ISO/IEC 27001:2022 requires the organization to define and apply an information security risk treatment process and to prepare a risk treatment plan. This is a mandatory requirement within clause 6 on planning. The purpose of the plan is to define how identified information security risks will be treated, which controls will be selected, and how the treatment decisions will be implemented. Therefore, it is not optional guidance or an audit note, but a formal requirement. For that reason, option B is correct.
=======
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit