I85PREP
⌘ K
ISO 27001 Transition study materials
ISO 27001 Transition study resources

ISO 27001 Transition practice questions

One question at a time. Build your ISO 27001 Transition understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Context of the organization

Under ISO/IEC 27001:2022, which two clauses of the standard establish requirements directly tied to understanding the organization and its context?

  1. Clause 9.1 Monitoring, measurement, analysis and evaluation and Clause 9.2 Internal audit
  2. Clause 5.1 Leadership and commitment and Clause 5.2 Policy
  3. Clause 4.1 Understanding the organization and its context and Clause 4.2 Understanding the needs and expectations of interested parties Correct answer.
  4. Clause 7.1 Resources and Clause 7.2 Competence

Explanation

Clause 4 of ISO/IEC 27001:2022 covers the context of the organization, and Clauses 4.1 and 4.2 specifically require determining external and internal issues and the relevant interested parties and their requirements. These outputs feed the scope of the ISMS in Clause 4.3 and the risk assessment process in Clause 6.1.2.

Question 2Context of the organization

In ISO/IEC 27001:2022 Clause 4.1, what is the organization required to determine?

  1. The names of every supplier that holds confidential information
  2. The external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcomes of the ISMS Correct answer.
  3. The complete list of threat actors operating in its sector
  4. The financial budget allocated to information security for the coming year

Explanation

Clause 4.1 requires the organization to determine external and internal issues relevant to its purpose and that affect its ability to achieve the intended outcomes of the information security management system. The requirement is deliberately broad so that the organization decides which issues matter for its ISMS.

Question 3Context of the organization

A newly appointed ISMS manager is drafting the context analysis. Which set of items best illustrates external issues under Clause 4.1?

  1. Risk treatment plan, Statement of Applicability and residual risk register
  2. Internal audit findings, management review minutes and corrective action records
  3. Corporate culture, governance structure, staff competence and internal policies
  4. Competitive landscape, regulatory environment, market trends and technological developments Correct answer.

Explanation

External issues are those arising from the legal, regulatory, market, technological, competitive and social environment in which the organization operates. Internal issues concern the organization's own culture, structure, capabilities and governance. The other options describe internal artefacts or ISMS outputs rather than external context.

Question 4Context of the organization

Which statement best describes how Clause 4.1 relates to the risk assessment in Clause 6.1.2?

  1. Clause 4.1 replaces the risk assessment for small organizations with fewer than fifty employees
  2. Clause 4.1 requires the risk assessment to be repeated every month regardless of change
  3. Clause 4.1 and Clause 6.1.2 are unrelated and may be documented independently without linkage
  4. The external and internal issues determined under Clause 4.1 inform the risk assessment by identifying conditions that may create or influence information security risk Correct answer.

Explanation

The context determination provides the environmental picture that shapes risk identification and evaluation. Issues such as new regulations, market changes or internal restructuring are natural inputs to the risk assessment and risk treatment process in Clause 6. The standard expects a logical flow from context to risk.

Question 5Context of the organization

Clause 4.2 of ISO/IEC 27001:2022 requires the organization to determine which two things about interested parties?

  1. The interested parties that are relevant to the ISMS and the requirements of those interested parties Correct answer.
  2. The number of employees at each party and their security certifications
  3. The contracts signed with each party and the payment terms agreed
  4. The audit history of each party and their incident records

Explanation

Clause 4.2 requires determining the relevant interested parties and the requirements of those parties that are relevant to the ISMS. This ensures the organization understands whose needs and expectations must be addressed, such as regulators, customers and staff.

Question 6Context of the organization

Which of the following is the clearest example of an interested party requirement that would be relevant to an ISMS under Clause 4.2?

  1. A competitor's decision to open a new regional office
  2. A trade association's annual conference theme
  3. A national data protection law obliging the organization to report breaches within 72 hours Correct answer.
  4. A supplier's internal staff newsletter schedule

Explanation

A legal obligation such as a breach notification deadline is a requirement of an interested party (the regulator) that is relevant to the ISMS because it directly shapes controls and processes. The other items are business events or communications that do not impose requirements on the ISMS.

