I85PREP
⌘ K
PECB ISO 28000 Transition study materials
PECB ISO 28000 Transition study resources

PECB ISO 28000 Transition practice questions

One question at a time. Build your PECB ISO 28000 Transition understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

In ISO 28000:2022, the term used for the highest-level document that states the organization's security policy and related commitments is:

  1. Statement of applicability
  2. Security policy Correct answer.
  3. Security management system manual
  4. Security risk treatment plan

Explanation

The 2022 edition retains the concept of a documented security policy as the top-level statement of intent, direction and commitments. It is issued by top management and provides the framework for setting security objectives. A statement of applicability and a risk treatment plan are risk-related records, not the top-level policy document.

Question 2Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which pair of terms best reflects the shift in the main clause structure between ISO 28000:2007 and ISO 28000:2022?

  1. From 'security management system' to 'security in supply chain management' Correct answer.
  2. From 'management review' to 'internal audit'
  3. From 'risk assessment' to 'risk treatment'
  4. From 'preventive action' to 'corrective action'

Explanation

The 2022 revision moved away from a pure management system framing toward security in supply chain management, broadening the scope beyond organizational security to the supply chain. This is reflected in the title and the definitions. The other pairs are either unchanged or do not represent the central structural shift.

Question 3Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Under ISO 28000:2022, the clause that establishes requirements for understanding the organization and its context corresponds most closely to which 2007 clause?

  1. Clause 7.2 Competence
  2. Clause 8.2 Monitoring and measurement
  3. Clause 5.2 Security policy
  4. Clause 4.1 General requirements Correct answer.

Explanation

The 2022 edition introduces 'Understanding the organization and its context' under Clause 4, which absorbs and extends the 2007 general requirements. It requires determining external and internal issues relevant to the security management system. The other clauses address policy, competence and monitoring, which are distinct topics.

Question 4Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which 2007 clause was eliminated as a standalone clause in ISO 28000:2022, with its intent absorbed into risk-based thinking and improvement?

  1. Internal audit
  2. Preventive action Correct answer.
  3. Documented information control
  4. Management review

Explanation

The 2022 edition removed the separate preventive action clause; its intent is now embedded in risk-based thinking and the improvement clause. Internal audit, management review and control of documented information all remain as distinct requirements. This reflects the broader harmonized structure trend in management system standards.

Question 5Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A security manager is aligning the organization's documents with ISO 28000:2022. Which requirement about documented information differs from the 2007 edition?

  1. The organization must retain a documented security policy only.
  2. The 2022 edition requires all documents to be retained for at least three years.
  3. The 2022 edition prohibits electronic documentation.
  4. The 2022 edition refers to 'documented information' rather than 'documents and records'. Correct answer.

Explanation

The 2022 edition uses the harmonized term 'documented information', covering both documents (maintained) and records (retained). The 2007 edition used 'documents' and 'records' as separate categories. This is a terminology and structure change, not a retention period or media restriction.

Question 6Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

In ISO 28000:2022, the requirement to determine the scope of the security management system appears in which clause?

  1. Clause 9.2
  2. Clause 4.3 Correct answer.
  3. Clause 5.1
  4. Clause 6.1

Explanation

Clause 4.3 of the 2022 edition addresses determining the scope of the security management system, building on the context analysis in Clause 4. The scope must be available as documented information. Policy, planning and internal audit are addressed in later clauses.

Question 7Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which statement accurately describes the leadership requirement in ISO 28000:2022 compared with ISO 28000:2007?

  1. Leadership requirements were removed to reduce duplication with the policy clause.
  2. Top management must now demonstrate leadership and commitment through specific actions, not only by establishing the policy. Correct answer.
  3. Leadership is now delegated entirely to the security manager.
  4. Leadership is a new clause that did not exist in any form in 2007.

Explanation

The 2022 edition strengthens the leadership clause by listing specific actions top management must take, such as ensuring resources and integrating requirements into business processes. The 2007 edition had a management commitment element but less explicit action-oriented requirements. Delegation to a security manager does not satisfy top management accountability.

Question 8Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

The 2022 edition requires that the security policy include a commitment to which of the following?

