I85PREP
⌘ K
PECB ISO 28000 Lead Auditor study materials
PECB ISO 28000 Lead Auditor study resources

PECB ISO 28000 Lead Auditor practice questions

One question at a time. Build your PECB ISO 28000 Lead Auditor understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of a security management system

In ISO 28000, what is the primary purpose of establishing a security management system (SeMS) for an organization?

  1. To replace all national regulatory requirements with international ones
  2. To provide a systematic framework for managing security risks and protecting the supply chain Correct answer.
  3. To certify the financial performance of logistics providers
  4. To guarantee that no security incident can ever occur within the organization

Explanation

A security management system gives an organization a structured, risk-based framework for identifying, controlling, and continually improving security across its operations and supply chain. It does not eliminate incidents or override national law; it complements legal obligations.

Question 2Fundamental principles and concepts of a security management system

Which concept best describes the 'Plan-Do-Check-Act' cycle as applied to an ISO 28000 security management system?

  1. A one-time project sequence performed only during initial certification
  2. A continuous improvement model in which security processes are planned, implemented, monitored, and adjusted Correct answer.
  3. A documentation format that replaces the need for risk assessment
  4. A financial auditing method used exclusively by external accountants

Explanation

PDCA is the continual improvement model underpinning ISO management system standards. Security objectives and processes are planned, implemented, checked through monitoring and audit, and improved through corrective action.

Question 3Fundamental principles and concepts of a security management system

In ISO 28000 terminology, what does the term 'security' primarily encompass?

  1. The protection of people, assets, information, and operations against security-related risks Correct answer.
  2. Exclusively the confidentiality of electronic data
  3. Only the physical guarding of buildings and perimeter fences
  4. The financial solvency of an organization's suppliers

Explanation

Within ISO 28000, security covers a broad range of threats affecting people, assets, information, and continuity of operations, not just physical guarding. It is risk-based and spans the whole organization and its supply chain.

Question 4Fundamental principles and concepts of a security management system

What is the role of 'top management' in an ISO 28000 security management system?

  1. Delegating all security decisions to the lowest operational level
  2. Providing leadership, direction, and commitment, including establishing security policy and objectives Correct answer.
  3. Performing only the internal audit function personally
  4. Outsourcing security accountability to an external certification body

Explanation

Top management must demonstrate leadership and commitment by establishing policy, objectives, and providing resources for the security management system. Accountability for the system cannot be delegated away or outsourced.

Question 5Fundamental principles and concepts of a security management system

Which statement best captures the meaning of a 'risk-based approach' in ISO 28000?

  1. Applying identical controls to every asset regardless of threat
  2. Prioritizing security controls according to assessed likelihood and consequence of threats Correct answer.
  3. Eliminating all risk before any operation may begin
  4. Relying solely on insurance to transfer security risk

Explanation

A risk-based approach means security controls are selected and prioritized according to the assessed likelihood and impact of identified threats. Resources are directed where risk is greatest rather than applied uniformly.

Question 6Fundamental principles and concepts of a security management system

What is the purpose of the security policy within an ISO 28000 system?

  1. To serve as a substitute for the risk assessment process
  2. To provide a documented statement of the organization's security intentions, principles, and commitment Correct answer.
  3. To list the names of every employee who has been disciplined for security breaches
  4. To record the annual profit and loss of the organization

Explanation

The security policy is a top-level document expressing the organization's commitment to security and the principles guiding its objectives. It provides direction for setting security objectives and controls.

Question 7Fundamental principles and concepts of a security management system

Which item is an example of an 'interested party' whose needs an ISO 28000 organization should consider?

  1. Only the organization's shareholders
  2. Only the external certification auditor
  3. Customers, regulators, employees, and supply chain partners Correct answer.
  4. A competitor's marketing department

Explanation

Interested parties include anyone affected by or with an interest in the organization's security performance, such as customers, regulators, employees, and supply chain partners. Their requirements inform the security management system.

Question 8Fundamental principles and concepts of a security management system

What does 'continual improvement' mean in the context of an ISO 28000 security management system?

