I85PREP
⌘ K
PECB ISO 28000 LI study materials
PECB ISO 28000 LI study resources

PECB ISO 28000 LI practice questions

One question at a time. Build your PECB ISO 28000 LI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of an SeMS

Which document is the principal international standard that specifies requirements for a security management system and provides the framework assessed in ISO 28000 lead implementer engagements?

  1. ISO 28000 Correct answer.
  2. ISO/IEC 27001
  3. ISO 14001
  4. ISO 9001

Explanation

ISO 28000 is the management system standard for security and resilience in the supply chain, and it is the reference framework for a security management system (SeMS). ISO 9001 addresses quality, ISO 14001 addresses environmental management, and ISO/IEC 27001 addresses information security, so none of them is the SeMS requirements standard.

Question 2Fundamental principles and concepts of an SeMS

In an ISO 28000 security management system, what is the primary purpose of establishing the scope of the SeMS?

  1. To list every security incident recorded during the previous financial year
  2. To document the marketing strategy for security services offered to customers
  3. To define the boundaries and applicability of the management system so that its requirements apply to identified activities, assets and locations Correct answer.
  4. To assign the internal audit schedule for the next three years

Explanation

Scope determination fixes the organizational and physical boundaries, interfaces and dependencies to which the SeMS requirements apply. It is a foundational decision because objectives, risk assessment, controls and audits must all be consistent with that declared boundary.

Question 3Fundamental principles and concepts of an SeMS

A logistics operator states that its top management will provide resources, set security policy and review SeMS performance. Which concept does this behaviour best illustrate?

  1. Operational control
  2. Corrective action
  3. Management review input
  4. Leadership and commitment Correct answer.

Explanation

Leadership and commitment is demonstrated when top management sets direction, provides resources and takes accountability for the effectiveness of the management system. Operational control, corrective action and management review inputs are downstream activities that depend on this commitment rather than define it.

Question 4Fundamental principles and concepts of an SeMS

Which statement best describes the meaning of a process approach within a security management system?

  1. Security activities are managed as interrelated processes with defined inputs, outputs and performance measures Correct answer.
  2. Security performance is measured solely by the number of guards employed
  3. Security is delivered only through inspection checkpoints at warehouse exits
  4. Each department works independently without documented interfaces

Explanation

The process approach treats security work as a set of interconnected processes whose inputs, outputs, sequence and interaction are planned and monitored. This enables consistent results and systematic improvement instead of isolated activities or headcount-based measures.

Question 5Fundamental principles and concepts of an SeMS

Which element of the SeMS provides the ongoing cycle of planning, implementation, checking and improvement that underpins continual improvement?

  1. Root cause analysis
  2. Cost-benefit analysis
  3. Plan-Do-Check-Act Correct answer.
  4. First-in-first-out

Explanation

Plan-Do-Check-Act is the iterative cycle in which requirements are planned, implemented, monitored and improved. It underpins continual improvement of the management system and its security performance.

Question 6Fundamental principles and concepts of an SeMS

In ISO 28000 terminology, what does a security risk assessment primarily produce?

  1. A signed contract with a guarding subcontractor
  2. An understanding of threats, vulnerabilities and consequences that informs prioritized risk treatment decisions Correct answer.
  3. A complete inventory of all vehicles owned by the organization
  4. A schedule of employee holiday leave

Explanation

Security risk assessment identifies and analyses threats, vulnerabilities and potential consequences so that risk can be evaluated against criteria and treated. Its output is decision-support information, not procurement documents or administrative records.

Question 7Fundamental principles and concepts of an SeMS

Which of the following best describes the concept of a security culture within an SeMS?

  1. A contractual penalty clause imposed on suppliers
  2. A documented procedure kept in the security office and rarely consulted
  3. A one-time awareness campaign held during induction week only
  4. Shared values, attitudes and behaviours that make security a normal part of everyone's daily work Correct answer.

Explanation

Security culture refers to the shared assumptions and behaviours that shape how people act when no one is watching, making security part of routine work. Documents, penalties and one-off campaigns may support culture but do not constitute it.

Question 8Fundamental principles and concepts of an SeMS

What is the role of interested parties in the SeMS context?