Question 7Context of the organization

Clause 4.3 of ISO/IEC 27001:2022 requires the organization to determine the boundaries and applicability of the ISMS. What must the scope statement do?

  1. List every individual asset owned by the organization in a fixed format
  2. Consider the external and internal issues and the requirements of interested parties, and be available as documented information Correct answer.
  3. Be approved annually by an external certification body before use
  4. Exclude any department that has never experienced a security incident

Explanation

Clause 4.3 requires the scope to take into account the issues from Clause 4.1 and the requirements from Clause 4.2, and to be maintained as documented information. The scope defines the boundaries within which the ISMS applies.

Question 8Context of the organization

An organization decides its ISMS scope covers only its cloud-hosted customer portal, excluding its on-premises HR system. What is the most important consequence of this scoping decision?

  1. The organization is automatically non-conformant because partial scopes are prohibited
  2. The scope statement must be kept confidential and never shared with auditors
  3. The excluded HR system can be ignored entirely with no further analysis or documentation
  4. The interfaces and dependencies between the in-scope portal and excluded systems must still be addressed, because Clause 4.3 requires considering interfaces and dependencies Correct answer.

Explanation

Clause 4.3 requires the scope to consider interfaces and dependencies with third parties and other parts of the organization. Excluding a system does not remove the need to manage risks arising at the boundary, such as shared identities or data flows. Partial scopes are permitted if justified and documented.

Question 9Context of the organization

Which item is the most appropriate piece of documented information to evidence the Clause 4.3 scope determination?

  1. A copy of the organization's marketing brochure
  2. A scope statement defining organizational units, locations, systems and boundaries, with justification for exclusions Correct answer.
  3. A signed employment contract for the information security manager
  4. A list of all past security awareness training sessions

Explanation

Clause 4.3 requires the scope and boundaries of the ISMS to be available as documented information. A clear scope statement that identifies units, locations, systems and any justified exclusions is the natural evidence.

Question 10Context of the organization

Clause 4.4 of ISO/IEC 27001:2022 requires the organization to establish, implement, maintain and continually improve the ISMS. Which statement best captures what the ISMS comprises?

  1. The set of security policies approved by the board
  2. A single risk register stored on a shared drive
  3. A collection of security tools purchased from a vendor
  4. The processes needed and their interactions, in accordance with the requirements of the standard Correct answer.

Explanation

Clause 4.4 requires the ISMS to include the processes needed and their interactions. The ISMS is a management system, meaning an interrelated set of processes, not merely a document or a technology stack. Policies and risk registers are components within those processes.

Question 11Context of the organization

During a management review, a director asks why the context analysis must be revisited. What is the most defensible answer under ISO/IEC 27001:2022?

  1. Because context is not static, and changes in external and internal issues or interested party requirements can affect the suitability of the ISMS Correct answer.
  2. Because the standard mandates a full context review every 30 days
  3. Because the context analysis must be rewritten whenever a new employee joins
  4. Because auditors require a new context document for each internal audit

Explanation

Context is dynamic: regulatory changes, market shifts, restructuring and new interested party requirements can alter the risk landscape. Clause 6.1.2 and Clause 10 expect the ISMS to respond to change, so the context analysis is revisited periodically and on significant change.

Question 12Context of the organization

Which of the following best distinguishes an internal issue from an external issue under Clause 4.1?

  1. An external issue only concerns foreign governments
  2. An internal issue is always more severe than an external issue
  3. An internal issue is one that has already caused an incident
  4. An internal issue arises from the organization's own governance, culture, capabilities or resources, while an external issue arises from its legal, social, technological or market environment Correct answer.

Explanation

The distinction is source-based: internal issues come from within the organization, such as governance, culture, structure and capabilities, while external issues come from the wider environment, such as legal, regulatory, competitive and technological factors. Severity or incident history does not define the category.

