ISOISO 27001Implementation and OperationEASYFree question
Following an operational information security risk assessment under Clause 8.2, what documented information must the organization retain?
- A.Documented information of the criteria used to select the information security risk treatment options
- B.The Statement of Applicability with the justification for each control
- C.The information security policy approved by top management
- D.Documented information of the results of the information security risk assessments
Why D is correct
Clause 8.2 requires the organization to retain documented information of the results of the information security risk assessments. These records provide evidence that the assessment was performed and form the basis for risk treatment decisions.
Know someone studying for ISO 27001? Send them this one.