I85PREP
⌘ K
PECB ISO 28000 Foundation study materials
PECB ISO 28000 Foundation study resources

PECB ISO 28000 Foundation practice questions

One question at a time. Build your PECB ISO 28000 Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of security management and an SeMS based on ISO 28000

In ISO 28000, what does the term "security management system" (SeMS) primarily describe?

  1. A government licence permitting an organization to trade internationally
  2. A framework of interrelated processes used to establish security policy, objectives, and arrangements to achieve those objectives Correct answer.
  3. A software tool installed at the gate to record vehicle movements
  4. A contractual annex listing the security guards assigned to each warehouse

Explanation

A management system is a set of interrelated or interacting elements, including policy, objectives, processes and resources, used to direct and control an organization with regard to security. It is not a document annex, an IT product, or a regulatory permit. The SeMS is the governance and process architecture through which security risks are managed.

Question 2Fundamental concepts and principles of security management and an SeMS based on ISO 28000

According to the ISO management system model, which sequence best reflects the logic of continual improvement applied to a SeMS?

  1. Design, Test, Deploy, Archive
  2. Identify, Purchase, Install, Insure
  3. Plan, Do, Check, Act Correct answer.
  4. Buy, Build, Sell, Retire

Explanation

ISO management system standards are built on the Plan-Do-Check-Act cycle, in which objectives and processes are planned, implemented, monitored, and then improved. This cycle drives continual improvement rather than a one-off project. The other sequences describe commercial or engineering lifecycles, not the management system model.

Question 3Fundamental concepts and principles of security management and an SeMS based on ISO 28000

An organization adopts ISO 28000 and states that its security objectives must be measurable and monitored. Which management system principle does this most directly reflect?

  1. Evidence-based decision making supported by performance evaluation Correct answer.
  2. Informal verbal communication
  3. Purchasing leverage over suppliers
  4. Individual heroism during incidents

Explanation

Setting measurable objectives and monitoring performance reflects evidence-based decision making and the performance evaluation element of a management system. Decisions about security should rest on data rather than intuition or personality. The other options are not management system principles.

Question 4Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which statement best describes the relationship between ISO 28000 and other ISO management system standards such as ISO 9001 or ISO 14001?

  1. They share a common high-level structure, so a SeMS can be integrated with quality or environmental management systems Correct answer.
  2. ISO 28000 replaces quality and environmental standards entirely
  3. They can only be combined if a certification body writes a new standard
  4. They are mutually exclusive, so an organization must choose only one to implement

Explanation

ISO management system standards use a harmonized high-level structure with common core text, which allows organizations to align or integrate multiple systems. This reduces duplication of policy, documentation and audit processes. They coexist rather than exclude or replace one another.

Question 5Fundamental concepts and principles of security management and an SeMS based on ISO 28000

In security risk terminology, what is the meaning of "risk appetite"?

  1. The total value of insured assets at a facility
  2. The maximum number of guards permitted per shift
  3. The list of incidents recorded in the previous year
  4. The amount and type of risk an organization is willing to pursue or retain Correct answer.

Explanation

Risk appetite expresses the level of risk an organization is prepared to accept in pursuit of its objectives, and it guides how risk treatment decisions are made. It is a governance statement, not an asset value, a staffing limit, or a historical record. Risk criteria and tolerances are then set consistently with that appetite.

Question 6Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which pair correctly distinguishes a "vulnerability" from a "threat" in a supply chain security assessment?

  1. A vulnerability is a person; a threat is a building
  2. A vulnerability is a legal penalty; a threat is a contract clause
  3. A vulnerability is an insurance policy; a threat is a premium
  4. A vulnerability is a weakness that could be exploited; a threat is a potential cause of an unwanted incident Correct answer.

Explanation

A vulnerability is an intrinsic weakness in an asset, process or control, while a threat is a potential source of harm that may exploit that weakness. Risk arises from the interaction of threat, vulnerability and consequence. The other pairs confuse these concepts with people, legal instruments or financial products.

Question 7Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A logistics company defines the scope of its SeMS as "all cargo handling and staging activities at its two port terminals". Why is a clearly defined scope important?

