ISOISO 27001Risk Assessment and TreatmentEASYFree question
Under ISO/IEC 27001:2022 clause 6.1.3, an organization decides to discontinue a legacy file-sharing service entirely because the risk it poses cannot be reduced to an acceptable level. Which risk treatment option does this represent?
- A.Modifying the risk by adding a new access control layer around the legacy service before decommissioning
- B.Retaining the risk by documenting management's formal acceptance of the legacy service's continued operation
- C.Avoiding the risk by deciding not to continue with the activity that gives rise to it
- D.Sharing the risk by outsourcing the legacy service to a vendor
Why C is correct
Avoidance means deciding not to start or to discontinue the activity giving rise to the risk. Discontinuing the legacy service removes the source of risk rather than reducing or transferring it.
Know someone studying for ISO 27001? Send them this one.