I85PREP
⌘ K
ISO 27001 Lead Auditor study materials
ISO 27001 Lead Auditor study resources

ISO 27001 Lead Auditor practice questions

One question at a time. Build your ISO 27001 Lead Auditor understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of Information Security Management System (ISMS)

Information security is defined in ISO/IEC 27000 as the preservation of which three properties?

  1. Confidentiality, authenticity and accountability
  2. Availability, privacy and traceability
  3. Confidentiality, integrity and availability Correct answer.
  4. Integrity, non-repudiation and reliability

Explanation

ISO/IEC 27000 defines information security as the preservation of confidentiality, integrity and availability of information. These three properties form the CIA triad on which ISMS controls are built. Other properties such as authenticity and non-repudiation may support these, but they are not part of the core definition.

Question 2Fundamental principles and concepts of Information Security Management System (ISMS)

An information security management system (ISMS) is best described as:

  1. A structured framework of processes for managing information security Correct answer.
  2. A one-off risk assessment performed before certification audits
  3. A software tool that blocks unauthorized network traffic and alerts staff
  4. A catalogue of technical controls applied to servers and endpoints

Explanation

A management system is a set of interrelated or interacting elements of an organization used to establish policies and objectives and processes to achieve those objectives, here applied to information security. It is a continuing, organization-wide framework rather than a product or a single activity.

Question 3Fundamental principles and concepts of Information Security Management System (ISMS)

Which document in the ISO/IEC 27000 family provides the overview and vocabulary for information security management systems?

  1. ISO/IEC 27005
  2. ISO/IEC 27000 Correct answer.
  3. ISO/IEC 27002
  4. ISO/IEC 27006

Explanation

ISO/IEC 27000 contains the overview of the family and the vocabulary, and its terms and definitions are normative for the other standards. The other documents in the family give guidance on controls, risk or certification body requirements.

Question 4Fundamental principles and concepts of Information Security Management System (ISMS)

The Statement of Applicability primarily records which of the following?

  1. The management review minutes for the last 12 months
  2. The audit programme for the certification cycle
  3. The necessary controls and their implementation status Correct answer.
  4. The competence records of the information security team

Explanation

The Statement of Applicability lists the controls the organization has determined necessary, with justification for their inclusion, their implementation status, and justification for any exclusion of Annex A controls. It is mandatory documented information under Clause 6.1.3.

Question 5Fundamental principles and concepts of Information Security Management System (ISMS)

The management system requirements of ISO/IEC 27001:2022 are contained in which clause range?

  1. Clauses 4 to 10 Correct answer.
  2. Clauses 1 to 3
  3. Clauses 11 to 13
  4. Annex A only

Explanation

ISO/IEC 27001:2022 follows the harmonized structure, with the auditable requirements in Clauses 4 to 10 covering context, leadership, planning, support, operation, performance evaluation and improvement. Clauses 1 to 3 are introductory, and Annex A lists controls rather than management system requirements.

Question 6Fundamental principles and concepts of Information Security Management System (ISMS)

Annex A of ISO/IEC 27001:2022 groups its controls into which themes?

  1. Confidentiality, integrity and availability pillars
  2. Preventive, detective and corrective control types
  3. Organizational, people, physical, technological Correct answer.
  4. Strategic, tactical and operational management layers

Explanation

The 2022 revision arranges its 93 Annex A controls into four themes: organizational, people, physical and technological. This replaced the 14 security domains used in the 2013 edition.

Question 7Fundamental principles and concepts of Information Security Management System (ISMS)

Continual improvement of the ISMS is addressed in which clause of ISO/IEC 27001:2022?

  1. Clause 8
  2. Clause 5
  3. Clause 6
  4. Clause 10 Correct answer.

Explanation

Clause 10 covers improvement: nonconformity and corrective action in 10.1, and continual improvement of the suitability, adequacy and effectiveness of the ISMS in 10.2. The surrounding clauses deal with planning, operation and leadership respectively.

Question 8Fundamental principles and concepts of Information Security Management System (ISMS)

The information security policy required by ISO/IEC 27001 must be:

  1. Documented and communicated within the organization Correct answer.
  2. Published on the public website in every language of operation
  3. Restricted to technical procedures for system administrators
  4. Approved each year by the certification body's lead auditor

Explanation

Clause 5.2 requires the policy to be documented, communicated within the organization, and available to interested parties as appropriate. It must also be appropriate to purpose, include objectives or a framework for setting them, and commit to satisfying applicable requirements and to continual improvement.