  1. Eliminating all supply chain risk
  2. Outsourcing security to a third party
  3. Publishing annual financial statements
  4. Continual improvement of the security management system Correct answer.

Explanation

The 2022 edition requires the security policy to include a commitment to continual improvement of the security management system, along with satisfying applicable requirements. Eliminating all risk is neither feasible nor required. Financial reporting and outsourcing are outside the policy requirements.

Question 9Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

How does ISO 28000:2022 treat the concept of 'security risk assessment' compared with the 2007 edition?

  1. It is now optional for small organizations only.
  2. It was removed and replaced by asset inventory.
  3. It was moved to the management review clause.
  4. It remains but is now aligned with the risk-based planning requirements of Clause 6. Correct answer.

Explanation

The 2022 edition integrates security risk assessment into the harmonized planning clause, requiring identification of risks and opportunities and determination of treatment. The 2007 edition had risk assessment as a distinct security-specific element. The activity remains mandatory, not optional or relocated to management review.

Question 10Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

In ISO 28000:2022, 'actions to address risks and opportunities' is addressed under which clause?

  1. Clause 7.1
  2. Clause 6.1 Correct answer.
  3. Clause 10.1
  4. Clause 8.1

Explanation

Clause 6.1 of the 2022 edition requires the organization to determine risks and opportunities that need to be addressed and to plan actions for them. Clause 7 addresses support, Clause 8 addresses operation, and Clause 10 addresses improvement. This placement reflects the harmonized structure.

Question 11Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which element is new in the support clause of ISO 28000:2022 when compared with the 2007 edition?

  1. A requirement to purchase security insurance
  2. Awareness requirements for persons working under the organization's control Correct answer.
  3. A requirement to publish security performance data publicly
  4. A requirement to certify all suppliers

Explanation

The 2022 edition includes an explicit awareness requirement under the support clause, ensuring persons doing work under the organization's control are aware of the policy and their contribution to security. Insurance purchase, supplier certification and public reporting are not requirements of the standard. Awareness complements competence and communication requirements.

Question 12Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A candidate is asked how ISO 28000:2022 handles 'outsourced processes'. Which statement is correct?

  1. Outsourced processes are outside the scope of the security management system.
  2. Outsourcing is prohibited for security-critical activities.
  3. Only suppliers certified to ISO 28000 may be used.
  4. The organization must ensure outsourced processes are controlled and retain responsibility for conformity. Correct answer.

Explanation

The 2022 edition requires the organization to control outsourced processes and retain responsibility for ensuring they conform to requirements. Outsourcing does not remove accountability. The standard does not prohibit outsourcing or require supplier certification to ISO 28000.

Question 13Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which clause in ISO 28000:2022 covers 'performance evaluation'?

  1. Clause 8
  2. Clause 9 Correct answer.
  3. Clause 7
  4. Clause 10

Explanation

Clause 9 of the 2022 edition addresses performance evaluation, including monitoring, measurement, analysis, internal audit and management review. Clause 8 covers operation and Clause 10 covers improvement. Clause 7 covers support.

Question 14Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

How does the 2022 edition's treatment of 'monitoring and measurement' differ from the 2007 edition?

  1. It only applies to financial performance.
  2. It now requires determining what needs to be monitored, the methods, and when results are analyzed and evaluated. Correct answer.
  3. It was removed to reduce administrative burden.
  4. It requires external auditors to perform all monitoring.

Explanation

The 2022 edition specifies that the organization must determine what to monitor and measure, the methods, timing, and when results are analyzed and evaluated. This is more explicit than the 2007 requirement. Monitoring remains an internal activity and is not restricted to financial performance.

Question 15Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Under ISO 28000:2022, internal audit requirements are found in which clause?

  1. Clause 9.3
  2. Clause 9.1
  3. Clause 9.2 Correct answer.
  4. Clause 10.2

Explanation

Clause 9.2 of the 2022 edition addresses internal audit, while Clause 9.1 covers monitoring and measurement and Clause 9.3 covers management review. Clause 10.2 covers nonconformity and corrective action. This subclause structure is part of the harmonized framework.

