Certification exam preparation and management-system competence
What the exam tests
Management-system competence: process approach, PDCA, leadership, documented information, performance evaluation, audit, management review and continual improvement, applied to ISO/IEC 27032 guidance. Also scenario judgment: choose the best management response, not the most technical one.
Core distinctions
- ISO/IEC 27032 gives guidance; ISO/IEC 27001 is a certifiable management system standard. Do not claim ISO/IEC 27032 certification of an organization.
- A policy states intent; a procedure states how; a guideline advises; a record provides evidence.
- Correction fixes the immediate problem; corrective action addresses cause and prevents recurrence.
- A risk owner accepts risk; an asset owner manages the asset; a process owner runs the process.
- Management review takes inputs such as audit results, incidents, risk status and metrics, and produces decisions and actions.
Worked example
An audit finds backups are never test-restored. The best answer is not 'buy a new backup tool'. It is: record the nonconformity, identify the cause such as no assigned owner or schedule, plan corrective action with a test schedule and responsibility, verify effectiveness, and review at management review. This closes the management-system loop.
Traps
Choosing a product when the question asks for a process; treating 'should' as 'shall'; confusing correction with corrective action; skipping management review; assuming a guidance standard equals certification; ignoring scope and interested parties.