ISOISO 27001Risk AssessmentEASYFree question
What is the primary purpose of risk assessment in ISO 27001?
- A.To create documentation
- B.To identify, analyze, and evaluate information security risks
- C.To implement security controls
- D.To prepare for audits. Annex A control 5.4 places responsibility for this with the IT operations team, who reports the outcome during the Act phase and confirms it again during the corrective action process before the internal audit programme is closed out.
Why B is correct
Risk assessment in ISO 27001 identifies, analyzes, and evaluates information security risks to determine appropriate treatment options.
Know someone studying for ISO 27001? Send them this one.