Question 16Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which statement best describes the change in management review requirements between ISO 28000:2007 and ISO 28000:2022?

  1. Management review was eliminated in 2022.
  2. The 2022 edition specifies required inputs and outputs for management review in more detail. Correct answer.
  3. Management review is now performed only by external parties.
  4. The 2007 edition required more frequent reviews than 2022.

Explanation

The 2022 edition lists specific inputs and outputs for management review, aligning with the harmonized structure. This makes the requirement more detailed than in 2007. Management review remains a top management activity and was not eliminated.

Question 17Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

In ISO 28000:2022, the improvement clause includes requirements for:

  1. Only disciplinary measures
  2. Only financial compensation
  3. Nonconformity, corrective action and continual improvement Correct answer.
  4. Only preventive action

Explanation

Clause 10 of the 2022 edition addresses nonconformity, corrective action and continual improvement. Preventive action as a standalone clause was removed, with its intent embedded in risk-based thinking. Disciplinary measures and financial compensation are not part of the improvement requirements.

Question 18Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A candidate claims ISO 28000:2022 requires a documented 'security management system manual'. How should this be evaluated?

  1. Incorrect; no documented information is required in 2022.
  2. Correct; the manual must be approved by a certification body.
  3. Correct; a manual is explicitly required.
  4. Incorrect; the 2022 edition does not mandate a manual, though documented information is required where necessary. Correct answer.

Explanation

The 2022 edition does not require a management system manual; it requires documented information necessary for the effectiveness of the system. This contrasts with older management system practices that mandated a manual. Some documented information is still required, so the claim that none is required is also wrong.

Question 19Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which definition change is most significant in ISO 28000:2022 regarding 'security'?

  1. Security is defined as financial solvency.
  2. Security is no longer defined in the standard.
  3. Security now refers only to physical guarding.
  4. Security is defined in relation to supply chain and organizational assets, including information and people. Correct answer.

Explanation

The 2022 edition defines security broadly in relation to supply chain and organizational assets, including people, information and infrastructure. This broadened definition supports the supply chain focus of the revision. Security is not limited to physical guarding or financial matters.

Question 20Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which clause in ISO 28000:2022 addresses 'planning' as a whole, including risk and objective setting?

  1. Clause 7
  2. Clause 8
  3. Clause 6 Correct answer.
  4. Clause 5

Explanation

Clause 6 of the 2022 edition covers planning, including actions to address risks and opportunities and security objectives. Clause 5 covers leadership, Clause 7 covers support and Clause 8 covers operation. This placement follows the harmonized high-level structure.

Question 21Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

How should an organization treat 'security objectives' under ISO 28000:2022?

  1. They are optional and may be omitted.
  2. They must be established at relevant functions and levels, be measurable where practicable, and be monitored. Correct answer.
  3. They must be kept confidential from all employees.
  4. They must be established only at the corporate level.

Explanation

The 2022 edition requires security objectives to be established at relevant functions and levels, be consistent with the policy, be measurable where practicable, and be monitored. Objectives are mandatory, not optional. They should be communicated appropriately rather than withheld from all employees.

Question 22Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which statement accurately reflects the relationship between ISO 28000:2022 and the high-level structure (HLS) used by other ISO management system standards?

  1. ISO 28000:2022 requires adoption of ISO 9001 in full.
  2. ISO 28000:2022 follows the harmonized structure, facilitating integration with other management system standards. Correct answer.
  3. ISO 28000:2022 abolished the Plan-Do-Check-Act cycle.
  4. ISO 28000:2022 uses a unique clause structure unrelated to other standards.

Explanation

The 2022 edition adopts the harmonized structure, making it easier to integrate with other ISO management system standards. The 2007 edition had a different clause arrangement. The standard does not abolish PDCA or require adoption of ISO 9001.

Question 23Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Under ISO 28000:2022, which activity is required to determine the needs and expectations of interested parties?

  1. Clause 4.2 Correct answer.
  2. Clause 8.1
  3. Clause 7.4
  4. Clause 6.2

Explanation

Clause 4.2 of the 2022 edition requires determining relevant interested parties and their relevant requirements. This supports the context analysis in Clause 4.1. Clause 6.2 covers objectives, Clause 7.4 covers communication and Clause 8.1 covers operational planning.