Question 9Fundamental principles and concepts of Information Security Management System (ISMS)

Which sequence reflects the risk assessment process required by ISO/IEC 27001?

  1. Treat risks, then evaluate them, then monitor them
  2. Evaluate risks, then identify them, then treat them
  3. Monitor risks, then analyse them, then identify them
  4. Identify risks, analyse them, then evaluate them Correct answer.

Explanation

Clause 6.1.2 establishes a process that identifies risks, analyses them in terms of consequences, likelihood and level, and evaluates them against risk criteria so they can be prioritised for treatment. Treatment follows evaluation and is addressed separately in 6.1.3.

Question 10Fundamental principles and concepts of Information Security Management System (ISMS)

Under ISO/IEC 27001, which set of options is available for treating information security risk?

  1. Modify, retain, avoid and share Correct answer.
  2. Prevent, detect, correct and recover
  3. Accept, transfer, insure and outsource
  4. Ignore, delegate, document and archive

Explanation

Risk treatment options recognized in the ISO/IEC 27000 family are modifying, retaining, avoiding and sharing risk. The chosen options are then translated into controls and actions in the risk treatment plan.

Question 11Fundamental principles and concepts of Information Security Management System (ISMS)

ISO/IEC 27001 requires information security objectives to be:

  1. Kept confidential and known only to top management
  2. Revised at every internal audit
  3. Measurable, monitored and communicated Correct answer.
  4. Set only by the certification body during audits

Explanation

Clause 6.2 requires objectives to be consistent with the policy, measurable where practicable, relevant to conformity and improvement, monitored, communicated, updated as appropriate, and documented. They are set by the organization itself, not by external parties.

Question 12Fundamental principles and concepts of Information Security Management System (ISMS)

Which of the following is a required input to the management review?

  1. The training plan of each customer organization
  2. The capital budget of the IT department
  3. Feedback on information security performance Correct answer.
  4. The audit programme for the next three years

Explanation

Clause 9.3.2 lists inputs including the status of actions from previous reviews, changes in issues and interested party requirements, and feedback on information security performance such as nonconformities, monitoring results, audit results and fulfilment of objectives.

Question 13Fundamental principles and concepts of Information Security Management System (ISMS)

When establishing its internal audit programme, an organization must consider:

  1. The budget approved by the finance department
  2. Process importance and results of previous audits Correct answer.
  3. The number of Annex A controls excluded in the SoA
  4. Only the availability of the internal auditors' calendar

Explanation

Clause 9.2 requires the audit programme to consider the importance of the processes concerned, changes affecting the organization, and the results of previous audits. The programme must be planned at planned intervals and cover the whole ISMS over time.

Question 14Fundamental principles and concepts of Information Security Management System (ISMS)

Clause 7.2 on competence requires the organization to:

  1. Certify at least one employee as an ISO 27001 lead auditor
  2. Deliver the same security awareness training to every employee annually
  3. Record the number of security incidents per employee
  4. Ensure that persons are competent for their work Correct answer.

Explanation

Clause 7.2 requires the organization to determine the necessary competence of persons doing work under its control, ensure those persons are competent on the basis of education, training or experience, and retain documented information as evidence.

Question 15Fundamental principles and concepts of Information Security Management System (ISMS)

When defining the scope of the ISMS, the organization must consider:

  1. Only the IT systems hosted in its own primary data centre
  2. The personal preferences of the certification body's audit team
  3. External and internal issues and interested party requirements Correct answer.
  4. Only the legal requirements of the country where it is registered

Explanation

Clause 4.3 requires the scope to take into account the external and internal issues identified under Clause 4.1 and the requirements of interested parties identified under Clause 4.2. Interfaces and dependencies with third parties must also be considered.

Question 16Fundamental principles and concepts of Information Security Management System (ISMS)

An organization is determining the interested parties relevant to its ISMS. What is it required to determine?

