Answer the following statements true (T) or false (F)

1. The selection of recommended controls is not guided by legal requirements.
2. The recommended controls need to be compatible with the organization’s systems and policies.
3. The implementation phase comprises not only the direct implementation of the controls but also the associated training and general security awareness programs for the organization.
4. Appropriate security awareness training for all personnel in an organization, along with specific training relating to particular systems and controls, is an essential component in implementing controls.
5. The IT security management process ends with the implementation of controls and the training of personnel.

1. False
2. True
3. True
4. True
5. False