NCC Group interview question

ISO 27001, Risk Management, PCI-DSS