  1. The number of employees in each business unit
  2. Which of their requirements will be addressed by the ISMS Correct answer.
  3. The share price impact of each information security incident
  4. The names of every supplier that holds a copy of the policy

Explanation

Clause 4.2 requires the organization to determine the interested parties relevant to the ISMS and the requirements of those interested parties that will be addressed by the ISMS. This feeds directly into scope definition and legal and contractual obligations.

Question 17Fundamental principles and concepts of Information Security Management System (ISMS)

Which action best demonstrates top management leadership and commitment under ISO/IEC 27001?

  1. Signing the policy once and then not reviewing it
  2. Delegating all ISMS decisions to an external consultant
  3. Allowing the ISMS to operate separately from business strategy
  4. Integrating ISMS requirements into business processes Correct answer.

Explanation

Clause 5.1 expects top management to demonstrate leadership by ensuring policy and objectives are established, integrating ISMS requirements into the organization's processes, providing resources, communicating importance and promoting improvement. Integration into business processes is a direct expression of this.

Question 18Fundamental principles and concepts of Information Security Management System (ISMS)

When a nonconformity occurs, ISO/IEC 27001 requires the organization to:

  1. Report the nonconformity to the certification body within 24 hours
  2. Record the nonconformity but take no further action
  3. Immediately dismiss the person responsible for the failure
  4. Evaluate the need for action to eliminate its cause Correct answer.

Explanation

Clause 10.1 requires the organization to react to the nonconformity, evaluate the need for action to eliminate its cause so it does not recur, implement the action, review its effectiveness and update the ISMS if necessary. Documented information of the nonconformity and actions taken must be retained.

Question 19Fundamental principles and concepts of Information Security Management System (ISMS)

ISO/IEC 27001 requires the risk assessment process to produce:

  1. A ranking based only on financial impact
  2. A single risk score for the whole organization
  3. An identical risk register for all organizations in a sector
  4. Consistent, valid and comparable results Correct answer.

Explanation

Clause 6.1.2 requires the risk assessment process to be defined so that it produces consistent, valid and comparable results. This allows risks to be prioritised, tracked over time and compared across assessments.

Question 20Fundamental principles and concepts of Information Security Management System (ISMS)

Which of the following is a control requirement for documented information under Clause 7.5?

  1. It must be written in English and signed by the CEO
  2. It is protected against loss of integrity and confidentiality Correct answer.
  3. It must always be stored on a cloud platform approved by the auditor
  4. It must be retained for a minimum period of seven years

Explanation

Clause 7.5.3 requires documented information to be available and suitable for use where and when it is needed, and to be protected from loss of integrity, loss of confidentiality, or improper use. Distribution, access, retrieval, storage, retention and disposition must also be controlled.

Question 21Fundamental principles and concepts of Information Security Management System (ISMS)

How many controls does Annex A of ISO/IEC 27001:2022 contain, and in how many themes?

  1. 93 controls in 14 themes
  2. 35 controls in 5 themes
  3. 114 controls in 14 domains
  4. 93 controls in 4 themes Correct answer.

Explanation

ISO/IEC 27001:2022 restructured Annex A into 93 controls arranged across four themes: organizational, people, physical and technological. The 2013 edition contained 114 controls in 14 domains.

Question 22Fundamental principles and concepts of Information Security Management System (ISMS)

What distinguishes a risk owner from a person implementing a control in ISO/IEC 27001 terms?

  1. The risk owner must be a member of top management, whereas the implementer must be an internal auditor
  2. The risk owner approves the audit report, whereas the implementer writes the audit findings
  3. The risk owner signs the Statement of Applicability, whereas implementers do not
  4. The risk owner is accountable for the risk; implementers execute controls Correct answer.

Explanation

A risk owner is the person or entity with the accountability and authority to manage a risk, including deciding on and accepting treatment. Control implementers carry out the treatment activities on the risk owner's behalf and do not thereby become accountable for the risk.

Question 23Fundamental principles and concepts of Information Security Management System (ISMS)

Clause 6.1.3 requires the organization, when determining controls for risk treatment, to:

  1. Compare the chosen controls with Annex A for omissions Correct answer.
  2. Apply every Annex A control regardless of risk
  3. Obtain the auditor's prior approval of the selected controls
  4. Use only controls not listed in Annex A

Explanation

Clause 6.1.3 requires the organization to compare the controls it has determined as necessary with those in Annex A and verify that no necessary control has been omitted. This comparison, together with justifications for inclusion and exclusion, underpins the Statement of Applicability.