  1. A recurring activity to enhance security performance over time Correct answer.
  2. Replacing the entire management system every year
  3. Achieving certification once and then making no changes
  4. Reducing security spending each year regardless of risk

Explanation

Continual improvement is the recurring process of enhancing security performance, informed by monitoring, audits, and corrective actions. It is an ongoing cycle rather than a one-time event.

Question 9Fundamental principles and concepts of a security management system

An organization identifies a new threat to its distribution network during a management review. According to the risk-based logic of ISO 28000, what is the most appropriate next step?

  1. Wait for a security incident to confirm the threat is real
  2. Assess the risk and determine whether additional security controls are needed Correct answer.
  3. Ignore the threat until the next scheduled certification audit
  4. Immediately terminate all distribution operations permanently

Explanation

When a new threat is identified, the organization should assess its likelihood and impact and decide whether existing controls are adequate or new ones are required. This reflects the risk-based, proactive nature of the security management system.

Question 10Fundamental principles and concepts of a security management system

Which of the following best distinguishes a security management system from a standalone security procedure?

  1. A management system is a coordinated set of interrelated processes with defined governance, while a procedure is a single documented way of performing a task Correct answer.
  2. A procedure includes top management commitment, while a management system does not
  3. A procedure always requires certification, while a management system never does
  4. A management system applies only to information technology, while procedures apply to physical sites

Explanation

A management system integrates governance, policy, risk assessment, and improvement processes into a coordinated whole. A procedure is a narrower, documented description of how a specific task is carried out.

Question 11Fundamental principles and concepts of a security management system

An auditor observes that an organization's security objectives are documented but have no measurable targets or deadlines. Which fundamental principle does this most directly challenge?

  1. The principle that security incidents must be hidden from regulators
  2. The principle that security objectives should be measurable and monitored Correct answer.
  3. The principle that only external auditors may set objectives
  4. The principle that all suppliers must be certified to ISO 28000

Explanation

ISO 28000 expects security objectives to be measurable, monitored, and tracked so performance can be evaluated. Objectives without targets or deadlines cannot be effectively monitored.

Question 12Fundamental principles and concepts of a security management system

What is the primary function of a risk assessment within an ISO 28000 security management system?

  1. To identify security threats, assess their likelihood and consequences, and determine risk levels to inform controls Correct answer.
  2. To calculate the organization's tax liability
  3. To replace the need for management review
  4. To assign blame to individual employees for past incidents

Explanation

Risk assessment identifies threats and evaluates likelihood and consequence so that risk levels can be determined and appropriate controls selected. It is a foundational input to security planning.

Question 13Fundamental principles and concepts of a security management system

How does ISO 28000 relate to the broader family of ISO management system standards?

  1. It replaces all other ISO management system standards
  2. It forbids integration with quality or environmental management systems
  3. It applies only to organizations with more than one thousand employees
  4. It uses a common high-level structure and terminology that allows integration with other management systems Correct answer.

Explanation

ISO 28000 follows a common high-level structure and shared terminology, enabling organizations to integrate security management with other management systems. This supports consistency and reduces duplication.

Question 14Fundamental principles and concepts of a security management system

An organization's security risk assessment is three years old and no threats have been reviewed since. What principle does this most clearly violate?

  1. The principle that security documentation should never be revised
  2. The principle that all risks must be eliminated before review
  3. The principle that risk assessments must be performed only by external parties
  4. The principle that risk assessment should be reviewed and updated to remain relevant Correct answer.

Explanation

Risk assessments must be kept current because threats, vulnerabilities, and business conditions change. A stale assessment cannot reliably inform controls and objectives.

Question 15Fundamental principles and concepts of a security management system

Which statement best describes the concept of 'supply chain security' as addressed by ISO 28000?

  1. Managing security risks across the network of organizations, processes, and logistics that deliver goods and services Correct answer.
  2. Protecting only the personal data of the organization's executives
  3. Ensuring that suppliers charge competitive prices
  4. Securing only the organization's own warehouse buildings

Explanation

Supply chain security addresses risks that span multiple organizations, processes, and logistics links, not just one facility. It requires coordination with partners and consideration of end-to-end risk.