  1. It transfers legal liability to the port authority
  2. It sets the boundaries within which the security management system requirements are applied and assessed Correct answer.
  3. It removes the need for management review
  4. It guarantees that no security incident can occur outside the terminals

Explanation

Scope defines the organizational and physical boundaries to which the SeMS applies, so that requirements, controls and audits are applied consistently. It does not provide a guarantee against incidents, replace management review, or shift legal liability. Interfaces outside the scope must still be considered as context.

Question 8Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which of the following is the best example of a leading indicator for supply chain security performance?

  1. Percentage of suppliers that completed security awareness training this quarter Correct answer.
  2. Number of cargo thefts reported last year
  3. Total insurance claims paid after incidents
  4. Count of police investigations closed

Explanation

Leading indicators measure preventive activities and conditions that predict future performance, such as training completion or control testing. Lagging indicators, like theft counts or claims paid, record outcomes after the fact. A balanced measurement set uses both, but only the training figure is forward-looking.

Question 9Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A warehouse operator identifies that a subcontractor's drivers have unescorted access to a bonded area. Which SeMS concept does this situation primarily illustrate?

  1. An opportunity to reduce insurance premiums
  2. A security risk arising from a third-party interface that requires assessment and treatment Correct answer.
  3. A documentation error in the security policy
  4. A failure of the internal audit schedule

Explanation

Third parties create interfaces where the organization's controls may not fully apply, generating security risk that must be assessed and treated through contractual or procedural controls. The issue is substantive access risk, not merely a policy typo, audit timing, or insurance pricing. Managing supplier and contractor interfaces is a core element of supply chain security.

Question 10Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Under a risk-based SeMS, how should an organization decide whether to treat, transfer, avoid, or accept a specific identified security risk?

  1. By delegating the decision to the lowest-paid guard on shift
  2. By always accepting the risk to avoid spending money
  3. By comparing the assessed risk against defined risk criteria and appetite, then selecting the most appropriate treatment Correct answer.
  4. By treating every risk with the same fixed control regardless of level

Explanation

Risk treatment options are selected by evaluating assessed risk against established criteria and appetite, considering cost and effectiveness of controls. Blanket acceptance or uniform controls ignore the differing significance of risks. Decisions must be made at an appropriate level of authority and recorded.

Question 11Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A security manager wants the SeMS to reflect the organization's context. Which activity best demonstrates this?

  1. Adopting the most expensive technology available on the market
  2. Copying another company's security manual without modification
  3. Restricting all planning to the security department without consultation
  4. Analysing internal and external issues, interested parties, and legal and regulatory obligations that affect security Correct answer.

Explanation

Understanding the organization and its context requires identifying external and internal issues, the needs of interested parties, and applicable legal and regulatory requirements relevant to security. This analysis shapes the scope, risk criteria and objectives of the SeMS. Copying foreign manuals or buying technology without analysis ignores context.

Question 12Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which statement about the role of top management in an ISO 28000-based SeMS is most accurate?

  1. Top management may delegate all security responsibility to a single guard and take no further part
  2. Top management must demonstrate leadership by establishing security policy, objectives, and integrating security into business processes Correct answer.
  3. Top management should avoid setting objectives so that staff can decide them
  4. Top management's role is limited to signing the certification contract

Explanation

Management system standards place leadership at the centre: top management establishes policy and objectives, provides resources, and integrates requirements into business processes. Leadership cannot be fully delegated to an operational role. Signing contracts or abstaining from objectives falls short of the required commitment.

Question 13Fundamental concepts and principles of security management and an SeMS based on ISO 28000

An organization sets a security objective to "reduce unauthorized access events at the main gate by 40% within twelve months". Which characteristic makes this a well-formed objective under a SeMS?

  1. It is vague enough to be interpreted differently by each shift
  2. It is specific, measurable, time-bound and relevant to a defined security risk Correct answer.
  3. It is unrelated to any identified risk
  4. It is impossible to measure so it cannot be challenged

Explanation

Security objectives should be consistent with policy, measurable where practicable, monitored, and linked to identified risks and legal or other requirements. A specific target with a percentage and a timeframe meets these qualities. Vagueness, immeasurability or irrelevance undermines the objective's value.

