ISO/IEC 27002 Foundation common mistakes
ISO/IEC 27002 Foundation · Understand the traps and how to avoid them.
Treating confidentiality, integrity and availability as interchangeable labels and mislabelling scenarios (e.g. calling a ransomware encryption event only a confidentiality breach, or classifying a defaced public website as purely an availability issue).
Candidates memorise the three letters but never practise mapping real incidents to the property that is actually harmed, so they default to 'confidentiality' whenever data is mentioned.
What to do instead
Before answering, write down which property is directly harmed and which are secondary. Ransomware: availability lost first, confidentiality potentially lost if exfiltration occurred, integrity harmed by encryption. Defacement: integrity primarily. Practise with ten short incident descriptions and justify each classification in one sentence.
Confusing the CIA triad with the additional properties used in the standard's definitions, such as authenticity, accountability, non-repudiation and reliability, and selecting 'integrity' for every question about proving who sent a message or who did what.
Study material often presents only the triad, so candidates force every scenario into three boxes and miss that non-repudiation and accountability are named concepts in the vocabulary.
What to do instead
Learn the fuller property list with a one-line test each: authenticity (the entity is who it claims), accountability (actions can be attributed to an entity), non-repudiation (an action cannot later be denied), reliability (consistent intended behaviour). Match the verb in the question to the property.
Mixing up the roles of asset owner, asset custodian, risk owner and control owner, for example saying the IT administrator who runs backups is accountable for the information asset.
Job titles feel like they map to roles, so candidates assign accountability to whoever operates the system rather than to the person with management responsibility for the asset.
What to do instead
Anchor on accountability versus operation: the owner has management responsibility and decides classification and access rules; the custodian implements and operates controls on the owner's behalf. Risk owner accepts risk; control owner maintains the control. Read each option and ask 'who answers for this, and who does the work?'
Treating risk treatment options as synonyms, or assuming 'avoid' means applying more controls, and failing to distinguish residual risk from the risk that remains after treatment versus the risk that has not yet been assessed.
Everyday language uses 'mitigate', 'avoid' and 'reduce' loosely, and candidates do not rehearse the standard's treatment categories against concrete examples.
What to do instead
Fix four definitions with examples: avoid (stop the activity), mitigate/reduce (apply controls), transfer/share (insurance, contract), accept (documented decision within risk appetite). Residual risk is what remains after treatment and must be accepted by the risk owner. Build a four-row table and place five scenarios into it.
Conflating information security, cybersecurity and privacy as one discipline, so privacy questions get answered with security controls and vice versa, and data protection principles are attributed to the wrong concept.
The standard deliberately defines these as related but distinct, and candidates skim the scope statements because they look like introductory padding.
What to do instead
Learn the distinguishing object: information security protects information in all forms; cybersecurity protects networks, systems and their users in cyberspace; privacy protects personally identifiable information and is governed by principles such as lawful and fair processing, purpose limitation and minimisation. When a question mentions personal data, ask first whether the issue is a protection-of-information problem or a lawful-processing problem.
Answering control questions with a generic good practice ('train staff', 'review regularly') instead of identifying the specific control objective and the mechanism the standard describes, such as access restriction, segregation of duties, or secure disposal.
Candidates rely on general experience rather than the standard's control structure, so plausible-sounding but non-specific answers attract them.
What to do instead
For each control, memorise the objective plus one concrete mechanism. Ask 'what does this control actually do, and what artefact or action proves it exists?' If an option could apply to any control in the standard, it is usually the distractor. Prefer the option naming a specific mechanism over the option naming a general attitude.
Confusing preventive, detective and corrective controls, or classifying monitoring and logging as preventive because 'it stops incidents happening'.
The categories are intuitive in name but candidates do not test each option against the timing question: before, during or after the event.
What to do instead
Apply a timing test to every option. Does it stop an event before it occurs (preventive: access restriction, segregation of duties), reveal it as or after it occurs (detective: logging, monitoring, review), or restore after it (corrective: backup restore, incident response)? Some controls are both; state which function the question is asking about.
Treating access control as a single topic and misassigning questions between access control policy, registration and de-registration of users, privilege management, authentication, and review of access rights, for example answering a leaver question with 'review of access rights' rather than timely removal.
These controls sit close together in the standard and candidates learn the heading rather than the individual control intent.
What to do instead
Map each sub-topic to its lifecycle moment: policy sets rules; registration creates access; privilege management controls what level; authentication verifies identity; review checks access periodically; de-registration removes it on change of role or exit. Read the scenario for the trigger event (new joiner, mover, leaver) and pick the control matching that trigger.
Ignoring the supporting clauses that make controls work, such as documented information, roles and responsibilities, and the fact that the standard's controls are generic and must be selected and tailored through risk assessment.
Candidates focus on the numbered control clauses and skim the introductory and structural content, then answer 'always implement all controls' or 'the standard prescribes a fixed control set'.
What to do instead
Remember the standard provides a reference set of controls, not a mandatory checklist: organisations select controls relevant to their risks, often using a risk treatment process. Also learn that documented information and clear responsibilities are themselves required supporting elements. Reject options claiming the standard mandates every control for every organisation.
Skipping the incident management and business continuity controls or reducing them to 'have a plan', then failing questions about the sequence of activities (preparation, detection and reporting, assessment and decision, response, learning) and about testing continuity arrangements.
These controls feel managerial and are deprioritised during study, so candidates answer with vague intent rather than the standard's activity structure.
What to do instead
Learn the incident lifecycle as an ordered sequence and be able to place an activity (reporting, triage, containment, post-incident review) at the right stage. For continuity, distinguish planning from testing and rehearse that arrangements must be exercised, reviewed and updated. Match the verb in the question (detect, decide, respond, learn) to the stage.