Question 16Fundamental principles and concepts of a security management system

An organization wants to demonstrate conformity of its security management system to ISO 28000. What does third-party certification typically involve?

  1. A customer's informal verbal approval of the security policy
  2. A self-declaration by the organization with no external review
  3. A financial audit conducted by the organization's bank
  4. An independent certification body auditing the system against the standard's requirements Correct answer.

Explanation

Third-party certification involves an independent certification body auditing the management system against the standard's requirements. This provides external assurance beyond self-declaration.

Question 17Fundamental principles and concepts of a security management system

Which of the following is a 'security control' in the ISO 28000 context?

  1. A legal contract for office supplies
  2. A financial bonus paid to executives
  3. A measure that modifies or reduces a security risk, such as access control or monitoring Correct answer.
  4. A marketing slogan used in advertising

Explanation

A security control is a measure that modifies, reduces, or manages a security risk, such as access control, surveillance, or screening. Controls are selected based on the risk assessment.

Question 18Fundamental principles and concepts of a security management system

During an audit, an organization claims its security management system is effective because no incidents occurred last year. Why is this reasoning weak under ISO 28000 principles?

  1. Absence of incidents alone does not demonstrate that risks are identified, assessed, and controlled; effectiveness is judged against planned arrangements and objectives Correct answer.
  2. Because effectiveness can only be judged by counting incidents
  3. Because ISO 28000 requires a minimum number of incidents each year
  4. Because incidents are irrelevant to security management

Explanation

Effectiveness means achieving planned results and managing risk, not merely the absence of incidents. An organization may simply have been lucky or may not be detecting incidents. Auditors look for evidence of risk identification, control, and monitoring.

Question 19Fundamental principles and concepts of a security management system

An organization outsources a critical logistics function to a partner. How should this be treated within the ISO 28000 security management system?

  1. Security requirements and controls should be defined and monitored for outsourced processes that affect security performance Correct answer.
  2. The partner automatically inherits the organization's certification without review
  3. Outsourced processes are entirely outside the scope of the security management system
  4. Security responsibility transfers completely to the partner with no oversight

Explanation

When processes affecting security are outsourced, the organization remains responsible for defining requirements and monitoring performance. Outsourcing does not remove accountability for the security management system.

Question 20Fundamental principles and concepts of a security management system

Which pair of concepts best reflects the relationship between 'risk' and 'opportunity' in a modern ISO management system context?

  1. Opportunities must be eliminated because they introduce uncertainty
  2. Only adverse threats matter, and opportunities are irrelevant to security
  3. Risk applies to suppliers and opportunity applies only to customers
  4. Both adverse threats and potential positive outcomes should be considered when planning the security management system Correct answer.

Explanation

Modern management system thinking addresses both risks (potential adverse effects) and opportunities (potential positive effects) when planning. Considering both supports more balanced and effective decision-making.

Question 21Fundamental principles and concepts of a security management system

An auditor finds that security responsibilities are assigned to a manager who lacks the authority to allocate resources. Which principle is most directly undermined?

  1. The principle that security must be managed only by external consultants
  2. The principle that assigned security roles should carry the authority and resources needed to fulfill them Correct answer.
  3. The principle that authority is irrelevant to security performance
  4. The principle that security roles should never be documented

Explanation

Effective security management requires that assigned roles be supported by commensurate authority and resources. Without them, the responsible person cannot implement or maintain controls, weakening the system.

Question 22Fundamental principles and concepts of a security management system

Which statement most accurately reflects how ISO 28000 treats legal and other requirements?

  1. The organization must identify and comply with applicable legal, regulatory, and other security-related requirements Correct answer.
  2. Legal requirements are outside the scope of a security management system
  3. Organizations may choose which laws to follow based on cost
  4. Legal requirements apply only to organizations seeking certification

Explanation

ISO 28000 requires organizations to identify applicable legal and other requirements and ensure compliance as part of the management system. Compliance obligations apply regardless of certification status.

Question 23Fundamental principles and concepts of a security management system

What is the main purpose of monitoring and measurement within an ISO 28000 security management system?

