10 questions every ISO, CISA and CISM candidate must get right.

Each question tests a concept examiners and interviewers return to again and again. After every answer you'll see why, the exam trap to avoid, and how it comes up in interviews.

Reviewed by cyber security professionals with 25+ years of experience each.

1 / 10

ISO/IEC 27001:2022Risk ownership and acceptance Expert-reviewed Exam & interview favourite

Scenario

An ISMS risk assessment rates the risk to the legacy payroll system as high, even after planned controls. The CISO wants the project closed, so the IT manager signs the risk acceptance form 'on behalf of the business'. The HR director, who owns payroll, has not seen the risk treatment plan.

Who must approve the risk treatment plan and accept the residual risk?