ISOISO 27001Implementation and OperationEASYFree question
How does ISO/IEC 27001:2022 Clause 8.2 frame the timing of operational risk assessments?
- A.Assessments occur at each surveillance audit and also when the certification body issues a new standard version
- B.Assessments occur at planned intervals and also when significant changes are proposed or occur
- C.Assessments occur at each audit and also when top management asks
- D.Intervals are fixed by the certification body and assessments are signed by the CISO
Why B is correct
Clause 8.2 requires risk assessments at planned intervals or when significant changes are proposed or occur. The standard does not impose a universal fixed frequency; the organization sets the interval while also responding to significant change.
Know someone studying for ISO 27001? Send them this one.