Question 14Fundamental concepts and principles of security management and an SeMS based on ISO 28000

What is the primary purpose of a security policy within an ISO 28000-based SeMS?

  1. To record the names of all visitors to a site
  2. To state top management's commitment and direction for security, providing a framework for setting objectives Correct answer.
  3. To list every individual control procedure in operational detail
  4. To replace the need for risk assessment

Explanation

The security policy is a concise statement of intent and direction that commits the organization to meeting applicable requirements and continual improvement, and provides the framework for objectives. Detailed procedures and records sit below the policy level. A policy does not substitute for risk assessment.

Question 15Fundamental concepts and principles of security management and an SeMS based on ISO 28000

During a supplier evaluation, a company finds that a freight forwarder has no documented security procedures but has never had a recorded incident. How should this be interpreted in a risk-based SeMS?

  1. Absence of documented controls is a potential vulnerability, and the lack of past incidents does not prove adequate control Correct answer.
  2. Documented procedures are unnecessary because incidents are random
  3. The forwarder should be excluded from consideration without any assessment
  4. The clean incident history proves the forwarder's security is adequate, so no action is needed

Explanation

A risk-based approach evaluates the presence and effectiveness of controls, not merely historical outcomes, since absence of incidents may reflect luck or under-reporting. Undocumented controls represent a vulnerability at the third-party interface. Exclusion may be a treatment option but should follow assessment rather than replace it.

Question 16Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which activity best illustrates the "Check" phase of the PDCA cycle in a SeMS?

  1. Monitoring, measuring and auditing security performance against planned objectives Correct answer.
  2. Purchasing additional CCTV cameras
  3. Writing the security policy for the first time
  4. Assigning a new guard to the night shift

Explanation

The Check phase verifies whether planned arrangements are implemented and effective, through monitoring, measurement, internal audit and management review. Writing policy, deploying staff, or buying equipment are Do-phase activities. Findings from Check feed back into improvement.

Question 17Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Why does ISO 28000 emphasize a process approach rather than relying solely on individual procedures?

  1. Because procedures are prohibited in a management system
  2. Because managing interrelated processes as a system improves consistency and the achievement of intended security outcomes Correct answer.
  3. Because it allows each department to work in isolation
  4. Because processes eliminate the need for competent personnel

Explanation

The process approach means understanding how activities interact as a system, so that outputs and interfaces are managed coherently to achieve intended results. Procedures may support processes but are not prohibited, and competent people remain essential. Isolation between departments undermines, rather than supports, the approach.

Question 18Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which of the following best describes the concept of "continual improvement" in a SeMS?

  1. A guarantee that no security incidents will occur
  2. A single project completed before certification
  3. A requirement to replace all staff annually
  4. An ongoing recurring activity to enhance security performance, not a one-time corrective action Correct answer.

Explanation

Continual improvement is a recurring activity to enhance performance over time, supported by monitoring, audit findings, corrective actions and management review. It is not a one-off project, a staffing rule, or a guarantee of zero incidents. Improvement should be proportionate to risk and evidence.

Question 19Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A company's SeMS requires that personnel in security-critical roles be competent. Which evidence best demonstrates competence?

  1. Records of relevant training, qualifications and demonstrated ability to perform the assigned security tasks Correct answer.
  2. A signed statement that the employee feels confident
  3. The number of years the employee has lived in the country
  4. A copy of the company's security policy in the employee's locker

Explanation

Competence is demonstrated by education, training, experience and the resulting ability to perform assigned tasks, supported by records. Self-declared confidence, personal background, or mere possession of a policy document do not demonstrate the required competence. Competence gaps should be addressed through training or other actions.

Question 20Fundamental concepts and principles of security management and an SeMS based on ISO 28000

In ISO 28000 terminology, what is the main purpose of a security risk assessment?