Question 24Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A candidate compares the treatment of 'communication' in the two editions. Which statement is most accurate for ISO 28000:2022?

  1. Communication is limited to external regulators only.
  2. Communication must always be in writing.
  3. Communication requirements were removed.
  4. The organization must determine what, when, with whom and how to communicate relevant to the security management system. Correct answer.

Explanation

The 2022 edition requires the organization to determine the what, when, with whom and how of internal and external communication relevant to the management system. Communication was not removed and is not limited to regulators. The standard does not mandate that all communication be written.

Question 25Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which statement best captures the difference in scope emphasis between ISO 28000:2007 and ISO 28000:2022?

  1. Both editions have identical scope with no change in emphasis.
  2. 2007 emphasized supply chain security across organizations; 2022 focuses only on internal physical security.
  3. 2007 focused on organizational security management; 2022 broadens scope to security in supply chain management. Correct answer.
  4. 2007 covered information security only; 2022 covers physical security only.

Explanation

The 2022 revision broadens the focus from organizational security management to security in supply chain management, reflecting the standard's evolving purpose. The 2007 edition had a narrower organizational focus. Neither edition is limited to information security or physical security alone.

Question 26Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A transition candidate is mapping the 2007 edition's 'security management system requirements' onto the 2022 clause structure. Which clause of ISO 28000:2022 contains the requirements for establishing the security management system itself, including the processes needed and their interactions?

  1. Clause 6.1
  2. Clause 9.2
  3. Clause 8.1
  4. Clause 4.4 Correct answer.

Explanation

ISO 28000:2022 follows the harmonized structure, so the requirement to establish, implement, maintain and continually improve the security management system, including the processes needed and their interactions, sits in Clause 4.4. Clause 6.1 deals with risks and opportunities, Clause 8.1 with operational planning and control, and Clause 9.2 with internal audit.

Question 27Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

When comparing the two editions, how is the concept of 'continual improvement' positioned in ISO 28000:2022 relative to ISO 28000:2007?

  1. It is a dedicated subclause (Clause 10.1) within the improvement clause, reflecting the harmonized structure Correct answer.
  2. It is embedded only within management review, with no dedicated improvement clause
  3. It is merged with corrective action under the planning clause
  4. It is addressed only in the introduction and not as a requirement

Explanation

In ISO 28000:2022, Clause 10, 'Improvement', contains 10.1, 'Continual improvement', and 10.2, 'Nonconformity and corrective action'. Continual improvement is therefore a dedicated requirement within the improvement clause, rather than being confined to management review or introductory text.

Question 28Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A security manager notes that ISO 28000:2022 requires the organization to consider 'changes' in a specific planning context. Under which clause are the requirements for planning changes to the security management system found?

  1. Clause 8.1
  2. Clause 5.3
  3. Clause 7.4
  4. Clause 6.3 Correct answer.

Explanation

The 2022 edition adds Clause 6.3, which requires changes to the security management system to be carried out in a planned manner, considering purpose, consequences, integrity, resources and allocation of responsibilities. This planning-of-change requirement has no direct counterpart in the 2007 edition.

Question 29Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which clause of ISO 28000:2022 introduces the requirement to determine the boundaries and applicability of the security management system, and how does this differ from 2007?

  1. Clause 9.3, which determines the scope during management review
  2. Clause 8.1, which in both editions defines operational boundaries
  3. Clause 4.3, which is new as a distinct scope-determination requirement not present as a separate element in 2007 Correct answer.
  4. Clause 1, which in both editions defines the scope of the standard itself

Explanation

ISO 28000:2022 Clause 4.3 requires the organization to determine the boundaries and applicability of the security management system, considering external and internal issues and interested parties. The 2007 edition did not contain an equivalent standalone scope-determination element.

Question 30Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A candidate states that ISO 28000:2022 requires a documented 'security policy' to be available as documented information. Which clause pair governs the policy and its maintenance as documented information?

