Understanding the risks in your organisation is a key part of being able to effectively manage it and its part of the reason that the ISO management systems now take a risk-based approach to things. ISO27001:2015 is no different to the other standards in that respect, if you want to have an effective Information Security Management System (ISMS) th...