  1. To assign blame for past incidents to individuals
  2. To produce a list of all assets in the organization
  3. To identify, analyse and evaluate security risks so that treatment decisions can be made Correct answer.
  4. To satisfy auditors without changing any practices

Explanation

Risk assessment comprises identification, analysis and evaluation of risk against criteria, providing the basis for treatment decisions. It is forward-looking and decision-oriented, not a blame exercise or a mere asset inventory. Its outputs inform the selection and prioritization of controls.

Question 21Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A security manager classifies a risk as "high" because its potential impact on human safety and continuity of operations is severe, even though its likelihood is low. Which principle does this illustrate?

  1. Risks should be judged only by financial cost
  2. Risk evaluation considers both likelihood and consequences against defined criteria Correct answer.
  3. Likelihood alone always determines the risk level
  4. Impact is irrelevant when likelihood is low

Explanation

Risk evaluation combines the likelihood of an event with the severity of its consequences and compares the result to defined criteria. A low-likelihood event with severe safety or continuity consequences can still be high risk. Ignoring either dimension or reducing everything to cost produces distorted priorities.

Question 22Fundamental concepts and principles of security management and an SeMS based on ISO 28000

An organization outsources screening of air cargo to a regulated third party. Which statement best reflects how the SeMS should treat this outsourced function?

  1. The outsourced process must remain within the control of the SeMS, with defined controls and monitoring of the provider Correct answer.
  2. Outsourcing removes the function from the scope of the SeMS entirely
  3. The provider's own certification fully replaces the organization's oversight obligations
  4. Only the provider's insurer is responsible for screening failures

Explanation

Outsourcing transfers activity but not accountability: outsourced processes must be controlled and monitored through defined criteria, contractual requirements and performance review. A provider's certification may provide assurance but does not remove the organization's oversight duty. Insurance addresses financial consequence, not operational control.

Question 23Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which situation most clearly indicates that a SeMS is not yet fully effective, despite having complete documentation?

  1. Internal audits are scheduled annually
  2. The security policy is signed by the chief executive
  3. Documented controls exist, but staff cannot describe them and monitoring records are absent Correct answer.
  4. Risk assessments are reviewed after significant changes

Explanation

Effectiveness concerns whether planned arrangements achieve intended results; documentation alone is not evidence of implementation. Staff unaware of controls and missing monitoring records show a gap between documented and actual practice. Signed policy, scheduled audits and periodic risk reviews are positive indicators.

Question 24Fundamental concepts and principles of security management and an SeMS based on ISO 28000

An organization's risk criteria state that any risk affecting the integrity of sealed containers with a severity above a defined threshold must be treated before shipment. A new route introduces such a risk. What is the most defensible action?

  1. Lower the threshold so that the risk falls below it
  2. Ship first and assess the risk after the first quarter
  3. Ignore the criteria because the route is new
  4. Apply treatment consistent with the criteria before allowing shipments on the new route Correct answer.

Explanation

Risk criteria are the organization's own decision rules and must be applied consistently, so a risk exceeding the threshold requires treatment before the activity proceeds. Retrospective assessment, ignoring criteria, or manipulating the threshold to avoid action all undermine the integrity of the SeMS. Changing criteria requires a legitimate management decision, not expedient adjustment.

Question 25Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A board asks why the SeMS should cover interfaces with carriers, customs brokers and customers rather than only internal operations. Which justification is most consistent with ISO 28000 principles?

  1. Only internal staff can ever cause a security incident
  2. Security risk in the supply chain arises across organizational boundaries, so interdependent parties must be addressed for controls to be effective Correct answer.
  3. Customer requirements are irrelevant to security management
  4. External parties always operate to the same standards as the organization

Explanation

Supply chain security depends on the weakest link, so the SeMS addresses the interfaces where goods, information and responsibility pass between parties. Assuming external parties share identical standards or that only internal staff pose risk is unfounded. Customer and regulatory requirements are part of the organization's context and obligations.

Question 26Fundamental concepts and principles of security management and an SeMS based on ISO 28000

In an ISO 28000-based SeMS, which statement best captures the meaning of "security" as distinct from general operational management?

