ISMS documentation

Answer:

In the ISMS implementation, the risk assessment and treatment process is performed after ISMS scope and Information Security Policy definition, starting with the definition of the Risk Assessment and Treatment Methodology.

After implementation risk assessment is normally performed once a year or every time there is a significant change on organizational context.

These articles will provide you further explanation about risk assessment:
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/