Risk Assessment, Treatment & the SoA

A company begins its ISMS work by listing threats and vulnerabilities and scoring each risk out of ten. It has not yet defined what level of risk it will accept. What should the implementer correct first?

• AComplete the Statement of Applicability so the scoring has a control baseline
• BRecalculate the scores on a five-point scale for consistency
• CEstablish risk acceptance and assessment criteria before evaluating risks✓
• DLittle - criteria are derived from the scores once assessment is finished

Answer: Clause 6.1.2 requires the organisation to define and apply a risk assessment process that establishes and maintains information security risk criteria, including risk acceptance criteria, before risks are evaluated. Without a threshold there is nothing to compare a score against.

Which clause requires the organisation to define the information security risk assessment process?

• AClause 6.1.3
• BClause 8.2
• CClause 6.1.2✓
• DClause 4.1

Answer: Clause 6.1.2 defines the risk assessment process, including criteria, identification, analysis and evaluation. Clause 6.1.3 covers treatment, and Clause 8.2 requires the assessment to be performed at planned intervals.

What are the three steps of the risk assessment in the order ISO/IEC 27001 sets out?

• AIdentify, analyse, evaluate✓
• BIdentify, treat, review
• CAnalyse, identify, treat
• DEvaluate, identify, analyse

Answer: Clause 6.1.2 requires risks to be identified, then analysed to determine likelihood and consequence, then evaluated against the criteria to prioritise them. Treatment is a separate step under 6.1.3.

Which clause requires the Statement of Applicability?

• AClause 6.1.3✓
• BClause 8.3
• CClause 6.1.2
• DClause 9.1

Answer: Clause 6.1.3 d) requires the organisation to produce a Statement of Applicability. Clause 6.1.2 covers the assessment and Clause 8.3 requires the treatment plan to be implemented.

Which of these must the Statement of Applicability contain?

• AThe residual risk figure calculated for each asset within the scope
• BThe justification for excluding any Annex A control✓
• CThe internal audit schedule covering the coming twelve-month period
• DThe names of the risk owners who accepted each of the residual risks

Answer: The SoA must record the necessary controls and why, whether they are implemented, and the justification for excluding any Annex A control. Risk owners and residual risk belong to the risk treatment plan and risk register.

Who must approve the residual information security risks?

• AThe internal auditor who reviewed the risk assessment process
• BThe risk owners, who own the risks being accepted✓
• CThe certification body, as part of the Stage 2 audit findings
• DThe information security manager, acting on behalf of the business

Answer: Clause 6.1.3 f) requires the risk owners to approve the risk treatment plan and accept the residual risks. The implementer prepares the decision; the risk owner makes it.

An organisation decides to buy insurance against a data breach. Which risk treatment option is this?

• ARetaining the risk
• BModifying the risk
• CAvoiding the risk
• DSharing the risk✓

Answer: Insurance and outsourcing share risk with another party. Modifying means applying controls, avoiding means not undertaking the activity, and retaining means accepting the risk as it stands.

An organisation stops offering a service entirely because the risk is unacceptable. Which treatment option is this?

• AModifying the risk
• BRetaining the risk
• CAvoiding the risk✓
• DSharing the risk

Answer: Avoidance means deciding not to start or to discontinue the activity that gives rise to the risk. It is the only option that removes the risk rather than changing its likelihood, consequence or ownership.

After controls are applied, what is the remaining risk called?

• AResidual risk✓
• BSecondary risk
• CInherent risk
• DAccepted risk

Answer: Residual risk is what remains after treatment. Inherent risk is the level before any control is applied; the two are commonly confused in exam questions.

What is the purpose of the risk treatment plan?

• ATo record the risk acceptance criteria
• BTo set out the treatments chosen, with owners, resources and timescales✓
• CTo document the internal audit findings
• DTo list every one of the Annex A controls together with its implementation status

Answer: The treatment plan is the delivery document: what will be done about each risk, by whom and by when. The control-by-control status is the Statement of Applicability, which is a different artefact.

How does the Statement of Applicability differ from the risk treatment plan?

• AThe SoA is an internal working document while the plan is shared with the auditor
• BThe SoA is optional and the plan is mandatory
• CThe SoA accounts for every Annex A control; the plan sets out how chosen treatments will be delivered✓
• DThey are two names for the same document

Answer: Both are required. The SoA is the control-by-control account, including exclusions and their justification; the treatment plan is the schedule of work with owners and dates.

How often does ISO/IEC 27001 require information security risk assessments to be performed?

• AAt planned intervals, and when significant changes are proposed or occur✓
• BOnce at implementation, unless the certification body requests a repeat
• COnly in the aftermath of a reported information security incident
• DOnce a year, provided the Statement of Applicability is kept current

Answer: Clause 8.2 requires information security risk assessments to be performed at planned intervals or when significant changes are proposed or occur, with documented information retained as evidence.

Which of these is a legitimate reason to exclude an Annex A control?

• AThe organisation has never experienced an incident of the kind it addresses
• BThe risk it addresses does not apply to the organisation’s scope✓
• CThe control is expensive to implement relative to the value it would add
• DThe control is not referenced anywhere in the information security policy

Answer: Exclusion must be justified by relevance to the risks and the scope. Cost, an absence of past incidents and omission from the policy are not justifications, though cost can legitimately influence how a control is implemented.

An organisation scores every risk out of ten but has never defined what score is unacceptable. What is the consequence?

• AEvery risk is treated as acceptable by default until criteria are written
• BOnly the highest-scoring risks need treatment, and the rest are retained
• CRisk cannot be evaluated, because there is no threshold to compare against✓
• DRisk can still be evaluated by comparing scores against industry benchmarks

Answer: Evaluation means comparing analysed risk against the criteria. Without acceptance criteria there is nothing to compare against, so a score of seven out of ten means nothing and no risk can be prioritised.

Who is responsible for identifying the risk owners?

• AThe internal audit function
• BISO/IEC 27005, which assigns them by asset class
• CThe organisation, as part of the risk assessment process✓
• DThe certification body during Stage 1

Answer: Clause 6.1.2 c) 2) requires the organisation to identify the risk owners as part of the risk assessment. External parties and guidance standards play no part in that assignment.

What must be retained as documented information from the risk treatment process?

• AEvidence of the results of the risk treatment✓
• BThe Statement of Applicability, which is the only required treatment output
• CThe certification body’s written approval of the risk treatment plan
• DThe minutes of the risk workshop at which the treatments were agreed

Answer: Clause 6.1.3 requires documented information about the risk treatment process to be retained. The SoA is one required output but not the only evidence, and no external approval is involved.