  1. To provide evidence of security performance and the effectiveness of controls so decisions can be based on data Correct answer.
  2. To replace the need for management review and internal audit
  3. To measure only the financial return on security investment
  4. To create paperwork for the certification body to archive

Explanation

Monitoring and measurement generate data on security performance and control effectiveness, enabling informed decisions and improvement. They support, but do not replace, management review and audit.

Question 24Fundamental principles and concepts of a security management system

An organization defines its security management system scope to exclude a high-risk production site. What is the most significant consequence from an ISO 28000 perspective?

  1. The excluded site's security risks may go unmanaged, and the scope may no longer reflect the organization's actual security obligations Correct answer.
  2. The excluded site must immediately close its operations
  3. The exclusion has no effect because scope is irrelevant to audits
  4. The organization automatically becomes certified faster with no risk

Explanation

Scope determines which activities, facilities, and risks are covered by the management system. Excluding a high-risk site leaves those risks unmanaged and may make the declared scope misleading.

Question 25Fundamental principles and concepts of a security management system

Which statement best explains why ISO 28000 emphasizes a proactive rather than reactive approach to security?

  1. Reactive approaches are cheaper in every situation
  2. Proactive approaches eliminate the need for any incident response
  3. Identifying and treating risks before incidents occur reduces potential harm and disruption to the supply chain Correct answer.
  4. Reactive approaches are prohibited by law in all countries

Explanation

A proactive approach anticipates and treats risks before they materialize, reducing potential harm and disruption. It does not remove the need for incident response, which remains part of the system.

Question 26Fundamental principles and concepts of a security management system

In ISO 28000, what does the term 'security management system' primarily describe?

  1. A catalogue of physical guarding measures installed at a specific facility
  2. A contractual annex listing penalties for supply chain security breaches
  3. A documented set of interrelated elements an organization uses to establish security policy, objectives, and processes for managing security risks Correct answer.
  4. A one-off security vulnerability scan performed by an external provider

Explanation

A management system is a set of interrelated or interacting elements, including policy, objectives, processes and resources, used to achieve security outcomes. ISO 28000 treats security as something governed by a systematic, organization-wide framework rather than isolated measures. The other options describe single activities, documents, or controls, none of which constitutes a management system.

Question 27Fundamental principles and concepts of a security management system

An organization's leadership wants the security management system to reflect its strategic direction and be integrated with business processes. Which ISO 28000 principle does this most directly illustrate?

  1. Leadership and commitment, where top management aligns security with organizational strategy and integrates it into business processes Correct answer.
  2. Competence, where personnel receive training appropriate to their security roles
  3. Document control, where records are indexed and retained for defined periods
  4. Operational planning, where controls are implemented under specified conditions

Explanation

Leadership and commitment requires top management to ensure the security policy and objectives are compatible with strategic direction and that security is integrated into the organization's business processes. Document control, competence, and operational planning support the system but do not address strategic alignment and integration. The stem's emphasis on strategy and integration points squarely to the leadership principle.

Question 28Fundamental principles and concepts of a security management system

An auditor is assessing how an organization determines the boundaries and applicability of its security management system. Which consideration is most consistent with ISO 28000 principles?

  1. The scope should be limited to whichever sites are easiest to audit within the available budget
  2. The scope should exclude activities performed by suppliers because they are separate legal entities
  3. The scope should be fixed once at certification and never revisited during the certification cycle
  4. The scope should reflect the organization's activities, products, services, and interfaces with the supply chain over which it has control or influence Correct answer.

Explanation

Determining scope requires the organization to consider its context, including activities, products, services, and the supply chain interfaces it controls or influences. Scope is a substantive decision tied to risk and context, not an administrative convenience. It must also be reviewed as the organization and its context change, and suppliers within the chain cannot simply be ignored.

Question 29Fundamental principles and concepts of a security management system

Two organizations in the same logistics sector adopt ISO 28000. Organization A documents a fixed list of security controls copied from a peer, while Organization B derives its controls from an ongoing assessment of threats, vulnerabilities, and consequences specific to its operations. Which statement best reflects ISO 28000's risk-based logic?

