ISOISO 27001DocumentationEASYFree question
What documentation is required for risk treatment?
- A.The risk treatment plan including selected options, rationale, responsible parties, timelines, and approved residual risk levels
- B.The Statement of Applicability alone, together with control test results, vendor attestations, and the penetration test summary for each site
- C.The risk assessment results, asset owners, likelihood scales, and the acceptance threshold for new risks
- D.A list of Annex A controls, implementation dates, budget codes, and sign-off by the certification body
Why A is correct
Risk treatment documentation includes selected treatment options, rationale, implementation actions, responsibilities, timelines, and accepted residual risk levels.
Know someone studying for ISO 27001? Send them this one.