Question 13Context of the organization

An organization operates in several countries with differing privacy laws. How should this be reflected in Clause 4.2 analysis?

  1. The requirements should be summarised as a single generic obligation with no country detail
  2. Privacy laws should be excluded because they are not information security requirements
  3. Each relevant regulator should be identified as an interested party with its specific legal requirements captured Correct answer.
  4. Only the regulator in the headquarters country should be listed

Explanation

Where multiple jurisdictions apply, each regulator is a relevant interested party and its specific requirements must be determined. Capturing them individually allows the ISMS to address differing obligations in risk assessment and controls. Generic summarisation risks losing legally significant differences.

Question 14Context of the organization

What is the primary purpose of determining the context of the organization in an ISMS?

  1. To satisfy a documentation checklist for the certification audit
  2. To replace the need for a risk treatment plan
  3. To provide a basis for designing an ISMS that is appropriate to the organization's situation and risks Correct answer.
  4. To standardise all organizations in a sector to the same controls

Explanation

Context determination ensures the ISMS is tailored to the organization's actual situation, including its environment and stakeholders. This supports proportionate risk-based decisions rather than a one-size-fits-all control set. Documentation and audit readiness are secondary effects.

Question 15Context of the organization

Which output most directly results from combining the Clause 4.1 and Clause 4.2 determinations?

  1. A completed Statement of Applicability with all 93 controls implemented
  2. A documented understanding of the environment and stakeholder requirements that informs scope, risk criteria and the ISMS processes Correct answer.
  3. A certified penetration test report
  4. A signed non-disclosure agreement with every employee

Explanation

Clauses 4.1 and 4.2 together establish the environmental and stakeholder picture that feeds scope definition, risk criteria and process design. The Statement of Applicability comes later from risk treatment, and technical reports or NDAs are separate operational artefacts.

Question 16Context of the organization

Clause 4.3 states the scope must consider interfaces and dependencies. Which situation best illustrates a dependency that should be reflected in the scope?

  1. The in-scope payment service relies on an outsourced identity provider that authenticates all users Correct answer.
  2. The marketing team prefers a particular font in documents
  3. The board meets on the first Tuesday of each month
  4. The organization's cafeteria menu is changed quarterly

Explanation

A dependency exists where an in-scope service relies on an external or out-of-scope component, such as an outsourced identity provider. Clause 4.3 requires such interfaces and dependencies to be considered so that risks at the boundary are managed. The other items are unrelated to ISMS boundaries.

Question 17Context of the organization

Which statement about interested parties under Clause 4.2 is accurate?

  1. Not every interested party is relevant; the organization determines which parties and requirements are relevant to the ISMS Correct answer.
  2. Interested party requirements are optional inputs that may be disregarded in risk assessment
  3. Every party that has ever contacted the organization must be listed
  4. Interested parties are limited to shareholders and regulators

Explanation

Clause 4.2 requires determining the interested parties that are relevant to the ISMS, which implies a filtering decision. Relevant requirements then inform the scope and risk process; irrelevant parties need not be captured.

Question 18Context of the organization

A certification auditor asks for evidence of Clause 4.1 activity. Which artefact provides the strongest direct evidence?

  1. A network diagram showing firewall placement
  2. A training attendance sheet for awareness sessions
  3. A list of security incidents from the past year
  4. A context analysis document recording external and internal issues and how they were determined Correct answer.

Explanation

The strongest evidence for Clause 4.1 is a documented analysis of external and internal issues that shows how they were identified and why they are relevant. Technical diagrams, incident lists and training records evidence other clauses.

Question 19Context of the organization

How does Clause 4.1 interact with Clause 6.1.1, which requires planning to address risks and opportunities?