  1. Organization B is better aligned, because controls should follow from the organization's own risk assessment and be updated as risks change Correct answer.
  2. Both are equally aligned, because ISO 28000 mandates a prescribed set of controls regardless of context
  3. Organization A is better aligned, because a fixed control list guarantees consistent coverage across the sector
  4. Organization A is better aligned, because copying peer controls demonstrates benchmarking against industry practice

Explanation

ISO 28000 is risk-based: security controls are selected and maintained in response to the organization's assessed threats, vulnerabilities, and consequences, and are revisited as those change. A static list copied from another organization cannot reflect a different risk profile and lacks the feedback loop that keeps controls relevant. Benchmarking may inform decisions but does not substitute for the organization's own risk assessment.

Question 30Security management system requirements

In ISO 28000, which clause establishes the requirement to define and document the scope of the security management system?

  1. Clause 6, Planning
  2. Clause 9, Performance evaluation
  3. Clause 4, Context of the organization Correct answer.
  4. Clause 8, Operation

Explanation

The scope of the security management system is determined within Clause 4, where the organization examines internal and external issues and interested parties before defining boundaries. Planning, operation, and performance evaluation all depend on that scope having been established first.

Question 31Security management system requirements

An auditor finds that top management has signed the security policy but never communicated it to contractors working on site. Which requirement is most directly unfulfilled?

  1. The policy must include a commitment to continual improvement
  2. The policy must be reviewed at planned intervals
  3. The policy must be documented as part of the management system
  4. The policy must be available and communicated within the organization Correct answer.

Explanation

ISO 28000 requires the security policy to be communicated to everyone working under the organization's control, including contractors and other relevant parties. Documentation and periodic review can be satisfied while communication is still missing, which is the gap observed here.

Question 32Security management system requirements

Which element must the security management system explicitly consider when determining risks and opportunities?

  1. Only risks rated high by the security manager
  2. Only threats identified by national law enforcement
  3. Only risks that have previously resulted in incidents
  4. Internal and external issues relevant to the organization's purpose Correct answer.

Explanation

Risk and opportunity determination in ISO 28000 is anchored in the context of the organization, so both internal and external issues must be considered. Restricting the analysis to legal threats, past incidents, or one person's rating would narrow the input below the standard's requirement.

Question 33Security management system requirements

What is the primary purpose of a security risk assessment within an ISO 28000 management system?

  1. To record every security incident that has occurred
  2. To satisfy insurers that premiums can be reduced
  3. To replace the need for internal audit of security processes
  4. To provide a systematic basis for selecting risk treatment and controls Correct answer.

Explanation

The risk assessment identifies and evaluates security risks so the organization can choose proportionate treatment and controls. It is an input to decision-making, not a substitute for audit, incident recording, or commercial negotiation.

Question 34Security management system requirements

An organization identifies a new supplier of logistics services. Under ISO 28000, what must the organization do regarding the security risks introduced by this relationship?

  1. Require the supplier to certify to ISO 28000 before any contract
  2. Transfer all responsibility for security to the supplier by contract
  3. Exclude the supplier from the risk assessment because it is external
  4. Define controls and criteria for the relationship and monitor supplier performance Correct answer.

Explanation

ISO 28000 requires the organization to determine controls for externally provided processes and to monitor performance of external providers against agreed criteria. Transferring responsibility, mandating certification, or excluding the supplier all avoid the organization's own accountability.

Question 35Security management system requirements

During an audit, a security manager states that risk treatment options were chosen based on professional judgement alone. What should the auditor examine to determine whether Clause 6 requirements are met?

  1. Documented information on the risk assessment and treatment process, including criteria used Correct answer.
  2. The number of guards employed at each site
  3. The organization's marketing material describing security services
  4. The curriculum vitae of the security manager

Explanation

The standard requires documented information about the risk assessment and treatment process, including the criteria applied and results. Professional judgement is acceptable only if the methodology and its basis are recorded and repeatable. Personal credentials, staffing levels, and marketing do not evidence the process.

Question 36Security management system requirements

Which statement best describes how ISO 28000 treats security risk treatment relative to the organization's risk criteria?

