Clause 6.1.3.e See ISO 27005 for guidance on performing Information Security Management Systems risk assessments.