  1. Clause 6.1.1 applies only to opportunities, not risks
  2. Clause 4.1 issues are recorded but never used in planning
  3. Issues identified in the context analysis can be treated as sources of risks and opportunities that the ISMS must plan for Correct answer.
  4. Clause 6.1.1 supersedes Clause 4.1 once planning begins

Explanation

Clause 6.1.1 requires the organization to consider the issues from Clause 4.1 when planning how to address risks and opportunities. The context analysis therefore feeds directly into planning, ensuring the ISMS responds to its environment.

Question 20Context of the organization

Which of these is a valid reason for an organization to exclude a business unit from its ISMS scope?

  1. The unit operates under a separate, independently certified ISMS with defined interfaces to the in-scope ISMS Correct answer.
  2. The unit has a high number of security incidents
  3. The unit is located in a different building
  4. The unit's manager dislikes audits

Explanation

Exclusions should be justified on sound grounds, such as a separate certified ISMS with managed interfaces. Dislike of audits, poor incident history or physical location are not defensible criteria and may raise questions about the credibility of the scope.

Question 21Context of the organization

What does ISO/IEC 27001:2022 require regarding the documentation of the scope of the ISMS?

  1. It must be available as documented information Correct answer.
  2. It must be verbal and communicated at team meetings
  3. It must be filed only with the certification body
  4. It must be reviewed by a lawyer before every audit

Explanation

Clause 4.3 requires the scope of the ISMS to be available as documented information. This makes the boundaries and applicability reviewable by interested parties and auditors.

Question 22Context of the organization

An organization's context analysis identifies that a key customer now requires ISO/IEC 27001 certification as a contractual condition. How should this be handled under Clause 4.2?

  1. Treat it only as a marketing opportunity with no ISMS impact
  2. Ignore it because customer demands are commercial rather than security matters
  3. Record the customer as a relevant interested party and capture the certification requirement as a requirement relevant to the ISMS Correct answer.
  4. Record it as an internal issue because the customer is known to the organization

Explanation

A customer imposing certification is a relevant interested party with a requirement relevant to the ISMS. Clause 4.2 requires capturing that requirement, which then influences scope, objectives and planning. The commercial origin of the requirement does not make it irrelevant.

Question 23Context of the organization

Which statement reflects the relationship between Clause 4.4 and the Plan-Do-Check-Act cycle embedded in the standard?

  1. Clause 4.4 replaces the need for evaluation and improvement activities
  2. Establishing the ISMS under Clause 4.4 is the starting point that the remaining clauses build on through planning, operation, evaluation and improvement Correct answer.
  3. Clause 4.4 applies only after certification has been achieved
  4. Clause 4.4 is optional for organizations with fewer than ten staff

Explanation

Clause 4.4 establishes the ISMS, and Clauses 5 to 10 provide the leadership, planning, support, operation, evaluation and improvement activities that sustain it. The management system is cyclical, with Clause 4 providing the foundation.

Question 24Context of the organization

A consultant proposes documenting context once at the start of the project and never updating it. What is the most accurate assessment?

  1. This is acceptable because context has no effect on risk assessment
  2. This is acceptable because Clause 4.1 requires a single initial determination only
  3. This is inadequate because context must be reviewed and updated in response to changes, and it feeds ongoing risk assessment and management review Correct answer.
  4. This is inadequate only if the organization has more than 250 employees

Explanation

While Clause 4.1 does not prescribe a fixed review cycle, the ISMS must remain suitable and effective, and management review under Clause 9.3 considers changes in external and internal issues. A static context document quickly becomes stale and undermines risk-based decisions.

Question 25Context of the organization

Which pair of factors would most likely be classified as internal issues affecting an organization's ISMS?

  1. Its governance structure and the information security competence of its workforce Correct answer.
  2. New data protection legislation and the emergence of a rival firm
  3. Global supply chain disruption and currency exchange rates
  4. Changes in national taxation and shifts in consumer spending

Explanation

Internal issues relate to the organization's own structure, culture, capabilities and resources, including governance and workforce competence. Legislation, competitors, taxation, consumer trends and global supply chain shifts are external environmental factors.

