Free APMG-International ISO-IEC-27001-Foundation Exam Dumps

Clause 6.1.2 (Information security risk assessment) requires organizations to ''define and apply an information security risk assessment process that... establishes and maintains information security risk criteria, including criteria for accepting risk.''

This means that acceptable levels of risk (risk acceptance criteria) must be explicitly defined. These criteria ensure consistent decision-making when evaluating whether identified risks need further treatment or can be tolerated.

Option A is incorrect because exclusions relate to the ISMS scope (Clause 4.3), not risk assessment planning. Option B is not a requirement; effectiveness of risk assessment methods is not required to be measured, though methods must be applied consistently. Option D is false---the standard clearly specifies required elements for risk assessment.

Thus, the correct answer is C: The criteria for acceptable levels of risk.

Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27000 standards:

According to ISO/IEC 27000:2018, Clause 3.35:

''Integrity is the property of accuracy and completeness.''

This is one of the three core principles of information security (CIA triad):

Confidentiality: ensuring information is not made available to unauthorized persons (related to option B).

Integrity: ensuring data is accurate, complete, and unaltered except by authorized means.

Availability: ensuring information is accessible and usable when required (related to option A).

Option D incorrectly mixes availability and confidentiality. The precise ISO definition is accuracy and completeness, which matches option C.

Thus, the correct verified answer is C.