According to ISO/IEC 27005, what is the output of the documentation of risk management processes?
According to ISO/IEC 27005, the output of the documentation of risk management processes should include detailed information about the results of the risk assessment and the chosen risk treatment options. This ensures transparency and provides a clear record of the decision-making process related to information security risk management. Therefore, option B is the correct answer.
After creating a plan for outsourcing to a cloud service provider to store their confidential information in cloud, OrgX decided to not pursue this business strategy since the risk of doing so was high. Which risk treatment option did OrgX use?
OrgX decided not to pursue a business strategy involving outsourcing to a cloud service provider due to the high risk. This decision reflects a 'risk avoidance' strategy, where the organization chooses not to engage in an activity that poses unacceptable risks. This aligns with option A.
What should an organization do after it has established the risk communication plan?
Once an organization has established a risk communication plan, it should implement it by establishing both internal and external communication channels to ensure all stakeholders are informed and involved in the risk management process. This step is crucial for maintaining transparency, ensuring clarity, and fostering a collaborative environment where risks are managed effectively. Therefore, option C is the correct answer.
ISO/IEC 27005:2018, Clause 7, 'Communication and Consultation,' which outlines the importance of establishing both internal and external communication mechanisms to ensure effective risk management.
According to ISO/IEC 27005, what is the input when selecting information security risk treatment options?
According to ISO/IEC 27005, the input for selecting information security risk treatment options should include a list of prioritized risks along with the specific event or risk scenarios that led to those risks. This information helps decision-makers understand the context and potential impact of each risk, allowing them to choose the most appropriate treatment options. Option A is incorrect because the risk treatment plan and residual risks are outputs, not inputs, of the risk treatment process. Option C is incorrect because a list of risks with level values assigned provides limited context for selecting appropriate treatment options.
An organization has installed security cameras and alarm systems. What type of information security control has been implemented in this case?
Security cameras and alarm systems are considered technical controls in the context of information security. Technical controls, also known as logical controls, involve the use of technology to protect information and information systems. These controls are designed to prevent or detect security breaches and mitigate risks related to physical access and surveillance. While security cameras and alarms are physical in nature, they fall under the broader category of technical controls because they involve electronic monitoring and alert systems. Option B (Managerial) refers to administrative policies and procedures, and option C (Legal) refers to controls related to compliance with laws and regulations, neither of which applies in this case.