Question 24Fundamental principles and concepts of Information Security Management System (ISMS)

Which ISO/IEC 27000-family document provides guidance on monitoring, measurement, analysis and evaluation of ISMS performance?

  1. ISO/IEC 27007
  2. ISO/IEC 27005
  3. ISO/IEC 27003
  4. ISO/IEC 27004 Correct answer.

Explanation

ISO/IEC 27004 gives guidance on monitoring, measurement, analysis and evaluation, supporting the Clause 9.1 requirement to determine what is monitored and the methods used. The other documents address risk, audit and implementation guidance respectively.

Question 25Fundamental principles and concepts of Information Security Management System (ISMS)

ISO/IEC 27001 requires information security risk assessments to be performed:

  1. Only once, before the initial certification audit
  2. At least once every five years as set by the certification body
  3. At planned intervals or when significant changes are proposed or occur Correct answer.
  4. Only when a security incident has been reported externally

Explanation

Clause 6.1.2 requires the organization to define and apply a risk assessment process at planned intervals and when significant changes are proposed or occur. This keeps the risk picture and the treatment plan current and relevant.

Question 26Fundamental principles and concepts of Information Security Management System (ISMS)

In the ISO/IEC 27000 family, which statement describes the property of availability?

  1. Information is accurate and complete and has not been altered in an unauthorized way.
  2. Information is not made available to unauthorized individuals, entities or processes.
  3. Information is stored only within the organization's own data centres.
  4. Information is accessible and usable on demand by an authorized entity. Correct answer.

Explanation

Availability concerns timely and reliable access to information and systems for those entitled to use them. Confidentiality concerns non-disclosure to unauthorized parties, and integrity concerns accuracy and completeness. Together these three properties form the core of information security.

Question 27Fundamental principles and concepts of Information Security Management System (ISMS)

Clause 6.1.3 of ISO/IEC 27001 requires a Statement of Applicability that includes, for the Annex A controls, at least:

  1. Whether the control is necessary and, if so, whether it is implemented, with justification for inclusion or exclusion. Correct answer.
  2. Only the controls the organization has decided to implement, listed without further detail.
  3. The internal audit findings recorded against each control during the last audit cycle.
  4. The cost of each control and the name of the auditor who verified it.

Explanation

The Statement of Applicability is the bridge between the risk assessment and the controls actually in place. It must list the necessary controls, state which are implemented, and give reasons for both inclusions and exclusions. Audit findings and cost information are not part of this requirement.

Question 28Fundamental principles and concepts of Information Security Management System (ISMS)

How do ISO/IEC 27001 and ISO/IEC 27002 relate to each other?

  1. ISO/IEC 27002 contains the certifiable requirements, and ISO/IEC 27001 explains how to implement them in practice.
  2. ISO/IEC 27001 applies only to the IT function, whereas ISO/IEC 27002 applies to the whole organization.
  3. Both are certifiable requirement standards covering identical content and can be used interchangeably by an auditor.
  4. ISO/IEC 27001 holds certifiable requirements for an ISMS; ISO/IEC 27002 gives control implementation guidance. Correct answer.

Explanation

ISO/IEC 27001 is the requirements standard against which an ISMS can be audited and certified. ISO/IEC 27002 is a guidance standard that elaborates implementation practices for the Annex A controls. Conformity is assessed against 27001 requirements, not against 27002 guidance.

Question 29Fundamental principles and concepts of Information Security Management System (ISMS)

An organization's risk criteria state that any risk scoring above 15 on its 25-point scale must be treated. A new risk scores 18, and managers decide to accept it untreated because treatment would be expensive. Which statement best reflects ISO/IEC 27001 requirements?

  1. Acceptance is permitted provided the decision is recorded in the Statement of Applicability alongside the implemented controls.
  2. The defined risk criteria must be applied consistently; leaving a risk above the threshold untreated requires revising the criteria or treating the risk. Correct answer.
  3. Acceptance is permitted because risk criteria are advisory only and carry no weight in an ISO/IEC 27001 audit.
  4. Acceptance is always permitted, because top management may override the organization's own risk criteria whenever the cost of treatment is judged too high.

