I27001F Exam Questions & Answers

Clause 4.4 of ISO/IEC 27001:2022 requires the organization to establish, implement, maintain, and continually improve an information security management system. This is one of the core statements of the standard and defines the lifecycle expectation for the ISMS. Therefore, the missing word is implement, making option A correct.

Residual risk is the risk that remains after risk treatment has been applied. In an ISMS, organizations assess risks, select treatment options, and implement controls or other measures to reduce risk to an acceptable level. Even after treatment, some level of risk may still remain, and that remaining portion is called residual risk. Therefore, option C is correct.

The Statement of Applicability is a documented result of the risk treatment process. It must include the necessary controls and justification for their inclusion, whether the controls are implemented, and justification for excluding controls from Annex A when they are not applicable. It does not need to be a list of risks, proof of management authorization, or the policy itself. Therefore, option C is correct.

ISO/IEC 27001:2022 requires the organization to define and apply an information security risk assessment process that produces consistent, valid, and comparable results. This is not optional guidance and not merely an auditing suggestion. It is a formal requirement within the planning and risk assessment requirements of the standard. Therefore, option B is correct.

ISO/IEC 27001:2022 requires the organization to plan actions to address risks and opportunities so that the ISMS can achieve its intended outcomes, prevent or reduce undesired effects, and achieve continual improvement. This is a direct requirement of the standard and not optional guidance. Therefore, option B is the correct answer.