  1. Their needs and expectations can shape security requirements and must be determined and considered Correct answer.
  2. They are limited to the organization's own employees
  3. They are excluded from consideration because only regulators matter
  4. They only matter after a security incident has occurred

Explanation

Interested parties such as customers, regulators, insurers and communities have needs and expectations that influence security requirements and obligations. The organization must determine relevant interested parties and understand which of their requirements it adopts.

Question 9Fundamental principles and concepts of an SeMS

A freight forwarder identifies that theft of high-value electronics during road transit is its most significant security concern. Which step logically follows the risk assessment in the SeMS cycle?

  1. Selecting and implementing risk treatment options consistent with the organization's risk criteria Correct answer.
  2. Waiting for a customer complaint before acting
  3. Publishing the risk assessment to competitors
  4. Removing the issue from the risk register because it cannot be eliminated

Explanation

After risks are identified and evaluated, the organization determines and applies treatment options such as controls, transfer or avoidance in line with its risk criteria. Ignoring the risk or waiting for external triggers defeats the purpose of the assessment.

Question 10Fundamental principles and concepts of an SeMS

Which statement best captures the relationship between security policy and security objectives in an SeMS?

  1. Objectives replace the policy once they have been written
  2. The policy is written only after all objectives have been achieved
  3. Policy and objectives are unrelated documents maintained by different teams
  4. The policy provides the overall direction and commitment from which measurable security objectives are derived Correct answer.

Explanation

The security policy expresses top management direction and commitment, while objectives translate that direction into measurable targets at relevant functions and levels. Objectives should be consistent with the policy, not a replacement for it.

Question 11Fundamental principles and concepts of an SeMS

An organization defines a security objective to reduce cargo tampering incidents by 30 percent within twelve months. Which characteristic makes this objective consistent with SeMS principles?

  1. It is expressed only as a general aspiration to be more secure
  2. It is measurable, time-bound and relevant to a significant security risk Correct answer.
  3. It focuses on reducing administrative paperwork costs
  4. It is assigned to no one and has no deadline

Explanation

Security objectives should be measurable, monitored and consistent with the security policy, with defined timeframes and responsibility. A quantified, dated target tied to a real risk satisfies those characteristics.

Question 12Fundamental principles and concepts of an SeMS

What distinguishes a threat from a vulnerability in SeMS risk analysis?

  1. A threat is a control measure, whereas a vulnerability is a residual risk
  2. A threat is a potential cause of harm, whereas a vulnerability is a weakness that a threat can exploit Correct answer.
  3. A threat is always internal, whereas a vulnerability is always external
  4. A threat is a legal requirement, whereas a vulnerability is a customer expectation

Explanation

Threats are potential sources of harm such as criminal actors or natural hazards, while vulnerabilities are weaknesses in assets, processes or controls that allow a threat to cause harm. Risk arises from the interaction of threat, vulnerability and consequence.

Question 13Fundamental principles and concepts of an SeMS

Which of the following best explains why documented information is required within an SeMS?

  1. It guarantees that no security incident will ever occur
  2. It provides evidence that processes are performed as planned and supports consistency and traceability Correct answer.
  3. It transfers legal liability to the document author
  4. It replaces the need for management review

Explanation

Documented information supports the operation of processes and provides evidence of conformity, enabling consistency, traceability and auditability. It cannot prevent all incidents, substitute for review, or shift liability to an individual author.

Question 14Fundamental principles and concepts of an SeMS

A warehouse manager records that access badges must be reviewed monthly and that the review result is filed. Which SeMS concept does this practice most directly support?

  1. Operational control Correct answer.
  2. Interested party analysis
  3. Scope definition
  4. Management commitment

Explanation

Operational control covers the implementation of planned arrangements and defined criteria for processes needed to meet security requirements. A recurring badge review with recorded results is a typical operational control.

Question 15Fundamental principles and concepts of an SeMS

What is the fundamental purpose of a nonconformity and corrective action process in an SeMS?

