A. It is a requirement to be fulfilled

B. None of the above

C. It is a recommendation, but not a requirement

D. It is only an observation to keep in mind when auditing the management system

A. The controls considered necessary

B. All of the above

C. Justification for the inclusion of controls

D. Justification for the exclusion of controls

A. Top management

B. The IT Security Manager

C. The Operations Manager

D. The quality management representative

A. None of the above

B. Risk remaining after risk treatment

C. Effect of uncertainty on objectives

D. Informed decision to take a particular risk

A. Ensuring that the information security policy and information security objectives are established and are compatible with the strategic direction of the organization

B. Hiring a consultancy to determine the best way to do it

C. Nothing is required

D. Appointing a volunteer to be responsible for the Information Security Management System