  1. Clause 4.2 for the policy and Clause 7.1 for resources
  2. Clause 5.1 for the policy and Clause 8.1 for operations
  3. Clause 6.2 for the policy and Clause 9.1 for monitoring
  4. Clause 5.2 for the policy and Clause 7.5 for documented information Correct answer.

Explanation

Clause 5.2 sets the security policy requirements, and Clause 7.5 governs documented information, including creating, updating and controlling it. The policy must be maintained as documented information and communicated within the organization.

Question 31Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

In ISO 28000:2022, the requirement to provide resources for the security management system, including competent persons, appears under which clause?

  1. Clause 8.2
  2. Clause 7.1 Correct answer.
  3. Clause 10.2
  4. Clause 6.1

Explanation

Clause 7.1 requires the organization to determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the security management system. The 2007 edition addressed resources less explicitly and not in this harmonized support clause structure.

Question 32Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A transition auditor asks how the 2022 edition treats 'competence' compared with the 2007 edition. Which statement is correct for ISO 28000:2022?

  1. Competence is addressed only through training records under Clause 8.1
  2. Clause 7.2 requires determining necessary competence, ensuring persons are competent, and retaining documented evidence of competence Correct answer.
  3. Competence is covered exclusively in the management review inputs
  4. Competence is not addressed because the standard focuses solely on physical security

Explanation

ISO 28000:2022 Clause 7.2 sets out a structured competence requirement: determine necessary competence, ensure competence through education, training or experience, evaluate effectiveness of actions, and retain documented information as evidence. This reflects the harmonized support clause structure absent from the 2007 edition.

Question 33Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which statement correctly describes how ISO 28000:2022 handles 'awareness' compared with ISO 28000:2007?

  1. Clause 7.3 requires awareness of the security policy, contribution to SMS effectiveness, and implications of not conforming Correct answer.
  2. Awareness is not a requirement and depends solely on the organization's discretion
  3. Awareness is addressed only in the introduction as a guiding principle
  4. Awareness is covered under Clause 9.1 as part of monitoring

Explanation

Clause 7.3 of the 2022 edition requires persons doing work under the organization's control to be aware of the security policy, their contribution to the effectiveness of the system, and the implications of not conforming. The 2007 edition addressed awareness less systematically within its people-related elements.

Question 34Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A candidate asks which clause of ISO 28000:2022 requires the organization to determine what needs to be communicated, when, with whom, and how. Which clause applies?

  1. Clause 8.1
  2. Clause 7.4 Correct answer.
  3. Clause 9.3
  4. Clause 5.2

Explanation

Clause 7.4 establishes the communication requirements, including what, when, with whom, and how to communicate, and requires documented information as appropriate. The 2007 edition addressed communication but not with this structured, harmonized set of determinations.

Question 35Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

In the 2022 edition, the requirement to evaluate security performance and the effectiveness of the security management system is found in which clause?

  1. Clause 9.1 Correct answer.
  2. Clause 6.2
  3. Clause 10.1
  4. Clause 9.2

Explanation

Clause 9.1 requires monitoring, measurement, analysis and evaluation of security performance and the effectiveness of the security management system. Clause 9.2 covers internal audit, Clause 10.1 covers general improvement, and Clause 6.2 covers security objectives.

Question 36Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which statement accurately describes the 2022 edition's treatment of 'management review inputs' compared with the 2007 edition?

  1. Clause 9.3 lists defined inputs including audit results, security performance, and risks and opportunities Correct answer.
  2. Inputs are defined only by the organization with no standard guidance
  3. Management review inputs are limited to financial results
  4. Management review has no prescribed inputs in either edition

Explanation

Clause 9.3 of ISO 28000:2022 specifies the inputs that management review must consider, such as the status of actions from previous reviews, changes in issues and interested party needs, security performance, audit results, and adequacy of resources. This structured input list reflects the harmonized structure and is more prescriptive than the 2007 treatment.

Question 37Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A candidate claims the 2022 edition removed the requirement to handle 'incidents'. Which clause of ISO 28000:2022 addresses incidents and nonconformities?

  1. Clause 8.1
  2. Clause 6.1
  3. Clause 10.2 Correct answer.
  4. Clause 9.1

Explanation

Clause 10.2 requires the organization to react to incidents and nonconformities, evaluate the need for action, implement corrective action, and retain documented information. The claim that incident handling was removed is therefore incorrect.

