An organization has decided to release the software even though some minor bugs have not been fixed yet
B.
An organization has implemented a data loss protection software
C.
An organization terminates work in the construction site during a severe storm
The Answer Is:
A
This question includes an explanation.
Explanation:
According to ISO/IEC 27001 : 2022 Lead Implementer, risk retention is one of the four risk treatment options that an organization can choose to deal with unacceptable risks. Risk retention means that the organization accepts the risk without taking any action to reduce its likelihood or impact. It applies to risks that are either too costly or impractical to address, or that have a low probability or impact. Therefore, an example of risk retention is when an organization decides to release the software even though some minor bugs have not been fixed yet. This implies that the organization has assessed the risk of releasing the software with bugs and has determined that it is acceptable, either because the bugs are not critical or because the cost of fixing them would outweigh the benefits.
[:, ISO/IEC 27001 : 2022 Lead Implementer Study guide and documents, section 8.3.2 Risk treatment, ISO/IEC 27001 : 2022 Lead Implementer Info Kit, page 14, Risk management process, 3, ISO 27001: Top risk treatment options and controls explained, ]
ISO-IEC-27001-Lead-Implementer PDF/Engine
Printable Format
Value of Money
100% Pass Assurance
Verified Answers
Researched by Industry Experts
Based on Real Exams Scenarios
100% Real Questions
Get 65% Discount on All Products,
Use Coupon: "ac4s65"