ISO 27001 Foundation common mistakes
ISO 27001 Foundation · Understand the traps and how to avoid them.
Treating ISO/IEC 27001 as a list of security controls to be implemented, and answering questions as if the standard prescribes specific technologies or safeguards.
Candidates confuse ISO/IEC 27001 (the management system requirements) with ISO/IEC 27002 (the control guidance catalogue), often because both are studied together.
What to do instead
Memorise the split: 27001 Clauses 4-10 define what the ISMS must do; Annex A/27002 supplies controls chosen via risk assessment. When a question asks 'what does 27001 require', answer in terms of management-system processes, not specific controls.
Confusing 'risk assessment' with 'risk treatment' and selecting the wrong one in scenario questions.
Both appear in Clause 6.1 and share vocabulary about risk, so candidates blur the analytical step with the decision/action step.
What to do instead
Anchor definitions: risk assessment = identify, analyse, evaluate; risk treatment = select and apply options plus produce a Statement of Applicability. Check whether the question asks for understanding the risk or for changing it.
Mixing up the Statement of Applicability (SoA) with the Risk Treatment Plan and describing the SoA as a schedule of activities.
Both are Clause 6 outputs and are produced close together, so their contents get merged in memory.
What to do instead
Remember the SoA as a justification document: it lists the controls deemed necessary and why, plus inclusion/exclusion justification. The risk treatment plan is the action plan with owners and timelines.
Answering 'who is responsible for the ISMS' with the security manager or IT department rather than top management.
In practice security teams run the day-to-day work, so candidates project organisational reality onto the standard's requirements.
What to do instead
Separate accountability from execution: Clause 5 places overall responsibility and integration into business processes on top management; operational roles are delegated. Look for 'top management' whenever the question mentions ultimate accountability, policy approval or resource provision.
Treating interested parties and the scope of the ISMS as fixed once documented, missing that they must be determined and reviewed as part of context.
Candidates memorise 'define scope' as a one-off project task rather than a living Clause 4 activity.
What to do instead
Link Clause 4.1-4.3 as a cycle: external/internal issues inform interested parties and their requirements, which inform scope. Expect questions where a business change (merger, new service, new regulation) should trigger a revisit of context and scope.
Describing internal audit and management review as interchangeable, or stating that internal audit decides whether certification is granted.
Both are Clause 9 evaluation activities and both produce reports, so their distinct purposes collapse together.
What to do instead
Keep them separate: internal audit checks conformity of the ISMS to requirements and the organisation's own arrangements; management review is top management evaluating suitability, adequacy and effectiveness, including inputs such as audit results. Certification comes from an external certification body, not internal audit.
Confusing corrective action (Clause 10) with corrective maintenance of a control, or with preventive action, and omitting root-cause analysis.
The word 'corrective' invites thinking about fixing the immediate symptom, which is what most people do at work.
What to do instead
Frame nonconformity handling as: react/contain, evaluate the need to eliminate the cause, determine and implement action, review effectiveness, update risks if needed. If an answer stops at 'fix the problem', it is incomplete.
Assuming certification is a one-off event and that the certificate has indefinite validity, or that a surveillance audit re-certifies from scratch.
Candidates learn the certification steps as a linear checklist and do not study the continuing cycle.
What to do instead
Memorise the cycle: certification audit (Stage 1 readiness, Stage 2 conformity), certificate typically valid three years, with surveillance audits in between and a recertification audit before expiry.
Mixing up documented information that must be 'maintained' versus 'retained', or assuming the standard mandates a fixed set of mandatory procedures and a quality-manual-style document.
Older management-system habits and the phrase 'documented information' lead candidates to invent a mandatory document list.
What to do instead
Use the standard's own distinction: maintain = keep up to date (e.g. scope, policy, risk assessment results); retain = keep as evidence (e.g. monitoring results, audit evidence). The standard requires documented information 'as necessary', not a prescribed manual.
Choosing answers that reflect good security practice generally rather than what the clause actually requires, especially on monitoring, measurement and communication.
Exam options are plausible and candidates default to intuition instead of recalling the clause structure.
What to do instead
Before answering, name the clause the question maps to (e.g. 9.1 monitoring and measurement, 7.4 communication) and reject options that exceed or contradict that clause's requirement, even if they sound sensible.