Competence and Management Review in a Logistics ISMS
TransRoute Logistics has an ISO/IEC 27001-certified ISMS covering its 1,400 employees and 22 distribution centres. Top management wants to 'add ISO/IEC 27032 certification' and has asked a consultant to prepare the internal audit team for the ISO/IEC 27032 Lead Cybersecurity Manager exam. The internal auditors have information-security auditing experience but no cybersecurity operations background. Management review minutes show only ISMS metrics such as audit findings and phishing click rates; there are no cybersecurity performance indicators, no scenario exercises, and no evidence that OT and cloud stakeholders participate. The consultant has a limited training budget and one month before the exam. The audit committee asks whether ISO/IEC 27032 is certifiable and how competence should be demonstrated.
1. Correct the statement that TransRoute can 'add ISO/IEC 27032 certification' and explain how ISO/IEC 27032 should be used alongside an ISO/IEC 27001 ISMS.
Read the worked answer
ISO/IEC 27032 is guidance, not a certifiable management system standard. TransRoute cannot be 'certified to ISO/IEC 27032'; its ISO/IEC 27001 certificate covers the ISMS. Individuals can sit an ISO/IEC 27032 Lead Cybersecurity Manager exam, but that is a personnel credential, not organizational certification. The correct use is to apply 27032 concepts to broaden the ISMS: cyberspace scope, stakeholder coordination across OT, cloud and business, cybersecurity risk, incident management, and continuous improvement. The existing ISO/IEC 27001 framework supplies the management system: policy, risk, competence, audit and management review. ISO/IEC 27032 adds cybersecurity-specific guidance where the ISMS is thin, such as IT-OT interfaces and multi-stakeholder incident response. The consultant should correct the audit committee in writing, map ISO/IEC 27032 guidance to existing processes, and avoid creating a parallel 'certification' project. This distinction is a common exam trap: guidance can inform conformity, but it does not create a certifiable requirement set.
2. Identify the competence gaps for the internal audit team and propose a one-month development plan within a limited budget.
Read the worked answer
Competence gaps: cybersecurity concepts and cyberspace scope; OT and cloud risk; threat and incident management; stakeholder coordination; regulatory notification; and the ability to audit technical controls without auditing like IT operations. One-month plan: week 1, gap self-assessment against the exam blueprint and read the standard's concepts; week 2, two half-day scenario workshops using TransRoute's OT and cloud cases; week 3, shadow a cybersecurity incident exercise and review the risk register; week 4, mock exam and peer review of one audit working paper. Low-cost evidence: training records, marked mock exam, workshop outputs, mentor sign-off, and observed audit interviews. The exam proves knowledge, not competence; the audit committee should also see supervised practice. Budget priority is a qualified mentor and exam fees, not expensive generic courses. The plan should assign each auditor a specific auditable area so learning transfers to the audit programme.
3. Recommend management review inputs and outputs that would demonstrate cybersecurity competence and continual improvement.
Read the worked answer
Management review inputs should include: status of cybersecurity risk treatment and exceptions; incident and near-miss trends; results of exercises and tabletops; stakeholder feedback from OT, cloud providers, regulators and customers; changes in threats, law and technology; supplier risk; audit findings; and cybersecurity performance metrics such as detection time, patch backlog and segmentation coverage. Outputs should be decisions: changes to policy and risk appetite, resource allocation, competence and training actions, incident readiness improvements, and assigned owners with dates. The review should also assess whether the ISMS scope still reflects cyberspace interactions. Evidence of competence includes training records, exercise participation, audit quality and the ability to explain risk decisions, not just exam passes. This makes continual improvement auditable and shows the audit committee that ISO/IEC 27032 is being used as guidance within the ISMS, not as a label.