# Clause 8.2.3: Risk assessment

Put in place and keep up a process for assessing risk that identifies what could disrupt the organization's prioritized activities and the resources those activities need, analyses and evaluates those risks, and decides which ones need treatment.

Cloud: Risk assessment for cloud use must include concentration: shared providers, shared regions, shared identity providers and shared networks. Individually resilient services can still fail together.

Evidence: Documented risk assessment process; Risk register scoped to prioritized activities and their required resources; Analysis and evaluation records with the criteria applied; Treatment decisions recorded with rationale, including acceptance.

Test: Identify any two critical services that share a provider, region or identity path.

Citation: ISO 22301:2019, clause 8.2.3. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.