row an auditor can sample, the preparation is real. If it produces a paragraph, it is not. When the published text arrives, read the subclause against the walk and record what it adds. The record on this site carries the change when it happens, and the watch sends the diff.

What an auditor samples

• The framework document or method the step refers to, with its owner and review date.
• One walked example, from the characteristic to the treated risk, in the organisation's own words.
• The record that shows the step was reviewed, not only performed.
• The reading note for the published subclause, with the date it was compared.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.