Explanation

Clause 6.1.2 requires the organization to establish risk criteria, including the level of risk it considers acceptable, and Clause 6.1.3 requires the treatment process to be applied against those criteria. A risk above the acceptance threshold must be treated, or the criteria themselves must be formally revised and approved. Otherwise the risk process is not being applied as defined.

Question 30Information Security Management System (ISMS)

Which of the following best describes what an organization must take into account when determining the scope of its ISMS?

  1. Internal and external issues, interested party requirements, and interfaces with other organizations Correct answer.
  2. The complete set of Annex A controls that the organization has chosen to implement, documented in the Statement of Applicability
  3. The physical locations where the organization's servers are hosted and the network segments that connect them to the internet
  4. Every business process that has been rated as high risk in the most recent risk assessment cycle, without exception

Explanation

Clause 4.3 requires the scope statement to consider external and internal issues, the requirements of interested parties, and the interfaces and dependencies between activities performed by the organization and those performed by others. The scope must be retained as documented information.

Question 31Information Security Management System (ISMS)

Clause 4.1 requires the organization to determine external and internal issues relevant to its purpose. What is the primary purpose of this activity?

  1. To capture only the legal and regulatory requirements applicable to the organization
  2. To define the audit criteria that internal auditors will apply during audits
  3. To understand the environment in which the ISMS operates Correct answer.
  4. To build the organization-wide threat catalogue that will be used during every risk assessment

Explanation

Clause 4.1 establishes the context in which the ISMS operates so that risks, interested party requirements and the scope are determined with a proper understanding of the organization's environment. This context is then maintained as input to planning and risk assessment.

Question 32Information Security Management System (ISMS)

When determining the interested parties relevant to the ISMS, what does ISO/IEC 27001 require the organization to determine?

  1. The identity of every employee and contractor together with their security clearance level
  2. The requirements of those interested parties that are relevant to the ISMS Correct answer.
  3. The list of suppliers whose contracts exceed a defined financial threshold
  4. The number of complaints received from customers during the previous year

Explanation

Clause 4.2 requires the organization to determine the interested parties that are relevant to the ISMS and the requirements of those parties that are relevant to information security. Only relevant requirements need to be determined and addressed by the ISMS.

Question 33Information Security Management System (ISMS)

Which of the following is a specific responsibility of top management under Clause 5.1 of ISO/IEC 27001?

  1. Performing the annual information security risk assessment for each operational department
  2. Ensuring that the resources needed for the ISMS are available Correct answer.
  3. Conducting the internal audits of the ISMS at the planned intervals defined in the audit programme
  4. Approving every individual access request raised by members of staff

Explanation

Clause 5.1 lists specific top management responsibilities, including ensuring that the resources needed for the ISMS are available. Top management must also integrate ISMS requirements into business processes, communicate the importance of the policy and promote continual improvement.

Question 34Information Security Management System (ISMS)

What does ISO/IEC 27001 require regarding the information security policy?

  1. It must be re-approved in full whenever any operational procedure is revised
  2. It must be documented and communicated within the organization Correct answer.
  3. It must be restricted to the senior management team and the ISMS manager
  4. It must be approved by an external certification body before release

Explanation

Clause 5.2 requires the policy to be established, documented and communicated within the organization, and to be available to interested parties as appropriate. It must also include commitments to satisfy applicable requirements and to continual improvement.

Question 35Information Security Management System (ISMS)

Clause 5.3 requires relevant roles to be assigned and communicated. For which of the following must responsibility and authority be assigned?

  1. Reporting on the performance of the ISMS to top management Correct answer.
  2. Maintaining the organization's payroll and human resource records
  3. Negotiating the terms of the certification audit with the certification body
  4. Approving the audit programme and selecting the audit team members

Explanation

Clause 5.3 requires responsibilities and authorities to be assigned and communicated for ensuring the ISMS conforms to the standard and for reporting on ISMS performance to top management. Other roles may be assigned as the organization sees fit.

Question 36Information Security Management System (ISMS)

ISO/IEC 27001 requires the information security risk assessment process to establish certain criteria. Which criteria are required?

