ISOISO 27001Continuous ImprovementEASYFree question
Does ISO 27001:2022 have a separate requirement for preventive action?
- A.Yes, clause 10.2 requires a documented preventive action procedure and a register of preventive actions
- B.Yes, preventive action sits in clause 8.1 and must be evidenced separately from risk treatment
- C.No, the risk-based approach inherently addresses preventive action through risk assessment and treatment
- D.No, preventive action was moved to Annex A control 5.7 and is handled by threat intelligence
Why C is correct
ISO 27001:2022 does not have a separate preventive action clause because the risk-based approach inherently addresses prevention through risk assessment and treatment.
Know someone studying for ISO 27001? Send them this one.