ISOISO 27001Implementation and OperationEASYFree question
Clause 8.3 of ISO/IEC 27001:2022 covers information security risk treatment. What is the core operational requirement of this clause?
- A.To rewrite the risk treatment methodology after every assessment
- B.To transfer every residual risk to an insurer
- C.To eliminate all identified risks regardless of cost
- D.To implement the information security risk treatment plan
Why D is correct
Clause 8.3 requires the organization to implement the information security risk treatment plan. The clause turns the plan developed under 6.1.3 into operational reality through the deployment of selected controls and actions.
Know someone studying for ISO 27001? Send them this one.