  1. Audit frequency, auditor competence, and sampling methods
  2. Incident severity scales, escalation paths, and recovery targets
  3. Risk acceptance criteria and criteria for performing risk assessments Correct answer.
  4. Cost thresholds, supplier ratings, and asset depreciation rates

Explanation

Clause 6.1.2 requires the risk assessment process to establish risk acceptance criteria and criteria for performing information security risk assessments. The process must also produce consistent, valid and comparable results and be applied at planned intervals.

Question 37Information Security Management System (ISMS)

Under Clause 6.1.3, which of the following is an accepted way of treating an identified information security risk?

  1. Removing the risk from the risk register without further action
  2. Recording the risk as a nonconformity and closing it at the next audit
  3. Delegating the risk to the internal audit function
  4. Modifying the risk by applying appropriate controls Correct answer.

Explanation

Clause 6.1.3 expects risk treatment options to be selected, including modifying, retaining, avoiding or sharing the risk, and controls to be determined and implemented. The selected treatment must be documented and reflected in the Statement of Applicability.

Question 38Information Security Management System (ISMS)

What is the purpose of the Statement of Applicability?

  1. To describe the audit methods and sampling approach used for internal audits
  2. To record the competence and training evidence for all information security staff
  3. To state which Annex A controls are applied or excluded, and why Correct answer.
  4. To list every information asset owned by the organization together with its owner and location

Explanation

The Statement of Applicability identifies the Annex A controls considered necessary, states whether each is implemented, and records the justification for inclusion or exclusion. It is mandatory documented information under Clause 6.1.3.

Question 39Information Security Management System (ISMS)

How is Annex A structured in ISO/IEC 27001:2022?

  1. As 35 controls grouped into five domains
  2. As 114 controls grouped into 14 clauses
  3. As 93 controls grouped into four themes Correct answer.
  4. As 114 controls grouped into four themes

Explanation

The 2022 edition of Annex A contains 93 controls organised into four themes: organizational, people, physical and technological. The earlier 114-control structure with 14 clauses belongs to the 2013 edition.

Question 40Information Security Management System (ISMS)

Clause 6.2 requires information security objectives to be established at relevant functions and levels. Which characteristic must these objectives have?

  1. They must be reviewed only when a security incident occurs
  2. They must be measurable, monitored, and updated as appropriate Correct answer.
  3. They must be kept confidential from operational staff
  4. They must be approved by the certification body before implementation

Explanation

Clause 6.2 requires objectives to be consistent with the policy, measurable where practicable, monitored, communicated, updated as appropriate, and supported by plans describing what will be done, by whom, when and how results are evaluated.

Question 41Information Security Management System (ISMS)

Clause 7.2 addresses competence. What must the organization do for persons doing work under its control that affects information security performance?

  1. Ensure each person has at least five years of relevant professional experience
  2. Rotate personnel between security roles at least once every twelve months
  3. Determine the necessary competence and ensure persons are competent Correct answer.
  4. Verify that each person holds a recognised ISO/IEC 27001 lead auditor certificate

Explanation

Clause 7.2 requires the organization to determine the necessary competence, ensure those persons are competent on the basis of appropriate education, training or experience, and retain documented evidence where applicable.

Question 42Information Security Management System (ISMS)

Clause 7.5 requires documented information to be controlled. Which of the following is an explicit requirement of that control?

  1. It must be stored in a single central repository controlled by the ISMS manager
  2. It must be protected from loss of confidentiality, improper use or integrity Correct answer.
  3. It must be retained for a minimum of five years after the ISMS has been discontinued
  4. It must be reviewed by an external auditor before being issued

Explanation

Clause 7.5.3 requires documented information to be available and suitable for use where and when it is needed, and to be adequately protected, for example from loss of confidentiality, improper use or loss of integrity.

Question 43Information Security Management System (ISMS)

Clause 7.4 requires the organization to determine what to communicate in relation to the ISMS. Which aspects must be determined?

  1. The names of every employee who has reported a security incident during the year
  2. The marketing plan for publicising the organization's ISMS certification
  3. What, when, with whom, and how to communicate Correct answer.
  4. The budget allocated to information security and the return on investment achieved

Explanation

Clause 7.4 requires the organization to determine what to communicate, when to communicate, with whom, and how, taking into account internal and external communication needs relevant to the ISMS.