  1. To document customer complaints without further action
  2. To punish the employee who reported the issue
  3. To eliminate the cause of a nonconformity so that it does not recur Correct answer.
  4. To increase the number of audit findings recorded

Explanation

Corrective action addresses root causes so that a nonconformity does not recur, which is distinct from merely correcting the immediate symptom. The process is about learning and improvement, not blame or volume of findings.

Question 16Fundamental principles and concepts of an SeMS

Why does ISO 28000 emphasize a risk-based approach rather than prescribing a fixed set of security controls?

  1. Because risk assessment is only a formality with no bearing on controls
  2. Because security controls are optional and need not be implemented
  3. Because security needs vary with the organization's context, threats and risk criteria, so controls must be selected to fit assessed risk Correct answer.
  4. Because regulators forbid the use of physical security measures

Explanation

A risk-based approach recognizes that organizations face different threats, contexts and tolerances, so proportionate controls must be chosen from assessed risk. Prescribing uniform controls would not fit diverse operations or changing threat environments.

Question 17Fundamental principles and concepts of an SeMS

A security manager wants to ensure the SeMS covers contractors and suppliers who handle cargo. Which concept best supports this?

  1. Outsourced processes and external providers must be controlled and their security requirements defined Correct answer.
  2. Supplier security is only relevant to financial auditing
  3. Contractors are exempt from security requirements because they are not employees
  4. External providers are outside any management system influence

Explanation

Where processes are outsourced, the organization must ensure they are controlled and that relevant security requirements are communicated and monitored. Contractors and suppliers handling cargo are therefore within the influence of the SeMS.

Question 18Fundamental principles and concepts of an SeMS

Which of the following best describes how the SeMS should treat legal and other requirements?

  1. They are irrelevant because the standard is voluntary
  2. They must be identified, accessed and taken into account when establishing and maintaining the management system Correct answer.
  3. They are considered only during the initial certification audit
  4. They are delegated entirely to the legal department without security involvement

Explanation

The organization must identify applicable legal and other requirements and consider them in designing and operating the SeMS. Compliance obligations are ongoing and integrated, not a one-time or isolated activity.

Question 19Fundamental principles and concepts of an SeMS

What is the primary role of performance monitoring and measurement in an SeMS?

  1. To determine whether security processes and controls are achieving intended results and to identify where improvement is needed Correct answer.
  2. To produce data used only for annual financial reporting
  3. To confirm that no changes to the management system are required
  4. To replace the need for internal audits entirely

Explanation

Monitoring and measurement provide evidence on the effectiveness of the SeMS and its security performance so that decisions and improvements can be made. It complements internal audit and management review rather than replacing them.

Question 20Fundamental principles and concepts of an SeMS

In the SeMS, what distinguishes an internal audit from a management review?

  1. They are identical activities performed by the same person at the same time
  2. An internal audit is performed by top management, while management review is performed by external auditors
  3. An internal audit evaluates conformity and effectiveness of the management system, while management review is a top management evaluation of suitability, adequacy and effectiveness using inputs such as audit results Correct answer.
  4. An internal audit focuses on finances, while management review focuses on security

Explanation

Internal audit is a systematic, independent evaluation of conformity and effectiveness against planned arrangements and requirements. Management review is a higher-level evaluation by top management that considers audit results and other inputs to decide on improvement and change.

Question 21Fundamental principles and concepts of an SeMS

Which statement best reflects the concept of resilience in the context of ISO 28000?

  1. The ability of the organization and its supply chain to anticipate, absorb, adapt to and recover from disruptive events Correct answer.
  2. The ability to transfer every risk to an insurer
  3. The practice of ignoring low-probability events
  4. The capacity to avoid all forms of change in operations

Explanation

Resilience concerns the capacity to anticipate, prepare for, respond to and recover from disruptions while maintaining critical functions. It is broader than risk transfer and depends on adaptability rather than rigidity.

Question 22Fundamental principles and concepts of an SeMS

A company defines a security policy, identifies risks, and implements controls, but never measures performance or reviews the system. Which conclusion is most defensible under SeMS principles?

