A. Regular review of compliance

B. Regular review of contractual compliance

C. Return assets to their legal owners

D. Maintain contact with legal authorities

A. Review the consequences of unintended changes

B. Scheduling of second party audits

C. Document information security objectives

D. Perform information security risk assessments at planned intervals

A. They are proportionate to the likelihood of the nonconformity recurring

B. They always eliminate the cause of the nonconformity

C. They do NOT change the organization's information security policies

D. They are appropriate to the effects of the nonconformity

A. Both 1 and 2 are true

B. Only 2 is true

C. Neither 1 or 2 is true

D. Only 1 is true

A. Ensuring information security objectives are established

B. Communicating feedback from interested parties to the organization

C. Implementing the actions from internal audits

D. Producing a risk assessment report

A. Responsibilities and procedures

B. Protection of documents

C. Change control

D. Information security in supplier relationships