ISOISO 27001Risk Assessment and TreatmentEASYFree question
Annex A of ISO/IEC 27001:2022 lists 93 controls grouped into four themes. In the risk treatment process, what is the correct status of Annex A?
- A.A mandatory checklist requiring each listed control to be fully implemented before the certification audit
- B.A reference set of controls used to check that no necessary control has been omitted
- C.A historical document retained for archival purposes with no ongoing decision role in current treatment
- D.A prohibited reference that certified organizations must not consult during treatment planning
Why B is correct
Annex A serves as a reference catalogue. Organizations determine necessary controls from the risk treatment and then compare against Annex A to ensure completeness; not every Annex A control must be implemented.
Know someone studying for ISO 27001? Send them this one.