ISOISO 27001Security ControlsEASYFree question
How should controls be selected in ISO 27001?
- A.Based on the output of the internal audit programme, adopting a control for each nonconformity that was raised in the cycle
- B.Based on the results of risk assessment, selecting controls necessary to implement chosen risk treatment options
- C.Based on the asset owner's budget for the financial year, picking the controls that fit within the approved spending limit
- D.Based on the controls chosen by peer organisations in the sector, copying the set that regulators published in guidance
Why B is correct
Controls are selected based on risk assessment results, implementing those necessary to execute the chosen risk treatment options effectively.
Know someone studying for ISO 27001? Send them this one.