Question 38Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

How does ISO 28000:2022 define 'security' in a way that differs from the 2007 edition's emphasis?

  1. It is defined only as compliance with legal requirements
  2. It is defined in relation to assets, infrastructure and people being protected from harm, with a broader scope than physical protection alone Correct answer.
  3. It is defined exclusively as protection against terrorism
  4. It is defined as the absence of documented incidents

Explanation

The 2022 edition frames security broadly around protection of people, assets and infrastructure from harm, aligning with a risk-based management system approach rather than a narrow protective or compliance focus. This broader framing supports the expanded scope of the standard.

Question 39Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which clause of ISO 28000:2022 requires the organization to determine external and internal issues relevant to its purpose and that affect its ability to achieve the intended outcomes of the security management system?

  1. Clause 4.2
  2. Clause 4.1 Correct answer.
  3. Clause 6.2
  4. Clause 5.1

Explanation

Clause 4.1 requires determining external and internal issues relevant to the organization's purpose and strategic direction that affect the SMS's ability to achieve intended outcomes. Clause 4.2 addresses interested parties, Clause 5.1 leadership, and Clause 6.2 objectives.

Question 40Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A transition candidate is preparing a gap analysis on 'documented information'. Which statement correctly reflects the 2022 edition's approach compared with 2007?

  1. The 2022 edition requires a fixed list of mandatory procedures
  2. The 2022 edition requires documentation only in electronic form
  3. The 2022 edition eliminates all documentation requirements
  4. Clause 7.5 consolidates creation, updating and control of documented information, replacing the 2007 focus on documents and records as separate categories Correct answer.

Explanation

ISO 28000:2022 uses the harmonized concept of 'documented information', consolidating requirements for creating, updating and controlling documents and records into Clause 7.5. The 2007 edition used separate document and record concepts and referenced documented procedures.

Question 41Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which clause of ISO 28000:2022 requires the organization to establish security objectives at relevant functions and levels, and to plan how to achieve them?

  1. Clause 9.1
  2. Clause 5.2
  3. Clause 6.1
  4. Clause 6.2 Correct answer.

Explanation

Clause 6.2 requires security objectives to be established at relevant functions and levels, be consistent with the security policy, be measurable where practicable, and be planned with what will be done, resources, responsibility, timeframe and evaluation. The 2007 edition did not structure objectives in this harmonized way.

Question 42Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

An organization is deciding how to treat security risks identified under ISO 28000:2022. Which clause contains the requirement to plan actions to address risks and opportunities and to evaluate their effectiveness?

  1. Clause 10.3
  2. Clause 8.1
  3. Clause 6.1 Correct answer.
  4. Clause 4.4

Explanation

Clause 6.1 requires the organization to plan actions to address risks and opportunities, integrate them into SMS processes, and evaluate their effectiveness. Clause 8.1 covers operational control, Clause 10.3 covers continual improvement, and Clause 4.4 covers establishing the SMS.

Question 43Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which clause of ISO 28000:2022 requires the organization to plan and control the processes needed to meet security requirements, including establishing criteria and controlling outsourced processes?

  1. Clause 8.1 Correct answer.
  2. Clause 6.1
  3. Clause 7.1
  4. Clause 9.2

Explanation

Clause 8.1 requires operational planning and control, including establishing criteria for processes, implementing control in accordance with criteria, and ensuring control over outsourced processes. The 2007 edition addressed operations but not in this harmonized operational planning and control structure.

Question 44Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A candidate asks whether ISO 28000:2022 requires the organization to conduct internal audits at planned intervals. Which clause and requirement apply?

  1. Clause 9.2 requires internal audits at planned intervals to determine whether the SMS conforms and is effectively implemented Correct answer.
  2. Clause 4.4 requires internal audits when the SMS is established
  3. Clause 9.1 requires internal audits as part of monitoring
  4. Clause 10.2 requires internal audits as part of corrective action

Explanation

Clause 9.2 requires internal audits at planned intervals to determine whether the security management system conforms to the organization's own requirements and the standard, and is effectively implemented and maintained. The 2007 edition also required internal audits, but the requirement is now structured within the harmonized performance evaluation clause.

