ISO 27002 Lead Manager common mistakes
ISO 27002 Lead Manager · Understand the traps and how to avoid them.
Treating confidentiality, integrity and availability as a checklist to be memorized rather than relating them to the other core properties (authenticity, accountability, non-repudiation, reliability) and to the privacy principles when a scenario asks which property is at risk.
Candidates study the CIA triad in isolation, then freeze when a question describes a forged email, an unlogged change, or a data-subject access request and requires mapping the scenario to the correct property or privacy principle rather than to 'confidentiality' by default.
What to do instead
Build a one-page matrix pairing each property (CIA plus authenticity, accountability, non-repudiation, reliability) with a concrete failure example and the control family that addresses it. Do the same for privacy principles (lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability) and practise classifying ten short scenarios into property and principle before answering.
Confusing the roles of ISO/IEC 27001 and ISO/IEC 27002, answering as if 27002 were certifiable or as if 27001 prescribed a fixed control list.
The two standards are studied together, and candidates blur the requirement standard (management system, certifiable) with the guidance standard (control implementation guidance, not certifiable). Questions testing the Statement of Applicability then produce answers that cite 27002 as the source of mandatory controls.
What to do instead
Write a short comparison: 27001 = requirements for establishing, implementing, maintaining and continually improving the ISMS, auditable and certifiable; 27002 = guidance on selecting and implementing controls, referenced through Annex A and the SoA. Rehearse that the SoA justifies inclusion/exclusion of each Annex A control with reasons, and that 27002 itself is never the audit criterion for certification.
Treating the Statement of Applicability as a formality, producing justifications such as 'not applicable' or 'low risk' without linking each inclusion or exclusion to risk assessment results, legal requirements, or contractual obligations.
Candidates focus on control content and underestimate how heavily the SoA is examined. They also forget that exclusions must be defensible and that the SoA is a living document updated when risk treatment changes.
What to do instead
Practise drafting SoA rows with four fields: control reference, applicable/not applicable, justification tied to a named risk or obligation, and implementation status. For each exclusion, write the rationale that would survive an auditor's challenge. Review how risk treatment decisions flow into the SoA and back into the risk register.
Jumping straight to control selection and implementation without first establishing context, leadership commitment, risk assessment methodology, and scope of the ISMS.
The exam's practical scenarios reward sequencing, but candidates who memorised control clauses answer 'implement the control' when the correct first step is defining scope, obtaining risk criteria, or securing management approval. This is the classic 'what should be done FIRST' trap.
What to do instead
Memorise the ISMS lifecycle order (context and scope, leadership and policy, risk assessment and treatment, SoA, implementation, monitoring and measurement, internal audit, management review, continual improvement). For any 'first step' question, eliminate options that implement controls before scope, risk criteria, or approval exist.
Mixing up organisational controls with people controls, for example classifying supplier security, asset ownership, or classification schemes as people controls, or treating awareness training as an organisational control.
The 27002 clause structure groups controls thematically, and candidates rely on intuition ('training involves people, so it is a people control') instead of the actual thematic grouping. Scenario questions then test the wrong clause family.
What to do instead
Create a mapping table of the four themes (organisational, people, physical, technological) with every control title placed under its theme. Test yourself by naming the theme from the control title alone, and note the boundary cases: awareness and training, terms of employment, disciplinary process and remote working sit under people; supplier relationships, incident management and business continuity sit under organisational.
Answering people-control questions with generic 'train the staff' responses instead of the specific control intent, such as screening before employment, terms and conditions of employment, segregation of duties, confidential reporting channels, or action on termination or change of employment.
Awareness is the most familiar people control, so it becomes the default answer. Candidates miss that screening, employment terms, disciplinary process, and post-employment obligations are distinct controls with different evidence and ownership.
What to do instead
For each people control, write the control objective, a sample evidence artefact (screening record, signed employment terms, awareness completion log, exit checklist), and a failure symptom. Practise distinguishing 'before employment', 'during employment' and 'termination or change' so the answer matches the lifecycle stage in the scenario.
Treating physical controls as a single perimeter question, ignoring layered defence and the interaction between physical and environmental controls, such as combining entry controls with clear desk and clear screen, lightning protection, or secure disposal.
Physical security feels intuitive, so candidates answer 'lock the door' and overlook the control's precise scope. Questions that combine an environmental threat (fire, flood, power loss) with an access threat expose the gap.
What to do instead
Build a layered model: perimeter, building entry, secure areas, desks and screens, equipment siting and protection, supporting utilities, cabling, equipment maintenance and secure disposal or reuse. For each layer, list the control objective and one measurable indicator, then practise scenarios that require two layers at once.
Confusing technological controls that look similar, particularly access control, privileged access, authentication, logging, and monitoring, or treating encryption as a complete answer without addressing key management and data states.
The technological theme is the largest, and candidates learn control titles without their boundaries. They then select 'restrict access' when the scenario is about accountability through logging, or select 'encrypt' when the gap is key custody or classification of data at rest versus in transit.
What to do instead
For each technological control, write a one-line boundary statement ('access control decides who may act; logging records who did act; monitoring detects anomalies in those records'). For cryptography, always state the data state, the key management lifecycle, and who owns the keys. Drill paired scenarios until the distinctions are automatic.
Designing measurement as a count of activities (number of training sessions, number of policies) rather than as evidence that controls are effective, and failing to define monitoring, measurement, analysis and evaluation criteria in advance.
Candidates default to activity metrics because they are easy to imagine, and they forget that the standard requires determining what to monitor, the methods, when to monitor, who analyses results, and when results are evaluated. This produces answers that cannot demonstrate effectiveness.
What to do instead
Practise writing measurement entries with the fields: what is measured, method, frequency, owner, threshold, and the decision triggered when the threshold is breached. Convert activity metrics into effectiveness metrics (for example, from 'number of phishing simulations' to 'click rate trend against a defined target') and state how the result feeds management review and corrective action.
Treating internal audit, management review, and control testing as interchangeable, and describing corrective action as 'fix the finding' without root cause analysis, ownership, or verification of effectiveness.
The continual improvement clauses are examined through scenarios, and candidates collapse the distinct purposes: audit provides independent assurance, management review provides direction and resource decisions, and testing provides technical evidence. Without that separation, answers name the wrong mechanism.
What to do instead
Write a three-column table contrasting internal audit, management review and control testing on purpose, frequency, inputs, outputs and independence. Then practise nonconformity handling as a sequence: contain, root cause analysis, corrective action plan with owner and date, verification of effectiveness, and update to risk assessment or SoA where relevant.