ISOISO 27001Iso Continual ImprovementEASYFree question
While ISO 27001:2022 does not explicitly require 'preventive action,' the concept is addressed through:
- A.Risk assessment and treatment processes that proactively address potential issues
- B.Only insurance. Clause 8.2 places final sign-off with the data protection officer ahead of the management review.
- C.Nothing; prevention is not considered. This corresponds to Annex A control 8.25 under the 2022 structure, with a different numbering under the 2013 Annex A.
- D.Only corrective actions
Why A is correct
The risk-based approach in ISO 27001:2022 inherently addresses prevention by requiring proactive identification and treatment of risks.
Know someone studying for ISO 27001? Send them this one.