I85PREP
⌘ K
EXIN Information Security Essentials study materials
EXIN Information Security Essentials study resources

EXIN Information Security Essentials: Compliance, Standards and Best Practices

EXIN Information Security Essentials · Work through your exam, one topic at a time.

All guide sections

Compliance, Standards and Best Practices

Laws bind, standards guide, certifications give assurance. This domain tests which framework does what, and whether a stated compliance claim actually proves security. Expect questions that contrast certifiable standards with guidance documents.

Obligations and frameworks

  • Hierarchy: legislation, then regulation and regulators, then contracts, then standards and frameworks (voluntary unless adopted), then internal policy.
  • ISO/IEC 27001: certifiable requirements for an ISMS - scope, leadership, risk assessment, Annex A controls, Statement of Applicability, internal audit, management review, continual improvement.
  • ISO/IEC 27002: guidance for implementing controls, not certifiable. ISO/IEC 27005: risk-management guidance. ISO/IEC 27701: privacy extension. ISO 22301: business continuity. ISO 9001: quality.
  • NIST Cybersecurity Framework: voluntary, five functions - Identify, Protect, Detect, Respond, Recover.
  • COBIT addresses IT governance, ITIL addresses IT service management, PCI DSS is a contractual standard for card data, SOC 2 is an assurance report on controls.
  • GDPR: the controller determines purpose and means, the processor acts on instructions; principles include lawfulness, data minimisation, storage limitation and accountability.
  • Audits: first party is internal, second party is a customer or supplier, third party is an independent certification body; check the body's accreditation.

Worked example

A cloud provider claims it is ISO/IEC 27001 certified. Ask for the certificate, the scope statement showing which sites and services are covered, the Statement of Applicability, the validity dates and the accreditation of the certification body. A certificate covers only the defined ISMS scope, so a product outside that scope is unproven; for the specific controls you rely on, request the SOC 2 report and check its type and period.

Traps that cost marks

  • Describing ISO/IEC 27002 as certifiable; only 27001 is.
  • Equating compliance with security - you can comply fully and still be breached.
  • Assuming a supplier certificate covers the exact service you buy.
  • Confusing accreditation of the certification body with certification of the organisation.
  • Forgetting that the Statement of Applicability is where exclusions must be justified.