ISOISO 27001Risk Assessment and TreatmentEASYFree question

Under ISO/IEC 27001:2022 clause 6.1.3, an organization decides to discontinue a legacy file-sharing service entirely because the risk it poses cannot be reduced to an acceptable level. Which risk treatment option does this represent?

A.Modifying the risk by applying additional controls
B.Avoiding the risk by deciding not to continue with the activity that gives rise to it
C.Sharing the risk with a third party
D.Retaining the risk based on informed decision

Why B is correct

Avoidance means deciding not to start or to discontinue the activity giving rise to the risk. Discontinuing the legacy service removes the source of risk rather than reducing or transferring it.

Know someone studying for ISO 27001? Send them this one.

ISO 27001 and ISO are trademarks or registered trademarks of their respective owners. CyberCertPrep is an independent exam-preparation resource and is not affiliated with, authorized by, sponsored by, or endorsed by ISO or any other certification body. All study material is independently created; the certification name is used only to identify the exam this resource helps you prepare for.

Under ISO/IEC 27001:2022 clause 6.1.3, an organization decides to discontinue a legacy file-sharing service entirely because the risk it poses cannot be reduced to an acceptable level. Which risk treatment option does this represent?

Where this fits in the ISO 27001 exam

One question down. Thousands to go.

Under ISO/IEC 27001:2022 clause 6.1.3, an organization decides to discontinue a legacy file-sharing service entirely because the risk it poses cannot be reduced to an acceptable level. Which risk treatment option does this represent?

Where this fits in the ISO 27001 exam

More free Risk Assessment and Treatment questions

One question down. Thousands to go.