Question 26Context of the organization

Under Clause 4.1 of ISO/IEC 27001:2022, which pair of factors is most clearly external to the organization's information security context?

  1. Its documented risk appetite and its internal audit capacity
  2. The organization's internal security culture and its staff competence levels
  3. Competitor activity in the market and applicable regulatory changes Correct answer.
  4. Its organizational structure and its contractual obligations to staff

Explanation

Clause 4.1 asks the organization to determine external and internal issues relevant to its purpose and that affect its ability to achieve the intended ISMS outcomes. External issues arise from the legal, regulatory, market, competitive and technological environment outside the organization's control. Competitor activity and regulatory change are classic external categories, whereas culture, structure and internal capability are internal.

Question 27Context of the organization

An organization is defining its ISMS scope. Which statement best describes how Clause 4.3 of ISO/IEC 27001:2022 treats exclusions?

  1. Any exclusion must be justified by a documented risk assessment approved by the auditor
  2. Exclusions are only allowed for business units outside the organization's home country
  3. Exclusions are not permitted once the scope statement has been approved by top management
  4. The scope must state which requirements of the standard are not applicable and why Correct answer.

Explanation

Clause 4.3 requires the scope to be available as documented information and to state which requirements of ISO/IEC 27001 are not applicable, with justification. This differs from older clause structures that spoke of exclusions from Annex A controls. The justification must be defensible against the boundary and applicability determination.

Question 28Context of the organization

A company identifies that its main customer now demands evidence of ISO/IEC 27001 certification. In Clause 4.2 terms, how should this be handled?

  1. As a risk that must be transferred to the customer through the contract
  2. As an external issue under Clause 4.1 that needs no further treatment
  3. As a contractual matter outside the ISMS because it originates from a customer
  4. As an interested party requirement that is relevant to the ISMS and must be determined and addressed Correct answer.

Explanation

Clause 4.2 requires the organization to determine interested parties relevant to the ISMS and the requirements of those parties. A customer demanding certification is a relevant interested party whose requirement must be determined and then considered when planning the ISMS. Treating it only as a contract term would miss the requirement to feed it into the ISMS.

Question 29Context of the organization

Which output is the most direct and expected result of completing the Clause 4.1 and 4.2 determinations?

  1. A signed management review minutes record covering the previous year
  2. Documented information on external and internal issues and on interested parties and their requirements Correct answer.
  3. A register of all information assets with assigned owners and classifications
  4. A completed Statement of Applicability listing all 93 Annex A controls

Explanation

Clauses 4.1 and 4.2 require the organization to determine issues and interested party requirements, and ISO/IEC 27001 expects this information to be maintained as documented information. The Statement of Applicability and asset register are outputs of later clauses such as 6.1.3 and asset management, not of the context determination itself.

Question 30Context of the organization

Clause 4.4 requires the organization to establish, implement, maintain and continually improve the ISMS. What does this imply about the ISMS as a management system?

  1. It is a one-time project deliverable that ends at certification
  2. It is a document set that only needs review when a security incident occurs
  3. It is a collection of security controls installed on technical infrastructure
  4. It is a set of interrelated processes that must be kept operating and improved over time Correct answer.

Explanation

Clause 4.4 frames the ISMS as a management system comprising interrelated processes that must be established, implemented, maintained and continually improved. This reflects the ongoing, process-based nature of the system rather than a static deliverable or a technical control set. Continual improvement links the ISMS to the Plan-Do-Check-Act cycle.

Question 31Context of the organization

An auditor asks how the organization ensures the ISMS scope remains valid after a merger adds a new data centre. Which response best reflects Clause 4.3?

