Answer the following statements true (T) or false (F)

1. The selection of recommended controls is not guided by legal
requirements.
2. The recommended controls need to be compatible with the
organization’s systems and policies.
3. The implementation phase comprises not only the direct
implementation of the controls, but also the associated training and general security awareness programs for the organization.
4. Appropriate security awareness training for all personnel in an
organization, along with specific training relating to particular systems and controls, is an essential component in implementing controls.
5. The IT security management process ends with the implementation of
controls and the training of personnel.

1. F
2. T
3 T
4. T
5. F