Which ISO standard will management decide to implement?

Management wants to bring their organization into compliance with the ISO standard for information security risk management.

Which ISO standard will management decide to implement?
A . ISO/IEC 27004
B . ISO/IEC 27002
C . ISO/IEC 27006
D . ISO/IEC 27005

View Answer

Answer: D

Explanation:

ISO/IEC 27005 is the standard dedicated to information security risk management. It provides guidelines for information security risk management and supports the general concepts specified in ISO/IEC 27001. It is designed to assist the implementation of information security based on a risk management approach and is applicable to all types of organizations which intend to manage risks that can compromise the organization’s information security.

Reference: The ISO/IEC 27005 standard is referenced in various resources as the go-to standard for information security risk management, which aligns with the objectives of bringing an organization into compliance with ISO standards for this purpose12. Additionally, the ECCouncil’s Certified Network Defender (CND) study materials and guidelines would include references to such standards as part of the curriculum for network security and defense34.