  1. The boundaries and applicability must be reviewed and the scope updated as documented information Correct answer.
  2. The merger is recorded as an external issue and no scope change is needed
  3. The scope is fixed at certification and changes only at the next surveillance audit
  4. The new data centre is automatically out of scope because it was not in the original statement

Explanation

The scope must reflect the organization's boundaries and applicability, which change when the organization changes. Clause 4.3 requires the scope to be available as documented information, so a merger affecting operations should trigger review and update. Recording the merger only as an external issue would not address the scope determination.

Question 32Context of the organization

Which statement accurately characterises the relationship between Clause 4.1 and Clause 6.1.1?

  1. Clause 4.1 outputs feed the planning of risks and opportunities required by Clause 6.1.1 Correct answer.
  2. Clause 6.1.1 applies only to external issues while Clause 4.1 covers internal issues
  3. Clause 6.1.1 replaces Clause 4.1 once the ISMS is certified
  4. Clause 4.1 and Clause 6.1.1 address unrelated subjects and do not interact

Explanation

Clause 6.1.1 requires the organization to plan actions to address risks and opportunities, considering the issues referred to in Clause 4.1 and the requirements referred to in Clause 4.2. The context determination therefore provides the input that risk and opportunity planning must consider. The two clauses are sequential and complementary, not alternatives.

Question 33Context of the organization

Which pair of factors would most appropriately be classified as internal issues under Clause 4.1?

  1. Workforce skills gaps and the organization's governance arrangements Correct answer.
  2. Competitor mergers and emerging attack techniques
  3. New privacy legislation and changing customer expectations
  4. Supplier bankruptcy and hosting provider outages

Explanation

Internal issues are factors within the organization that affect its ability to achieve the intended ISMS outcomes, such as governance, culture, capability and resources. Workforce skills gaps and governance arrangements sit inside the organization's control. Legislation, suppliers, competitors and external threats are external issues.

Question 34Context of the organization

A certification auditor requests evidence that Clause 4.2 has been applied. Which artefact provides the most direct evidence?

  1. A maintained record identifying relevant interested parties and their information security requirements Correct answer.
  2. The business continuity plan with recovery time objectives
  3. The risk treatment plan showing selected controls and their implementation status
  4. The internal audit programme covering the certification cycle

Explanation

Clause 4.2 requires the organization to determine relevant interested parties and their relevant requirements, and ISO/IEC 27001 expects this to be documented information. A record listing those parties and their requirements directly evidences the clause. Risk treatment plans and audit programmes evidence later clauses.

Question 35Context of the organization

Which situation best illustrates an interface or dependency that Clause 4.3 requires the scope determination to consider?

  1. A backup tape stored in the organization's own on-site safe
  2. An outsourced payroll provider that processes employee data feeding the in-scope HR system Correct answer.
  3. A firewall rule permitting outbound HTTPS traffic from the corporate network
  4. An employee working remotely from a home office on a company laptop

Explanation

Clause 4.3 requires consideration of interfaces and dependencies, meaning relationships with external parties and other systems on which in-scope activities rely. An outsourced provider processing data that flows into an in-scope system is a clear dependency. The other options describe internal operational arrangements that do not represent an external interface or dependency.

Question 36Context of the organization

What is the primary purpose of Clause 4.1 within an ISMS?

  1. To determine the issues that can affect the ISMS's ability to achieve its intended outcomes Correct answer.
  2. To list the legal and regulatory obligations applicable to the organization
  3. To record the security controls currently deployed across the estate
  4. To define the risk acceptance criteria used by risk owners

Explanation

Clause 4.1 requires the organization to determine external and internal issues relevant to its purpose and that affect its ability to achieve the intended outcomes of the ISMS. Its purpose is to ground the ISMS in the organization's real situation. Listing legal obligations is one input to that analysis, not its overall purpose.

Question 37Context of the organization

An organization documents its context once at project start and does not revisit it. What is the most accurate assessment against ISO/IEC 27001:2022?

