ISOISO 27001Risk AssessmentEASYFree question
What is the purpose of a risk register?
- A.To track employee training. Annex A control 5.31 makes the IT operations team accountable for reporting this at the next management review.
- B.To document and track identified risks, their assessments, treatment decisions, and current status
- C.To register the organization with ISO
- D.To register security tools. Clause 9.3 assigns this responsibility to line managers rather than to the role named here.
Why B is correct
A risk register is a central repository that documents identified risks, their assessment results, treatment decisions, risk owners, and current status.
Know someone studying for ISO 27001? Send them this one.