Which item is required to be defined when planning the organization's risk assessment process?

According to ISO/IEC 27001:2022, when planning and establishing the information security risk assessment process, the organization is explicitly required to define and maintain risk acceptance criteria. These criteria are fundamental to the risk management process as they establish the threshold for which risks are considered acceptable and which ones require treatment. Without these predefined criteria, risk evaluation and treatment decisions would be inconsistent and subjective, undermining the entire purpose of the Information Security Management System (ISMS).

A. The risk assessment must be applied to all information and assets within the defined ISMS scope; excluding parts is contrary to the standard's requirements.

B. The standard requires measuring the effectiveness of the ISMS as a whole (Clause 9.1), not specifically defining how to measure the effectiveness of the risk assessment method itself.

D. This is incorrect. ISO/IEC 27001 Clause 6.1.2 details several specific requirements for defining the risk assessment and treatment process, including risk criteria.

1. ISO/IEC 27001:2022, "Information security, cybersecurity and privacy protection — Information security management systems — Requirements":

Clause 6.1.2 c) 2) states that the information security risk assessment process shall "establish and maintain information security risk acceptance criteria". This is a direct and mandatory requirement.

2. ISO/IEC 27005:2022, "Information security, cybersecurity and privacy protection — Guidance on managing information security risks":

Section 6.3, "Risk criteria", provides detailed guidance on establishing risk criteria, including risk acceptance criteria. It explains that these criteria are "terms of reference against which the significance of risk is evaluated" and are crucial for making risk treatment decisions.

3. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page.

Chapter 11, "Risk Management", explains that a key step in the risk assessment methodology is to "define your risk acceptance criteria," which reflects the organization's risk appetite and is essential before evaluating identified risks. This text is widely used in academic and professional settings for ISO 27001 implementation.