ISOISO 27001Implementation and OperationEASYFree question
An organization wants to know which operational records it must retain after each cycle of its risk processes. Considering Clauses 8.2 and 8.3 together, which pair of records is mandatory?
- A.The risk treatment plan approved by top management and the Statement of Applicability reissued after each internal audit cycle
- B.The results of the internal audits and the minutes of the management reviews held before each surveillance visit by the auditor
- C.The risk acceptance criteria and the risk assessment methodology approved by the information security steering committee
- D.The results of the information security risk assessments and the results of the information security risk treatment
Why D is correct
Clause 8.2 requires retaining documented information of risk assessment results and Clause 8.3 requires retaining documented information of risk treatment results. Together these two record sets evidence the operational risk cycle and provide traceability from assessed risk to applied treatment.
Know someone studying for ISO 27001? Send them this one.