ISOISO 27001Risk Assessment and TreatmentEASYFree question
Under ISO 27005 retention criteria, RETAINING (accepting) a risk without adding controls is most clearly justified when:
- A.The risk owner is unavailable to make a decision and the deadline for the annual review has already quietly passed
- B.The risk is extremely high and no one wants to fund a control and the finance lead has frozen spending
- C.The risk is unknown and has not been assessed by anyone qualified to make that determination
- D.The risk's level is within the organization's defined risk acceptance criteria and treatment cost would exceed the benefit
Why D is correct
Retention is appropriate when a risk already falls within acceptance criteria, or when the cost of further treatment outweighs the benefit. Retaining an unassessed or clearly excessive risk, or doing so by default, does not meet retention criteria.
Know someone studying for ISO 27001? Send them this one.