  1. Activities aimed at preventing accidental damage during cargo handling
  2. Measures taken to protect people, assets, and operations from intentional harmful acts across the supply chain Correct answer.
  3. Procedures for maximizing throughput and reducing dwell time at terminals
  4. Financial controls that protect the organization from currency fluctuation

Explanation

In ISO 28000, security concerns deliberate, malicious acts that could harm people, goods, infrastructure, or continuity of the supply chain, rather than accidental or purely commercial losses. Quality, efficiency, and finance functions may overlap with security but do not define it. The distinguishing element is intentional harm from threats such as theft, tampering, fraud, or terrorism.

Question 27Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which statement describes the primary purpose of a Security Management System (SeMS) as understood in ISO 28000?

  1. To guarantee that no security incident will occur in the supply chain
  2. To certify individual security guards against a national licensing standard
  3. To provide a structured, risk-based framework of interrelated processes for managing security across the organization and its supply chain Correct answer.
  4. To replace contractual security obligations with a single documented procedure

Explanation

An SeMS is a management system: a set of interrelated or interacting elements, including policy, objectives, and processes, used to manage security risk systematically. It gives structure and consistency to how security is governed, assessed, and improved. It cannot guarantee the absence of incidents, nor is it a personnel licensing scheme.

Question 28Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which element of the PDCA cycle in an ISO 28000-based SeMS corresponds to establishing security objectives and the processes needed to deliver results?

  1. Do
  2. Check
  3. Act
  4. Plan Correct answer.

Explanation

In the PDCA model applied to management systems, Plan covers establishing the security policy, objectives, and the processes required to achieve them. Do is implementation, Check is monitoring and measurement, and Act is taking action for improvement. Assigning objectives to the planning stage is consistent with ISO management system conventions.

Question 29Fundamental concepts and principles of security management and an SeMS based on ISO 28000

What does the term "interested party" mean in the context of an ISO 28000-based SeMS?

  1. A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity Correct answer.
  2. A supplier that has signed a security annex to its contract
  3. A regulator that has issued a license to operate a port facility
  4. Any employee who holds a security-critical role in the organization

Explanation

Interested parties are stakeholders whose needs and expectations the organization must consider when establishing its SeMS, and they may include customers, regulators, employees, communities, and partners. The concept is broader than any single stakeholder category. Understanding interested parties is part of determining the organization's context.

Question 30Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which of the following best describes the relationship between a security policy and security objectives in an SeMS?

  1. The objectives set overall direction, while the policy lists the measurable results that must be achieved
  2. The policy and objectives are interchangeable terms for the same documented statement
  3. The policy is optional for small organizations, whereas objectives are mandatory for all
  4. The policy sets overall direction and commitment, while objectives translate that direction into measurable results to be achieved Correct answer.

Explanation

The security policy is a statement of top management's overall intentions and direction regarding security, including commitments to satisfy requirements and improve. Objectives are the specific, measurable outcomes derived from that direction. This hierarchy keeps operational targets aligned with strategic intent.

Question 31Fundamental concepts and principles of security management and an SeMS based on ISO 28000

In ISO 28000 terminology, what is a "security risk"?

  1. The effect of uncertainty on security objectives, arising from the combination of the likelihood of a harmful event and its consequences Correct answer.
  2. The financial loss resulting solely from damage to cargo in transit
  3. Any deviation from a documented procedure discovered during an internal audit
  4. A legal penalty imposed by a customs authority for documentation errors

Explanation

Security risk expresses the effect of uncertainty on security objectives, considering both how likely a harmful event is and how severe its consequences would be. It is broader than a single type of loss and is not the same as a nonconformity or a penalty. Risk assessment combines these two dimensions to support treatment decisions.

Question 32Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which statement best reflects the concept of "continual improvement" in an ISO 28000-based SeMS?

  1. Recurring activity to enhance security performance, carried out progressively and sustained over time Correct answer.
  2. Increasing the number of security guards annually regardless of risk
  3. A one-time project to close all open audit findings before certification
  4. Replacing the security policy each year with a newly written document

Explanation

Continual improvement is a recurring, ongoing activity to enhance performance, not a single event. It is driven by monitoring, audit results, incident lessons, and management review. Improvement should be directed by evidence and risk rather than by arbitrary targets such as headcount.