  1. The system is complete because a policy exists
  2. The system is incomplete because monitoring, audit and management review are needed to verify effectiveness and drive improvement Correct answer.
  3. The system is complete because controls have been implemented
  4. The system is complete because risk was assessed once at the start

Explanation

A functioning SeMS requires checking and improvement activities such as monitoring, internal audit and management review in addition to planning and implementation. Without these, effectiveness cannot be verified and continual improvement cannot occur.

Question 23Fundamental principles and concepts of an SeMS

Two organizations face the same theft threat but have different risk appetites. How should this difference be reflected in their SeMS?

  1. Risk appetite is irrelevant once a threat has been identified
  2. The organization with lower tolerance should ignore the threat to reduce costs
  3. Each organization should define risk criteria reflecting its own tolerance and select treatment accordingly Correct answer.
  4. Both must implement identical controls because the threat is the same

Explanation

Risk criteria express the organization's tolerance and are used to evaluate and prioritize risk, so identical threats can justify different treatment decisions. Applying uniform controls disregards context and tolerance.

Question 24Fundamental principles and concepts of an SeMS

An auditor finds that a security control was implemented and documented, but no one can explain how its effectiveness is evaluated. Which principle is most directly at stake?

  1. Scope of the management system
  2. Monitoring and measurement of control effectiveness Correct answer.
  3. Interested party identification
  4. Document control numbering

Explanation

Implementing a control without evaluating its effectiveness leaves the organization unable to know whether risk is actually being managed. Monitoring and measurement provide the evidence needed to judge whether controls achieve intended results.

Question 25Fundamental principles and concepts of an SeMS

Why is top management accountability considered fundamental rather than delegable in an SeMS?

  1. Because the management system's suitability, adequacy and effectiveness depend on decisions about direction, resources and risk acceptance that only top management can authorize Correct answer.
  2. Because top management personally performs all security guard duties
  3. Because external auditors require executives to write all procedures
  4. Because accountability can be fully transferred to a contractor

Explanation

Top management authorizes policy, allocates resources and accepts residual risk, which are decisions that determine whether the system is suitable and effective. These decisions cannot be fully delegated while accountability remains with leadership.

Question 26Fundamental principles and concepts of an SeMS

ISO 28000 describes the SeMS as following a continual improvement cycle. Which sequence correctly reflects the order of the main elements of that cycle as applied to security management?

  1. Establish policy and objectives, implement controls, monitor and measure, review and improve Correct answer.
  2. Implement controls, establish policy, review performance, allocate resources
  3. Identify interested parties, conduct management review, set objectives, implement controls
  4. Monitor performance, set objectives, conduct audits, establish policy

Explanation

The SeMS is built on a Plan-Do-Check-Act logic: security policy, objectives and risk-based planning come first, then implementation of controls, then monitoring and measurement, and finally review by top management leading to improvement. Each stage feeds the next, so performance data from monitoring informs the review that triggers updated objectives.

Question 27Fundamental principles and concepts of an SeMS

An organization's SeMS scope statement covers its container terminal but excludes a separately managed inland depot. What is the most important consequence of defining the scope in this way?

  1. The depot falls outside SeMS certification and control boundaries Correct answer.
  2. The depot automatically becomes an interested party of the SeMS
  3. The scope statement must be approved by the depot's customers
  4. The depot's security risks must still be assessed as if in scope

Explanation

The scope defines the physical, functional and organizational boundaries to which the SeMS and any certification apply, so activities outside it are not covered by the system's controls, monitoring or audit. The organization should still consider interfaces and dependencies with excluded activities, but they are not part of the certified boundary.

Question 28Fundamental principles and concepts of an SeMS

A logistics provider relies on a subcontractor for overnight warehousing. In SeMS terms, how should this relationship be treated?

  1. As an external issue that is irrelevant once the contract is signed
  2. As part of the organization's security risk picture and control arrangements Correct answer.
  3. As a control that the organization can delegate entirely
  4. As a legal requirement outside the SeMS scope

Explanation

Outsourcing transfers operational activity but not accountability: the organization must consider subcontractor-related threats and vulnerabilities in its risk assessment and ensure appropriate controls, such as contractual security requirements and monitoring, are in place. ISO 28000 expects the SeMS to address such externally provided processes that affect security performance.

