ISOISO 27001Security ControlsEASYFree question
What is the purpose of information security policies as a control?
- A.To assign day-to-day tasks and approvals to the process owners responsible for each system
- B.To list the technical settings and parameters applied to each firewall and server build
- C.To provide management direction and support for information security in accordance with business and regulatory requirements
- D.To record the audit findings and corrective actions agreed with the certification body
Why C is correct
Information security policies provide management direction and support, establishing the framework for how information security is managed throughout the organization.
Know someone studying for ISO 27001? Send them this one.