Which statement correctly describes the relationship between risk assessment and risk treatment in an operational ISMS?
-
A
Risk treatment is performed first, then assessment validates the results
-
B
Risk assessment identifies and evaluates risks; risk treatment decides how to address them
-
C
Both activities are identical and can be performed by the same document
-
D
Risk assessment is only required for the initial ISMS certification audit