Question 29Fundamental principles and concepts of an SeMS

Two managers debate whether the SeMS should focus on preventing incidents or on recovering from them. Which position is most consistent with ISO 28000's approach to security management?

  1. Prevention alone, because recovery planning belongs to business continuity
  2. Both, because the SeMS addresses prevention, preparedness, response and recovery Correct answer.
  3. Neither, because the SeMS only sets policy and leaves response to operations
  4. Recovery alone, because incidents cannot realistically be prevented

Explanation

ISO 28000 treats security management as covering the full cycle of preventing incidents, being prepared for them, responding when they occur and recovering afterwards. Prevention reduces likelihood while preparedness, response and recovery limit consequence, so a mature SeMS invests in both rather than choosing one.

Question 30Initiation of an SeMS implementation

An organization is beginning to establish a security management system based on ISO 28000. Which activity best characterizes the initiation phase of the implementation?

  1. Publishing the security policy to external interested parties
  2. Certifying suppliers against contractual security requirements
  3. Conducting internal audits of security controls already in place
  4. Defining the scope of the SeMS and securing top management commitment Correct answer.

Explanation

Initiation is about establishing the foundations: determining the boundaries of the management system and obtaining visible top management commitment and authorization. Auditing, supplier certification, and external publication occur later in the lifecycle.

Question 31Initiation of an SeMS implementation

When defining the scope of a security management system during initiation, what should the organization primarily consider?

  1. The interfaces and dependencies with third parties and the wider supply chain Correct answer.
  2. The number of employees who hold security certifications
  3. The cost of the certification body's audit days
  4. The marketing value of the certification to prospective customers

Explanation

Scope definition must reflect the organization's activities, products, services, and the interfaces and dependencies with external parties that affect security. Certification logistics and marketing benefits do not determine the boundaries of the management system.

Question 32Initiation of an SeMS implementation

Why does ISO 28000 place emphasis on understanding the organization's context at the start of implementation?

  1. To justify excluding high-risk activities from the management system
  2. To determine which external provider should host the security database
  3. To calculate the insurance premium for physical assets
  4. To identify internal and external issues that can affect the intended security outcomes Correct answer.

Explanation

Context analysis identifies the internal and external issues, interested parties, and conditions that influence how the SeMS must be designed and what it needs to achieve. It is not a mechanism for excluding risky activities or for procurement and insurance decisions.

Question 33Initiation of an SeMS implementation

Which output is most directly associated with the initiation phase of an SeMS implementation?

  1. A closed corrective action for a nonconformity
  2. A documented risk treatment plan with residual risk acceptance
  3. An approved implementation plan with allocated resources and responsibilities Correct answer.
  4. A completed management review record

Explanation

Initiation produces the mandate, plan, resources, and assigned responsibilities needed to build the system. Risk treatment plans, management reviews, and corrective actions are outputs of later operational and evaluation phases.

Question 34Initiation of an SeMS implementation

A newly appointed security manager wants to obtain top management commitment before drafting SeMS documentation. Which action is most effective?

  1. Circulating a draft security policy for staff comments before management has approved it
  2. Purchasing security software to demonstrate visible progress
  3. Commissioning an external audit of the current security arrangements
  4. Presenting a business case linking security management to the organization's strategic objectives and legal obligations Correct answer.

Explanation

Top management commitment is best secured by demonstrating how the SeMS supports strategic objectives and helps meet legal and contractual obligations. Drafting policy before approval, auditing, or buying tools does not establish the mandate for the system.

Question 35Initiation of an SeMS implementation

What is the primary purpose of establishing a baseline assessment of current security arrangements during initiation?

  1. To replace the risk assessment process with a checklist review
  2. To satisfy the certification body's requirement for a pre-audit
  3. To determine the disciplinary measures for security incidents
  4. To identify gaps between current practice and ISO 28000 requirements so implementation can be prioritized Correct answer.

Explanation

A baseline or gap analysis compares existing arrangements with the standard's requirements and highlights where effort is needed. It informs planning and prioritization but does not substitute for risk assessment or serve disciplinary purposes.

Question 36Initiation of an SeMS implementation

During initiation, an organization identifies that several of its security processes are outsourced to logistics providers. How should this be reflected in the SeMS?

