Câu 9: Lead Implementer: PECB Certified ISO/IEC 27001 Lead Implementer

Which of the following statements regarding information security risk is NOT correct?

1. A. Information security risk is associated with the potential that the vulnerabilities of an information asset may be exploited by threats
2. B. Information security risk cannot be accepted without being treated or during the process of risk treatment — đáp án hiện tại
3. C. Information security risk can be expressed as the effect of uncertainty on information security objectives