Question 33Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which of the following is an example of a documented information requirement that supports an ISO 28000-based SeMS?

  1. Marketing brochures describing the company's services
  2. Records of security risk assessments and their treatment decisions Correct answer.
  3. Minutes of social events organized by the staff association
  4. A list of employees' preferred shift patterns

Explanation

Documented information in an SeMS should provide evidence of the planning and operation of security processes, such as risk assessment results and treatment decisions. Records of this kind support traceability, audit, and management review. Unrelated administrative or promotional material does not serve that purpose.

Question 34Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A freight forwarder wants its SeMS to cover a newly acquired warehouse in another country. Which action best reflects applying the process approach?

  1. Add the site to the organization chart without changing any security processes
  2. Issue a memo declaring that the existing procedures apply unchanged to the new site
  3. Wait for the next scheduled certification audit before addressing the new site
  4. Identify the security processes at the new site, define their sequence and interactions with existing processes, and assign owners and controls Correct answer.

Explanation

The process approach means understanding processes as interrelated activities with defined inputs, outputs, interactions, and owners, and managing them as a system. Integrating a new site therefore requires mapping its processes and their interfaces with existing ones. A memo or an org chart change does not achieve that integration.

Question 35Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A shipping company's management review agenda contains only financial results. Which change would best align the review with ISO 28000 expectations?

  1. Replace the review with an annual email from the security manager
  2. Restrict the review to a summary of the previous year's insurance claims
  3. Add a standing item on competitor pricing and market share
  4. Include security performance, incident trends, risk assessment results, audit findings, and the status of corrective actions Correct answer.

Explanation

Management review should consider inputs relevant to the SeMS, such as performance against objectives, incidents, risk status, audit results, and corrective action status, so top management can direct improvement. Financial results alone do not provide that view. The review is a structured decision-making forum, not a report or a market analysis.

Question 36Fundamental concepts and principles of security management and an SeMS based on ISO 28000

An organization defines security roles but finds that warehouse supervisors do not know their responsibilities during a cargo tampering alert. Which SeMS element is most directly deficient?

  1. Control of monitoring and measuring equipment
  2. Management of calibration records for weighing scales
  3. Competence, awareness, and communication of roles and responsibilities Correct answer.
  4. Procurement criteria for office stationery

Explanation

When people do not understand their security roles and how to act in a defined situation, the deficiency lies in competence, awareness, and communication. ISO 28000 expects roles, responsibilities, and authorities to be assigned and communicated, and personnel to be competent for their security duties. Equipment calibration and stationery procurement are unrelated to this gap.

Question 37Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A logistics firm identifies that a new route passes through a region with frequent cargo theft. Which response best demonstrates risk-based planning in the SeMS?

  1. Prohibit all shipments on the route without further analysis
  2. Continue operating unchanged until an incident occurs on the route
  3. Assess the likelihood and impact for the route, then select and record treatment measures proportionate to the assessed risk Correct answer.
  4. Ask drivers to sign a personal declaration accepting the risk

Explanation

Risk-based planning requires assessing likelihood and consequences, then choosing treatment proportionate to the assessed level and recording the decision. Options that skip assessment, either by blanket prohibition or by inaction, are not risk-based. A declaration signed by drivers does not treat the risk to the organization.

Question 38Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which pair of concepts is correctly distinguished in an SeMS?

  1. A risk and a hazard are synonyms and are used interchangeably in ISO 28000
  2. A hazard is a potential source of harm, whereas a risk is the combination of the likelihood of harm and its consequences Correct answer.
  3. A hazard is an incident that has already occurred, whereas a risk is an incident that may occur
  4. A risk is a potential source of harm, whereas a hazard is the measured consequence of that harm

Explanation

A hazard is a potential source of harm, while risk combines the likelihood that harm occurs with the severity of its consequences. The two are related but distinct: hazards are identified, and the risks they present are assessed. Treating them as synonyms or reversing them leads to confused assessments.

Question 39Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A company's SeMS covers its own facilities but ignores the security practices of the trucking firms it contracts. Which principle of ISO 28000 does this most clearly conflict with?

