Question:A marketing agency has developed its risk assessment approach as part of the ISMS implementation.

Comprehensive and Detailed In-Depth Explanation:

ISO/IEC 27001 does not prescribe a specific risk assessment methodology but instead provides general requirements for risk assessment. Organizations are free to develop their own risk assessment methods, as long as they:

Identify risks and impacts on information security.

Define risk criteria for evaluating risks.

Implement risk treatment plans based on the organization's context.

A. Correct Answer:

ISO/IEC 27001 Clause 6.1.2 (Information Security Risk Assessment) states that organizations may define their own risk assessment methodology.

This approach must be systematic, measurable, and aligned with business objectives.

B. Incorrect:

Organizations are not required to use a recognized methodology like OCTAVE, MEHARI, or EBIOS, as long as their approach meets ISO requirements.

C. Incorrect:

ISO/IEC 27001 does not mandate a specific risk assessment method, only that a consistent and structured approach is used.

Relevant Standard Reference:

ISO/IEC 27001:2022 Clause 6.1.2 (Information Security Risk Assessment Process)