I27001F Exam Dumps : Certified ISO/IEC 27001:2022 Foundation

ISO/IEC 27001:2022 requires the organization to plan actions to address risks and opportunities so that the ISMS can achieve its intended outcomes, prevent or reduce undesired effects, and achieve continual improvement. This is a direct requirement of the standard and not optional guidance. Therefore, option B is the correct answer.

=======

Annex A of ISO/IEC 27001:2022 contains the reference set of information security controls used to support risk treatment decisions. In the 2022 edition, these controls are organized into four themes: organizational, people, physical, and technological controls. Annex A is not a set of ISMS implementation steps and it is not a risk management guideline. Its role is to provide a structured set of control objectives and controls that may be selected as part of risk treatment. Therefore, option B is the correct answer.

=======

ISO/IEC 27001:2022 requires the information security policy to be available as documented information, communicated within the organization, and available to interested parties as appropriate. In practical terms, this means the policy must be communicated to relevant persons in the organization so they understand the direction and expectations related to information security. Among the options provided, the best and correct answer is D, because the policy is intended to be known broadly across the organization, not restricted to a single role or department.