  1. Delegating all security responsibility to the contracting authority
  2. Managing security across the supply chain, including the interfaces with partners whose activities affect the organization's security Correct answer.
  3. Limiting the SeMS to activities that occur inside a fenced perimeter
  4. Focusing exclusively on internal processes to keep the system simple

Explanation

ISO 28000 addresses security throughout the supply chain, including the interfaces with partners whose activities can affect the organization's security. Ignoring contracted carriers leaves a significant part of the risk unmanaged. The standard does not support confining the system to a fenced perimeter or delegating responsibility away.

Question 40Fundamental concepts and principles of security management and an SeMS based on ISO 28000

During an internal audit, a company finds that security risk assessments were performed once at start-up and never repeated. Which principle does this most directly violate?

  1. Risk assessments should be repeated exactly once every five years
  2. Risk assessments should be replaced by incident reports once operations stabilize
  3. Risk assessments should be performed only by external consultants
  4. Risk assessments should be updated when the context, threats, or operations change, so that treatment remains appropriate Correct answer.

Explanation

Risk assessment is an ongoing process, not a one-time event; changes in context, threats, operations, or incidents should trigger review and updating. Keeping a stale assessment means treatment decisions may no longer match reality. Neither a fixed five-year cycle nor reliance on incident reports alone satisfies this expectation.

Question 41Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which statement best explains why ISO 28000 emphasizes leadership and commitment from top management?

  1. Top management is the only group competent to perform security risk assessments
  2. Top management must personally guard facilities to demonstrate commitment
  3. Top management provides direction, resources, and integration of security into business processes, which subordinates cannot mandate on their own Correct answer.
  4. Top management commitment is required only for organizations seeking certification

Explanation

Top management sets direction, ensures resources, and integrates security requirements into the organization's business processes, giving the SeMS authority and sustainability. This is a governance role, not a technical one. Commitment is expected of all SeMS users, not only those seeking certification.

Question 42Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A port operator records many near-misses involving unauthorized persons near restricted areas but reports no actual breaches. How should the SeMS treat these near-misses?

  1. As matters to be excluded from management review to avoid alarm
  2. As irrelevant because no security objective was actually missed
  3. As valuable inputs for identifying weaknesses and improving controls before a real breach occurs Correct answer.
  4. As proof that the existing controls are fully effective

Explanation

Near-misses reveal weaknesses in controls and are useful leading information for prevention. An SeMS should capture, investigate, and learn from them rather than wait for actual breaches. Their absence of harm does not mean the controls are effective, and excluding them from review removes valuable learning.

Question 43Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which statement best describes the role of "context of the organization" in establishing an ISO 28000-based SeMS?

  1. It is a fixed template that all organizations must complete identically
  2. It refers only to the physical geography of an organization's facilities
  3. It determines the internal and external issues, interested parties, and scope that shape how the SeMS is designed Correct answer.
  4. It is established once and never revisited during the life of the SeMS

Explanation

Understanding the organization's context means identifying external and internal issues, relevant interested parties and their requirements, and the resulting scope and design of the SeMS. It is organization-specific and should be reviewed as circumstances change. It is not a uniform template or a purely geographic concept.

Question 44Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A security manager must decide how much detail to include in SeMS documented information. Which criterion best reflects ISO 28000 thinking?

  1. The extent needed to ensure the effective planning and control of security processes and to provide evidence of results Correct answer.
  2. Whatever format the largest customer's template requires, regardless of internal use
  3. The minimum possible volume, because documentation has no effect on security
  4. The maximum possible volume, because more documentation always improves security

Explanation

Documented information should be proportionate: sufficient to control processes and retain evidence of results, without unnecessary bureaucracy. Volume alone neither improves nor harms security, and external templates should be adapted to the organization's needs. The test is fitness for purpose, not quantity.

Question 45Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Which action best demonstrates that an organization has integrated security into its business processes rather than treating it as an add-on?