Question 45Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which statement correctly describes the relationship between ISO 28000:2022 and the harmonized structure used by other management system standards?

  1. The 2022 edition adopts the harmonized clause structure, aligning clause numbering with other MSS such as ISO 9001 and ISO 14001 Correct answer.
  2. The 2022 edition uses a structure unique to security standards with no alignment
  3. The 2022 edition removes clause numbering entirely
  4. The 2022 edition retains the 2007 clause numbering to preserve continuity

Explanation

ISO 28000:2022 adopts the harmonized structure, so its clause numbering and core text align with other management system standards such as ISO 9001 and ISO 14001. This alignment is a major transition consideration because 2007 clause references no longer map directly.

Question 46Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

An organization wants to integrate its security management system with its quality and environmental management systems. Which feature of ISO 28000:2022 most directly supports this integration?

  1. Its restriction to manufacturing organizations
  2. Its requirement to use a single certified auditor
  3. Its adoption of the harmonized structure and common core text Correct answer.
  4. Its elimination of the need for documented information

Explanation

The harmonized structure and common core text allow ISO 28000:2022 to be integrated more easily with other management system standards. Shared clauses such as context, leadership, planning, support, operation, performance evaluation and improvement reduce duplication.

Question 47Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A candidate is comparing the treatment of 'leadership' in the two editions. Which clause of ISO 28000:2022 requires top management to demonstrate leadership and commitment by ensuring resources and communicating the importance of effective security management?

  1. Clause 9.3
  2. Clause 5.3
  3. Clause 5.1 Correct answer.
  4. Clause 6.1

Explanation

Clause 5.1 sets out leadership and commitment requirements, including taking accountability, ensuring resources, communicating the importance of effective security management, and promoting improvement. Clause 5.3 covers roles and authorities, Clause 6.1 risks and opportunities, and Clause 9.3 management review.

Question 48Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which statement best describes how ISO 28000:2022 treats the relationship between security risk assessment and the rest of the management system, compared with the 2007 edition?

  1. Security risk assessment is replaced entirely by management review
  2. Security risk assessment is integrated into the planning clause and informs operational control, rather than standing as an isolated element Correct answer.
  3. Security risk assessment is addressed only in the improvement clause
  4. Security risk assessment is optional in the 2022 edition

Explanation

In the 2022 edition, risk assessment is embedded in planning (Clause 6.1) and linked to operational control (Clause 8.1) and objectives (Clause 6.2), rather than being an isolated 2007 element. This integration reflects the risk-based thinking of the harmonized structure.

Question 49Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

A candidate asserts that ISO 28000:2022 requires a 'security management representative' as a single appointed individual, as was common under 2007. How should this be evaluated?

  1. The 2022 edition instead requires assignment of responsibilities and authorities for the SMS at relevant levels, without mandating a single representative Correct answer.
  2. The 2022 edition forbids assigning security responsibilities to managers
  3. The 2022 edition assigns the role exclusively to the internal audit function
  4. The 2022 edition retains the single representative requirement unchanged

Explanation

Clause 5.3 of the 2022 edition requires top management to ensure that responsibilities and authorities for relevant roles are assigned and communicated, including reporting on SMS performance. It does not mandate a single named management representative as the 2007 edition commonly implied.

Question 50Differences between main clauses of ISO 28000:2022 and ISO 28000:2007

Which statement accurately describes the 2022 edition's requirement for determining interested parties and their relevant requirements?

  1. Clause 4.2 requires interested parties to conduct internal audits
  2. Clause 4.2 requires listing all possible stakeholders regardless of relevance
  3. Clause 4.2 requires interested parties to approve the security policy
  4. Clause 4.2 requires determining relevant interested parties and the relevant needs and expectations that become compliance obligations Correct answer.

Explanation

Clause 4.2 requires the organization to determine relevant interested parties and their relevant needs and expectations, and to determine which of these become compliance obligations. The 2007 edition did not structure interested party analysis in this harmonized way.