  1. Include the outsourced processes within the scope and define how they are controlled Correct answer.
  2. Exclude outsourced processes because they are controlled by another organization
  3. Require the providers to implement their own separate ISO 28000 system before any contract
  4. Delegate all security risk decisions to the providers

Explanation

Outsourced processes that affect security performance must remain within the scope of the management system, with defined controls and responsibilities. Exclusion or full delegation would leave a gap in the organization's ability to manage security risk.

Question 37Initiation of an SeMS implementation

Which set of interested parties is most relevant to consider when initiating an SeMS in a port-based organization?

  1. Only the employees working within the security department
  2. Regulators, customers, employees, contractors, and neighboring community stakeholders Correct answer.
  3. Only the certification body and the accreditation body
  4. Only the shareholders and the finance department

Explanation

Interested parties include those whose requirements or interests affect security, such as regulators, customers, employees, contractors, and the community. Limiting consideration to one internal group or to conformity assessment bodies ignores significant obligations and expectations.

Question 38Initiation of an SeMS implementation

An organization's initiation plan proposes to implement all ISO 28000 requirements simultaneously within one month. What is the most sound critique of this approach?

  1. It is unrealistic because a phased approach aligned with risk priorities and resource capacity is more effective Correct answer.
  2. It is unacceptable because certification requires a minimum of two years
  3. It is acceptable because the standard mandates simultaneous implementation
  4. It is preferable because documentation can be minimized

Explanation

Implementation should be planned according to risk priorities, resource availability, and organizational capacity, which usually implies sequencing. ISO 28000 does not mandate simultaneous implementation, nor does it impose a fixed minimum implementation duration.

Question 39Initiation of an SeMS implementation

What role does the security policy play at the initiation stage of an SeMS?

  1. It replaces the need for documented procedures
  2. It provides the framework and direction for setting security objectives and committing to obligations Correct answer.
  3. It records the results of individual security risk assessments
  4. It lists the names of all security guards on duty

Explanation

The security policy establishes top-level direction, commitment, and the framework for objectives and compliance obligations. Risk assessment results, operational rosters, and procedures are separate elements at lower levels of the system.

Question 40Initiation of an SeMS implementation

Which factor most strongly influences the resources an organization allocates when initiating its SeMS?

  1. The number of pages in the security manual
  2. The seniority of the person who signs the policy
  3. The number of suppliers the organization uses
  4. The results of the initial risk assessment and the significance of identified threats Correct answer.

Explanation

Resource allocation should be risk-based, driven by the significance of identified threats and vulnerabilities and their potential consequences. Documentation volume, signatory seniority, or supplier count do not determine the level of security resources needed.

Question 41Initiation of an SeMS implementation

In ISO 28000 terminology, what does 'security' primarily encompass?

  1. Only the physical guarding of premises by contracted staff
  2. The protection of people, assets, and operations against security-related events and their consequences Correct answer.
  3. Compliance with financial reporting standards
  4. Only the protection of information systems from cyber attacks

Explanation

Security in ISO 28000 covers the protection of people, assets, and operations from security-related incidents and their consequences, including but not limited to cyber and physical threats. It is broader than guarding or information security alone and is unrelated to financial reporting.

Question 42Initiation of an SeMS implementation

A security manager is documenting the organization's context and identifies a new regulatory requirement for cargo screening. How should this be handled during initiation?

  1. Record it as a compliance obligation that the SeMS must address and reflect it in scope and objectives Correct answer.
  2. Assign it to the logistics provider without further action
  3. Treat it as an optional improvement to be considered later
  4. Defer it until the next certification cycle

Explanation

Legal and regulatory requirements are compliance obligations that must be identified and addressed by the management system, influencing scope, objectives, and controls. Deferral or transfer to a provider does not remove the organization's obligation.

Question 43Initiation of an SeMS implementation

Which statement best describes the relationship between the SeMS and the organization's other management systems during initiation?

