PECB Updated ISO-IEC-27001-Lead-Implementer Exam Questions and Answers by hendrix

Risk retention means accepting the risk, either knowingly or by default, often because it is deemed acceptable or cost-effective compared to the mitigation effort. In this scenario, the company assessed the risk and decided to accept it, which is classic risk retention.

“Risk retention involves knowingly accepting a risk. Risk retention can be a conscious decision based on risk assessment.”

— ISO/IEC 27001:2022, Clause 6.1.3, ISO/IEC 27005:2022, Section 8.3.2

An audit program provides the overall schedule, scope, and objectives for a series of audits. An audit plan is a document for a specific audit that describes activities, arrangements, and responsibilities.

“An audit program consists of one or more audits planned for a specific timeframe and direction. An audit plan describes how a particular audit will be conducted.”

— ISO/IEC 19011:2018, Clause 5.1 & 5.4

ISO/IEC 27002:2022 Clause 5.20 – Addressing information security within supplier agreements states:

“Agreements with suppliers should include requirements to address the information security risks associated with information and communications technology services and products provided by suppliers.”

Further emphasized in Clause 5.19 – Information security in supplier relationships, which mandates managing supplier-related risks.

This means contracts must include clauses addressing information security expectations, responsibilities, access rights, compliance, audits, and breach response mechanisms.