Clause 6.1.2.a See ISO 27005 for guidance on performing risk assessments for Information Security Management Systems.