ISO 27000 I27001F Full Course Free

Annex A of ISO/IEC 27001:2022 contains the reference set of information security controls used to support risk treatment decisions. In the 2022 edition, these controls are organized into four themes: organizational, people, physical, and technological controls. Annex A is not a set of ISMS implementation steps and it is not a risk management guideline. Its role is to provide a structured set of control objectives and controls that may be selected as part of risk treatment. Therefore, option B is the correct answer.

=======

The three fundamental properties of information security are confidentiality, integrity, and availability, often referred to as the CIA triad. Confidentiality means information is accessible only to authorized persons or entities. Integrity means safeguarding the accuracy and completeness of information. Availability means information and associated assets are accessible and usable when required. These principles are foundational within ISO/IEC 27001 and ISO/IEC 27002. Therefore, option B is correct.

=======

ISO/IEC 27001:2022 requires the organization to establish and maintain information security risk criteria, identify information security risks, and identify risk owners as part of the risk assessment process. These activities are core elements of clause 6 on planning and risk assessment. Since all of the listed options are required parts of the process, the correct answer is D.

ISO/IEC 27001:2022 does not require a specific tool, consultant, or named individual as the basis for compliance. What it does require is that the organization define and apply an information security risk assessment process that establishes and maintains risk criteria, ensures consistent, valid, and comparable results, identifies risks, analyzes risks, and evaluates risks. Therefore, option D is the correct answer.

=======