  1. Nonconforming, because context must be reviewed at least quarterly
  2. Acceptable, provided the original analysis was thorough
  3. Nonconforming, because the ISMS must be continually improved and context changes over time Correct answer.
  4. Acceptable, because Clause 4 has no maintenance requirement

Explanation

Clause 4.4 requires the ISMS to be maintained and continually improved, and context determinations become outdated as the organization and its environment change. A single static analysis therefore does not satisfy the ongoing nature of the requirements. The standard does not prescribe a fixed quarterly frequency, but it does require review when circumstances change.

Question 38Context of the organization

Which statement best reflects the relationship between Clause 4.4 and the Plan-Do-Check-Act cycle in ISO/IEC 27001:2022?

  1. Clause 4.4 replaces PDCA with a linear implementation model
  2. PDCA applies only during initial certification, after which Clause 4.4 takes over
  3. The ISMS processes established under Clause 4.4 are the system that PDCA operates on to maintain and improve the ISMS Correct answer.
  4. PDCA applies only to Clause 10 and has no relationship to Clause 4.4

Explanation

ISO/IEC 27001 describes the ISMS as a set of interrelated processes that follow the Plan-Do-Check-Act model. Clause 4.4 establishes, implements, maintains and continually improves those processes, which is precisely the system that PDCA drives. The two concepts are complementary rather than alternatives.

Question 39Context of the organization

A business unit is proposed for exclusion from the ISMS scope. Which reason is most defensible under Clause 4.3?

  1. The unit uses different technology from the rest of the organization
  2. The unit was acquired after the organization first achieved certification
  3. The unit's manager has not completed security awareness training
  4. The unit performs no activities affecting the confidentiality, availability or integrity of in-scope information Correct answer.

Explanation

Scope determination turns on boundaries and applicability, so an exclusion is defensible when the activity genuinely does not affect the information security of in-scope information. Excluding a unit merely because it is new, uses different technology or has training gaps would leave a gap in the ISMS coverage. The justification must be documented and defensible.

Question 40Context of the organization

Which statement about Clause 4.2 is accurate?

  1. Interested parties are limited to regulators and law enforcement bodies
  2. The requirements of interested parties must be determined only when they are legally binding
  3. Only external parties count as interested parties under the clause
  4. Interested parties include internal and external parties whose requirements are relevant to the ISMS Correct answer.

Explanation

Clause 4.2 refers to interested parties relevant to the ISMS, which can be internal or external, such as employees, customers, suppliers, regulators and shareholders. The organization must determine which of their requirements are relevant and must be addressed. Limiting the clause to regulators or to legally binding requirements is too narrow.

Question 41Leadership

Under ISO/IEC 27001:2022, which clause establishes the requirement that top management demonstrate leadership and commitment with respect to the information security management system?

  1. Clause 5.1 Correct answer.
  2. Clause 7.5
  3. Clause 9.3
  4. Clause 4.1

Explanation

Clause 5.1 is the leadership and commitment requirement and lists specific actions top management must take, such as ensuring the policy and objectives are compatible with strategic direction and integrating ISMS requirements into business processes. Clause 4.1 addresses understanding the organization and its context, clause 9.3 covers management review, and clause 7.5 covers documented information.

Question 42Leadership

ISO/IEC 27001:2022 requires top management to ensure that information security policy and objectives are compatible with what?

  1. The results of the most recent penetration test
  2. The supplier contract portfolio
  3. The IT budget cycle
  4. The strategic direction of the organization Correct answer.

Explanation

Clause 5.1 requires top management to ensure the information security policy and objectives are compatible with the organization's strategic direction. This ties the ISMS to business strategy rather than to operational artefacts such as test results or budgets.

Question 43Leadership

Which of the following is an explicit top management responsibility listed in clause 5.1 of ISO/IEC 27001:2022?

  1. Performing the annual internal audit programme
  2. Configuring security monitoring tools
  3. Integrating ISMS requirements into the organization's business processes Correct answer.
  4. Approving every individual risk treatment plan

Explanation

Clause 5.1 explicitly requires top management to ensure that the requirements of the ISMS are integrated into the organization's business processes. Internal audit is an independent function, and detailed operational activities such as tool configuration and individual treatment approvals are delegated.

