Information Security - Risk Management Process

Risk assessment is a mandatory activity under all the Information Security policy frameworks e.g. COBIT, ISO27001. However, risk assessment methodologies are point-in-time and don't deal with incremental risk as the above process does.