  1. Treatment options are selected and documented in line with the organization's risk criteria Correct answer.
  2. Treatment is only required for risks that exceed the insurance deductible
  3. Treatment must always prioritise physical barriers over procedural controls
  4. Treatment must be approved by an external certification body

Explanation

Risk treatment in ISO 28000 is selected and recorded in a manner consistent with the organization's own risk criteria and appetite. The standard does not prescribe a hierarchy favouring physical controls, nor does it tie treatment to insurance or external approval.

Question 37Security management system requirements

An organization's security objectives are stated as "improve security" with no measure, owner, or timeframe. Which requirement of Clause 6 is most clearly deficient?

  1. Objectives must be measurable, monitored, communicated, and updated as appropriate Correct answer.
  2. Objectives must be published on the public website
  3. Objectives must be identical across all business units
  4. Objectives must be approved by the board of directors annually

Explanation

ISO 28000 requires security objectives to be consistent with the policy, measurable where practicable, monitored, communicated, and updated. A vague aspiration without measures or ownership fails that requirement regardless of board or public involvement.

Question 38Security management system requirements

Which of the following best describes the hierarchy of controls expected when an organization plans security risk treatment?

  1. Deploy CCTV before assessing whether the risk can be avoided
  2. Rely on guards as the primary control for all identified risks
  3. Eliminate or reduce the risk at source before relying on detection and response measures Correct answer.
  4. Purchase insurance first, then consider physical protection

Explanation

ISO 28000 expects treatment to address risk at source where possible, with detection, response, and recovery measures layered on top. Starting with insurance, guarding, or surveillance inverts that logic and leaves the underlying risk unaddressed.

Question 39Security management system requirements

What must an organization do when a planned change to its operations could affect the security management system?

  1. Manage the change in a planned manner, considering the consequences for security Correct answer.
  2. Notify the certification body before implementing the change
  3. Reissue the security policy with a new version number
  4. Suspend all operations until the change is complete

Explanation

Clause 6 requires changes to be carried out in a planned way, with consideration of their consequences and any needed adjustments to controls or resources. Suspending operations, notifying the certification body, or reissuing the policy are not universal requirements.

Question 40Security management system requirements

An auditor reviews a risk register and finds that risks are recorded but no treatment decisions or residual risk evaluations appear. Which conclusion is most defensible?

  1. The organization has complied because risk registers are optional in ISO 28000
  2. The risk register is adequate because identification is the only requirement
  3. The organization has complied because treatment is an operational matter outside the standard
  4. The risk treatment process is incomplete because decisions and residual risk are not documented Correct answer.

Explanation

ISO 28000 requires documented information on risk assessment results and treatment, including how residual risk is evaluated against criteria. A register that stops at identification leaves the treatment process unevidenced and cannot demonstrate that risks are acceptable.

Question 41Security management system requirements

Which of the following is the most appropriate evidence that security risk assessment results have been used to inform operational controls?

  1. A list of all security equipment installed at each site
  2. A statement in the annual report that security is important
  3. Control procedures traceable to specific assessed risks and their treatment decisions Correct answer.
  4. Minutes of a meeting where risks were discussed without decisions

Explanation

Effective linkage is shown when operational controls can be traced back to assessed risks and documented treatment decisions. Equipment inventories, discussion minutes without outcomes, and public statements do not demonstrate that risk results drove control selection.

Question 42Security management system requirements

Which requirement applies to the organization's determination of legal and other requirements relevant to security?

  1. The organization must publish a register of all laws on its website
  2. The organization must retain a lawyer as a permanent member of the security team
  3. The organization must comply only with requirements of its home country
  4. The organization must identify, access, and keep up to date legal and other requirements applicable to its security risks Correct answer.

Explanation

ISO 28000 requires the organization to identify and have access to applicable legal and other requirements and to determine how they apply to its security risks. Retaining counsel, public disclosure, or limiting scope to the home country do not meet that requirement.

Question 43Security management system requirements

A port operator discovers that a new customs regulation affects its cargo screening process. What should the security management system require?

