The reason why option A is not correct is that information security controls should not be considered only after the risk assessment. ISO 27001 emphasizes the importance of integrating information security controls throughout the risk management process, including during the risk assessment work itself. By considering controls during the risk assessment, organizations can identify appropriate measures to mitigate or manage risks effectively. Therefore, the correct answer is D: During the risk assessment work.
upvoted 3 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
haIT
1 year, 5 months ago