Control 5.27 requires knowledge gained from incidents to be used to strengthen and improve controls.

Information security is broadly defined as preserving confidentiality, integrity, and availability of information; it may also involve other properties such as authenticity and non-repudiation.

ISO/IEC 27002 requires equipment to be securely located and protected against physical and environmental threats, such as fire, water, dust, interference, and unauthorized access.

ISO/IEC 27002:2022 provides guidance for selecting, implementing, and managing information security controls. It is not the certification requirements standard; that role belongs to ISO/IEC 27001. ISO/IEC 27002 supports organizations by explaining the purpose of each control, the implementation guidance, and other related information needed to apply controls appropriately. Its controls are grouped into organizational, people, physical, and technological themes. The standard is intended to be used as a reference when organizations design security measures based on their risks, business needs, legal obligations, contractual requirements, and information security objectives. Therefore, option A is correct because "guidance" is the core function of ISO/IEC 27002. Option B is incorrect because ISO/IEC 27002 does not set mandatory requirements for certification. Option C is related to risk management, but it is not the main purpose of ISO
/IEC 27002; risk management guidance is more directly associated with ISO/IEC 27005. ISO/IEC 27002 guides control implementation after risk and control needs are determined. References/Chapters: ISO/IEC
27002:2022, Clause 1 Scope; Clause 4 Structure of the standard; Controls 5-8.

The organization should ensure that information security responsibilities are reassigned appropriately when an employee leaves or changes roles, preventing gaps in accountability.