Question 44Information Security Management System (ISMS)

Clause 9.1 requires the organization to evaluate information security performance and the effectiveness of the ISMS. Which elements must be determined?

  1. Only the total number of security incidents recorded across the organization during the year
  2. What needs to be monitored and measured, the methods, when, and who Correct answer.
  3. Only the results of the most recent external certification audit performed by the certification body
  4. Only the performance metrics that the certification body has requested to see

Explanation

Clause 9.1 requires the organization to determine what needs monitoring and measuring, the methods to be used, when monitoring and measurement will be performed, and who will perform and analyse the results. The results must then be evaluated.

Question 45Information Security Management System (ISMS)

Clause 9.2 requires an internal audit programme. Which factors must the programme consider?

  1. The size of the organization's marketing budget and its forecast for the next financial year
  2. The importance of processes and the results of previous audits Correct answer.
  3. The personal preferences of the certification body's lead auditor regarding scheduling
  4. The number of employees in each department and their length of tenure

Explanation

Clause 9.2 requires the audit programme to be planned considering the importance of the processes concerned, changes affecting the organization and the results of previous audits. Frequency, methods, responsibilities and reporting must also be defined.

Question 46Information Security Management System (ISMS)

Which of the following is a required input to the management review under Clause 9.3?

  1. The organization's marketing strategy for the coming financial year
  2. The list of job applicants for current IT vacancies
  3. The salary bands applied to the information security team
  4. Feedback from interested parties, including complaints Correct answer.

Explanation

Clause 9.3 lists required inputs, including feedback from interested parties, changes in external and internal issues and in interested party requirements, and information on ISMS performance such as nonconformity trends, monitoring results, audit results and achievement of objectives.

Question 47Information Security Management System (ISMS)

Clause 10.2 requires the organization to react to a nonconformity. What must be done after evaluating the need for action to eliminate its cause?

  1. Issue a new version of the information security policy each time a nonconformity occurs
  2. Immediately suspend the certification of the ISMS until the matter is resolved
  3. Report the nonconformity to the relevant regulator within 24 hours
  4. Review the effectiveness of any corrective action taken Correct answer.

Explanation

Clause 10.2 requires reacting to the nonconformity, evaluating the need for action to eliminate the cause, implementing that action, reviewing the effectiveness of the corrective action, and updating risks and the ISMS where necessary, while retaining records of the nonconformity and actions taken.

Question 48Information Security Management System (ISMS)

What does Clause 10.1 of ISO/IEC 27001 require?

  1. Continual improvement of the ISMS's suitability, adequacy and effectiveness Correct answer.
  2. Annual re-certification by an accredited body
  3. Replacement of the ISMS every three years
  4. Independent external benchmarking of the ISMS against at least three competitor organizations

Explanation

Clause 10.1 requires the organization to continually improve the suitability, adequacy and effectiveness of the ISMS. Improvement is typically driven by monitoring results, audit findings, management review and corrective actions.

Question 49Information Security Management System (ISMS)

Which statement correctly distinguishes audit criteria from audit evidence?

  1. Audit criteria are the reference requirements; audit evidence is the verified information collected Correct answer.
  2. Audit criteria are the findings raised; audit evidence is the corrective action plan agreed
  3. Audit criteria are the auditor's personal opinions; audit evidence is the audit conclusion reached
  4. Audit criteria are the objective records collected by the auditor; audit evidence is the standard against which they are judged

Explanation

Audit criteria are the set of requirements used as a reference, while audit evidence consists of records, statements of fact or other verified information relevant to the criteria. Findings emerge from evaluating the evidence against the criteria.

Question 50Information Security Management System (ISMS)

An auditor finds that a required procedure exists and is being followed, but the approval record for one single document is missing. How is this best described?

  1. A major nonconformity requiring immediate suspension of certification
  2. A minor nonconformity against documented information control Correct answer.
  3. An observation that has no basis in the audit criteria and should not be recorded
  4. Conformity, because the procedure itself is followed in practice

Explanation

A single missing record where the process exists and is followed indicates a lapse rather than a systemic breakdown, and is normally classified as a minor nonconformity. Major nonconformities typically involve systemic failure or the absence of a required element.