ISOISO 27001Risk Assessment and TreatmentEASYFree question
An organization sets an information security objective to reduce phishing-related account compromises by 40% within a year. How should this objective interact with risk treatment?
- A.Risk treatment must be suspended until objectives are met, and no controls (like MFA or awareness training) begin implementation early
- B.Objectives and risk treatment are independent, and controls (like MFA or training) should be chosen without reference to any stated target
- C.The objective replaces the need for a risk treatment plan, and controls (MFA, training) become optional
- D.The objective should be supported by treatment decisions and controls (e.g., MFA, training) whose effectiveness contributes to meeting it
Why D is correct
Security objectives and risk treatment are tightly coupled. Treatment selections such as controls are the means by which measurable objectives are achieved, and progress toward those objectives provides evidence of treatment effectiveness.
Know someone studying for ISO 27001? Send them this one.