ISOISO 27001Implementation and OperationEASYFree question
How do Clause 8.2 (risk assessment) and Clause 8.3 (risk treatment) relate to each other during operation of the ISMS?
- A.They are independent and never interact
- B.Clause 8.3 must be completed before Clause 8.2 begins
- C.Clause 8.2 replaces Clause 8.3 entirely once the ISMS is certified
- D.Clause 8.2 produces assessed risks that feed Clause 8.3, where the treatment plan is implemented to address those risks
Why D is correct
Clause 8.2 performs the operational risk assessment, identifying and evaluating risks, and Clause 8.3 implements the risk treatment plan that addresses those assessed risks. The output of 8.2 is the input to 8.3 in the operational risk cycle.
Know someone studying for ISO 27001? Send them this one.