  1. Record the regulation in the incident log and continue current practice
  2. Wait for the next scheduled management review before taking any action
  3. Delegate compliance to the customs authority
  4. Update the compliance obligations and adjust controls and documented information accordingly Correct answer.

Explanation

Legal and other requirements must be kept current and their implications reflected in controls and documented information. Deferring action to the next review, logging it as an incident, or delegating compliance to the regulator all leave the organization non-compliant in the interim.

Question 44Security management system requirements

What is required regarding resources for the security management system?

  1. Resource decisions are outside the scope of the standard
  2. Resources must be outsourced to a security contractor
  3. The organization must determine and provide the resources needed for the system Correct answer.
  4. Resources must be allocated only after an incident occurs

Explanation

ISO 28000 requires the organization to determine and provide the resources necessary to establish, implement, maintain, and improve the security management system. Resource provision is a standing requirement, not a reaction to incidents, and cannot be delegated wholesale.

Question 45Security management system requirements

An auditor finds that security responsibilities are assigned to a named manager but no one has been given authority to approve changes to security controls. Which requirement is affected?

  1. Awareness of the security policy must be promoted
  2. Communication of significant security events must be planned
  3. Roles, responsibilities, and authorities relevant to security must be assigned and communicated Correct answer.
  4. Competence of persons doing work affecting security must be ensured

Explanation

The standard requires relevant roles to be assigned with both responsibility and authority, and communicated within the organization. Assigning accountability without the authority to act leaves the role incomplete, which is a distinct issue from competence, awareness, or communication planning.

Question 46Security management system requirements

Which of the following is the best evidence of competence for personnel performing security-critical tasks?

  1. The person's length of service in the organization
  2. A signed declaration that the person will follow all procedures
  3. Records of education, training, or experience against defined competence criteria Correct answer.
  4. A photograph on the site access badge

Explanation

Competence must be determined against defined criteria and supported by records of education, training, or experience. Declarations, tenure, and identification badges do not demonstrate that the required knowledge and skills are present.

Question 47Security management system requirements

Contract security guards are deployed at a facility. What does ISO 28000 require concerning their awareness of the security management system?

  1. Only permanent employees need awareness training
  2. Awareness is required only for staff who handle classified information
  3. Awareness is the contractor's responsibility and outside the system
  4. Persons working under the organization's control must be made aware of the policy, their contribution, and the implications of non-conformity Correct answer.

Explanation

Awareness requirements apply to all persons doing work under the organization's control, including contracted personnel. The organization cannot discharge this duty by attributing it entirely to the contractor, and the requirement is not limited to permanent staff or classified work.

Question 48Security management system requirements

Which activity best demonstrates that the organization has planned its internal and external security communications?

  1. Defined arrangements covering what, when, with whom, and how security information is communicated Correct answer.
  2. An intranet page that has not been updated for two years
  3. An email distribution list with no defined content or triggers
  4. A verbal understanding that the security manager will inform staff as needed

Explanation

ISO 28000 requires communication arrangements to be planned, specifying what will be communicated, when, to whom, and how. Stale pages, informal understandings, and undirected distribution lists lack the defined elements the standard expects.

Question 49Security management system requirements

How must documented information required by the security management system be controlled?

  1. It must be accessible to the public on request
  2. It must be available and suitable for use where and when needed, and protected as appropriate Correct answer.
  3. It must be retained for a minimum of ten years in all cases
  4. It must be stored only in paper form for legal validity

Explanation

Documented information must be controlled to ensure availability, suitability, and protection, including distribution, access, retrieval, and retention. Fixed ten-year retention, paper-only storage, and public access are not requirements of the standard.

Question 50Security management system requirements

An auditor finds two versions of a security procedure in use at different sites, with no indication of which is current. Which control of documented information has failed?

  1. Retention of records as evidence
  2. Protection of records from loss
  3. Determination of the scope of the management system
  4. Control of versions and changes to ensure the current version is available at points of use Correct answer.

Explanation

Controlling documented information includes managing versions and changes so that current documents are available where used and obsolete ones are prevented from unintended use. Loss protection, retention, and scope determination address different requirements.