  1. A separate security department works in isolation and reports only to external auditors
  2. Security requirements are added to contracts only when a customer insists
  3. Security criteria are embedded in procurement, recruitment, and route planning decisions alongside cost and delivery factors Correct answer.
  4. Security is discussed only after an incident has been reported in the media

Explanation

Integration means security considerations are built into routine business decisions such as procurement, recruitment, and route planning, so they are applied consistently. Isolation, reactive discussion, or purely customer-driven compliance indicates security remains an add-on. Integration is a defining feature of a mature SeMS.

Question 46Fundamental concepts and principles of security management and an SeMS based on ISO 28000

An organization identifies a threat of insider collusion in its screening process. Which description of the risk is most complete for an SeMS risk assessment?

  1. A list of all screening equipment in use at the facility
  2. The name of the employee most likely to be involved
  3. The likelihood that insiders could bypass screening, the potential consequences for cargo integrity and reputation, and the existing controls Correct answer.
  4. A statement that insiders are untrustworthy

Explanation

A complete risk description combines likelihood, consequences, and the effectiveness of existing controls, so that treatment can be proportionate. Judgments about individuals or equipment inventories are inputs at best and do not constitute a risk description. The assessment must support a decision about treatment.

Question 47Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A company sets a security objective of reducing seal tampering incidents. Which set of elements makes the objective most consistent with ISO 28000 expectations?

  1. A target set only by the security manager without management approval
  2. A target that is deliberately unmeasurable to avoid accountability
  3. A broad aspiration with no target or owner
  4. A measurable target, an assigned responsible person, a timeframe, and a means of monitoring progress Correct answer.

Explanation

Security objectives should be measurable where practicable, assigned to a responsible party, time-bound, and monitored, so that progress can be tracked and reviewed. Broad aspirations, unapproved targets, or deliberately unmeasurable goals undermine accountability. Clear ownership and measurement are what make an objective actionable.

Question 48Fundamental concepts and principles of security management and an SeMS based on ISO 28000

An organization's SeMS relies on a single long-serving security manager who holds all knowledge of threat assessments in her head. Which analysis is most consistent with ISO 28000 principles?

  1. The SeMS is fragile because knowledge and processes are not documented or embedded, creating a single point of failure Correct answer.
  2. The SeMS is effective because no incidents have occurred so far
  3. The SeMS is robust because tacit expertise is always superior to documented processes
  4. The SeMS is compliant because documentation is optional for experienced staff

Explanation

A management system depends on processes that are defined, understood, and repeatable, not on one individual's memory. Concentrating knowledge in one person creates a single point of failure and undermines continuity and competence management. Past absence of incidents does not demonstrate that the system is effective.

Question 49Fundamental concepts and principles of security management and an SeMS based on ISO 28000

A company's risk criteria state that any risk with a severity above a defined threshold must be treated before operations proceed. A shipment would breach the threshold. Which decision is most consistent with a functioning SeMS?

  1. Proceed with the shipment and record the decision afterwards
  2. Lower the severity rating without evidence so the shipment falls below the threshold
  3. Ignore the criteria because commercial pressure outweighs them
  4. Apply the defined treatment or escalate for a documented, authorized exception before the shipment proceeds Correct answer.

Explanation

Risk criteria are only meaningful if they are applied consistently; when a risk exceeds the threshold, the required treatment must be applied or an exception must be formally authorized and documented. Proceeding first and recording later inverts the control. Adjusting ratings without evidence is manipulation of the assessment rather than management of risk.

Question 50Fundamental concepts and principles of security management and an SeMS based on ISO 28000

Two departments rate the same supplier risk very differently. Which SeMS improvement would most directly address this inconsistency?

  1. Remove supplier risk from the SeMS scope to avoid conflict
  2. Allow each department to keep its own method to preserve local flexibility
  3. Average the two ratings without examining the underlying assessments
  4. Establish common risk assessment methodology and criteria, and calibrate assessors across the organization Correct answer.

Explanation

Consistent risk decisions require a common methodology, defined criteria, and calibrated assessors so that ratings are comparable. Allowing divergent methods or simply averaging numbers masks the underlying disagreement. Excluding supplier risk from scope removes an important element of supply chain security.