  1. The SeMS may only be implemented after all other systems are certified
  2. The SeMS must operate in complete isolation to avoid conflicts
  3. The SeMS should be aligned and integrated with other management systems where practical Correct answer.
  4. The SeMS must replace the quality management system

Explanation

ISO management system standards encourage alignment and integration with other management systems to reduce duplication and conflicting requirements. Isolation, replacement, or sequencing behind other certifications is neither required nor desirable.

Question 44Initiation of an SeMS implementation

What is the purpose of defining roles, responsibilities, and authorities early in the SeMS implementation?

  1. To transfer legal liability to individual employees
  2. To ensure accountability for security performance and clarify who authorizes decisions Correct answer.
  3. To reduce the number of documents required by the standard
  4. To avoid the need for management review

Explanation

Clearly assigned roles, responsibilities, and authorities ensure that security tasks are owned and decisions are properly authorized. It does not reduce documentation obligations, replace management review, or shift legal liability to individuals.

Question 45Initiation of an SeMS implementation

An organization wants to use a recognized risk assessment methodology at the start of its SeMS. What characteristic is most important in selecting the method?

  1. It should be approved by the certification body in advance
  2. It should rely solely on qualitative expert opinion
  3. It should be the most complex method available on the market
  4. It should produce consistent, comparable results and suit the organization's risk profile Correct answer.

Explanation

A suitable methodology provides consistent, repeatable, and comparable results appropriate to the nature and scale of the organization's risks. Complexity, pre-approval by a certification body, or reliance on a single qualitative source are not indicators of suitability.

Question 46Initiation of an SeMS implementation

Which activity demonstrates that security is being considered in the organization's strategic planning from the outset?

  1. Assigning security duties only to the night shift supervisor
  2. Keeping security plans confidential from senior management
  3. Including security objectives and performance indicators in the business planning cycle Correct answer.
  4. Reviewing security only after an incident has occurred

Explanation

Embedding security objectives and performance measures in the business planning cycle shows that security is integrated into strategic decision-making. Restricting responsibility to one supervisor, reacting only to incidents, or withholding plans from leadership indicates the opposite.

Question 47Initiation of an SeMS implementation

When initiating an SeMS, why should the organization identify applicable legal, statutory, regulatory, and contractual security requirements?

  1. To create a register that the SeMS uses to direct controls and demonstrate compliance Correct answer.
  2. To limit the scope of the management system to unregulated activities
  3. To avoid having to conduct a risk assessment
  4. To transfer compliance obligations to the certification body

Explanation

Identifying applicable requirements creates a compliance register that guides control selection and provides evidence of conformity. It does not replace risk assessment, narrow scope to unregulated areas, or shift obligations to a certification body.

Question 48Initiation of an SeMS implementation

A senior manager asks why the SeMS initiation should involve operational staff rather than only the security department. What is the best justification?

  1. It avoids the requirement for management commitment
  2. Operational staff can take over all security decision-making authority
  3. Involvement builds ownership and captures practical knowledge of risks in day-to-day activities Correct answer.
  4. It reduces the need for documented procedures

Explanation

Engaging operational staff builds ownership and surfaces practical knowledge about how work is actually performed and where risks arise. It does not transfer decision authority, remove documentation needs, or substitute for management commitment.

Question 49Initiation of an SeMS implementation

Which of the following best represents a key performance indicator that could be established during SeMS initiation?

  1. The number of pages in the security policy
  2. The brand of access control equipment installed
  3. The seniority of the security manager
  4. The number of security awareness training hours completed per employee Correct answer.

Explanation

Performance indicators should measure the effectiveness of security activities, such as training completion, incident rates, or corrective action closure. Documentation length, staff seniority, or equipment brand are not meaningful measures of security performance.

Question 50Initiation of an SeMS implementation

During initiation, the organization decides how it will communicate about security internally and externally. Which consideration is most relevant to this decision?

  1. Maximizing the volume of communication to all parties
  2. Ensuring sensitive security information is protected while obligations to notify are met Correct answer.
  3. Restricting all communication to the security department
  4. Publishing detailed incident reports on public channels

Explanation

Communication planning must balance transparency and legal notification obligations against the protection of sensitive security information. Maximizing volume, restricting all communication, or publicizing detailed incident reports would undermine security.