PECB ISO-IEC-27001-Lead-Implementer Exam With Confidence Using Practice Dumps

According to the ISO/IEC 27001 : 2022 Lead Implementer course, one of the objectives of information security incident management is to collect and preserve records that can be used as evidence for disciplinary and legal action, as well as for learning and improvement purposes1. Therefore, Anna should be aware of the collection and preservation of records when gathering data for the forensics team. She should follow the guidelines and procedures specified in the information security incident management policy of InfoSec, which defines the type, format, content, and location of the records to be created and maintained2. The records should be accurate, complete, consistent, and reliable, and should be protected from unauthorized access, modification, or deletion3.

References: 1: PECB, ISO/IEC 27001 Lead Implementer Course, Module 8: Information Security Incident Management, slide 16 2: PECB, ISO/IEC 27001 Lead Implementer Course, Module 8: Information Security Incident Management, slide 19 3: PECB, ISO/IEC 27001 Lead Implementer Course, Module 8: Information Security Incident Management, slide 20

 Risk modification is one of the four risk treatment options defined by ISO/IEC 27001, which involves applying controls to reduce the likelihood and/or impact of the risk. By requiring its employees to change their email passwords at least once every 60 days, Company A has implemented a risk modification option to reduce the risk of unauthorized access to its email accounts. Changing passwords frequently can make it harder for attackers to guess or crack the passwords, and can limit the damage if a password is compromised.

The other three risk treatment options are:

Risk avoidance: This option involves eliminating the risk source or discontinuing the activity that causes the risk. For example, Company A could avoid the risk of email compromise by not using email at all, but this would also mean losing the benefits of email communication.

Risk retention: This option involves accepting the risk and its consequences, either because the risk is too low to justify any treatment, or because the cost of treatment is too high compared to the potential loss. For example, Company A could retain the risk of email compromise by not implementing any security measures, but this would expose the company to potential breaches and reputational damage.

Risk transfer: This option involves sharing or transferring the risk to a third party, such as an insurer, a supplier, or a partner. For example, Company A could transfer the risk of emailcompromise by outsourcing its email service to a cloud provider, who would be responsible for the security and availability of the email accounts.

References:

ISO/IEC 27001:2013, clause 6.1.3: Information security risk treatment

ISO/IEC 27001 Lead Implementer Course, Module 4: Planning the ISMS based on ISO/IEC 27001

ISO/IEC 27001 Lead Implementer Course, Module 6: Implementing the ISMS based on ISO/IEC 27001

ISO/IEC 27001 Lead Implementer Course, Module 7: Performance evaluation, monitoring and measurement of the ISMS based on ISO/IEC 27001

ISO/IEC 27001 Lead Implementer Course, Module 8: Continual improvement of the ISMS based on ISO/IEC 27001

ISO/IEC 27001 Lead Implementer Course, Module 9: Preparing for the ISMS certification audit

ISO 27001 Risk Assessment & Risk Treatment: The Complete Guide - Advisera1

Infosec Risk Treatment for ISO 27001 Requirement 8.3 - ISMS.online2

ISO 27001 Clause 6.1.3 Information security risk treatment3

ISO 27001 Risk Treatment Plan - Scrut Automation4