Question 44Leadership

A newly appointed CEO wants to know what ISO/IEC 27001:2022 requires of top management in relation to resources. Which statement reflects the standard?

  1. Top management must hold the information security budget in a separate cost centre
  2. Top management must delegate resource decisions entirely to the CISO
  3. Top management must ensure that the resources needed for the ISMS are available Correct answer.
  4. Top management must personally approve each purchase order above a threshold

Explanation

Clause 5.1 requires top management to ensure that the resources needed for the information security management system are available. The standard does not prescribe procurement mechanics or budgeting structures, and responsibility cannot be fully delegated away.

Question 45Leadership

What does clause 5.2 of ISO/IEC 27001:2022 require top management to do with the information security policy?

  1. Establish it, and ensure it is appropriate to the purpose of the organization Correct answer.
  2. Review it only after a security incident
  3. Delegate its authorship to the internal audit function
  4. Publish it exclusively to external interested parties

Explanation

Clause 5.2 requires top management to establish an information security policy that is appropriate to the purpose of the organization. The policy must also provide a framework for setting objectives, include a commitment to satisfy applicable requirements, and include a commitment to continual improvement.

Question 46Leadership

Clause 5.2 of ISO/IEC 27001:2022 requires the information security policy to include a commitment to satisfy applicable requirements and a commitment to what else?

  1. Adoption of a specific control framework
  2. Continual improvement of the ISMS Correct answer.
  3. Elimination of all identified information security risk
  4. Annual third-party certification

Explanation

The policy must contain a commitment to satisfy applicable requirements and a commitment to continual improvement of the information security management system. Risk can be treated and reduced but not eliminated entirely, and no specific framework or certification body is mandated.

Question 47Leadership

Which requirement applies to the information security policy under clause 5.2 of ISO/IEC 27001:2022?

  1. It must be reissued in full every quarter
  2. It must be kept confidential from all employees
  3. It must be signed by every external supplier
  4. It must be available as documented information Correct answer.

Explanation

Clause 5.2 requires the information security policy to be available as documented information, and clause 7.5 governs how that documented information is controlled. There is no mandated reissue frequency, and the policy must be communicated within the organization rather than withheld.

Question 48Leadership

Clause 5.3 of ISO/IEC 27001:2022 requires top management to ensure that responsibilities and authorities for information security are assigned and communicated. What must these assignments also do?

  1. Replace the need for a risk assessment
  2. Ensure the ISMS conforms to the requirements of the standard Correct answer.
  3. Remove the need for management review
  4. Guarantee that no security incidents will occur

Explanation

Clause 5.3 requires that relevant roles have assigned responsibility and authority for ensuring the ISMS conforms to the requirements of ISO/IEC 27001, for reporting ISMS performance to top management, and for related duties. Assigning roles does not remove other ISMS processes such as risk assessment or management review.

Question 49Leadership

According to clause 5.3 of ISO/IEC 27001:2022, to whom must the performance of the ISMS be reported?

  1. All external interested parties
  2. The certification body
  3. The internal audit team only
  4. Top management Correct answer.

Explanation

Clause 5.3 requires that assigned roles report the performance of the information security management system to top management. Reporting to external parties or the certification body is governed by other requirements and communication decisions, not by this clause.

Question 50Leadership

An organization assigns ISMS coordination to a single person but gives that person no authority to enforce corrective actions across departments. Which clause 5.3 requirement is most directly unmet?

  1. The policy must be reviewed at planned intervals
  2. Relevant responsibilities and authorities must be assigned and communicated Correct answer.
  3. Documented information must be version controlled
  4. Interested parties must be determined

Explanation

Clause 5.3 requires both responsibility and authority to be assigned and communicated for relevant roles. Responsibility without authority leaves the coordinator unable to ensure the ISMS conforms, which is the essence of the requirement.