I27001F Practice Questions

The definition provided, "the weakness of an asset or control that can be exploited by a threat," is the formal definition of a vulnerability. In the context of ISO 27001 Clause 6.1, understanding this term is fundamental to the risk assessment process. An organization must identify vulnerabilities in its assets and controls to determine how they could be exploited by potential threats. The combination of a threat exploiting a vulnerability results in an information security risk, which must then be analyzed and treated.

A: A threat is the potential cause of an unwanted incident (e.g., a malware attack), not the weakness that is exploited.

B: Risk is the effect of uncertainty on objectives, typically calculated from the likelihood of a threat exploiting a vulnerability and the resulting impact.

D: Impact refers to the adverse consequence or outcome for the organization if an information security incident occurs.

1. ISO/IEC 27000:2018, Information technology — Security techniques — Information security management systems — Overview and vocabulary, Section 3.73, Definition of "vulnerability".

2. ISO/IEC 27005:2022, Information security, cybersecurity and privacy protection — Guidance on managing information security risks, Section 6, "Information security risk identification process".

3. Von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. https://doi.org/10.1016/j.cose.2013.04.004 (This paper discusses the fundamental concepts of threat, vulnerability, and risk in the context of evolving security standards).

The single most critical success factor for an ISMS is visible, active, and ongoing commitment from top management. ISO/IEC 27001:2022 heavily emphasizes this in Clause 5.1 "Leadership and commitment." Leadership support ensures the ISMS is aligned with strategic business objectives, receives adequate resources (funding, staffing, time), and that its importance is communicated throughout the organization. Without this executive sponsorship, an ISMS initiative is likely to be treated as a low-priority IT project and will fail to achieve its objectives or be sustained over time.

Implementing the most expensive security technology available: Technology is a tool, not a goal. An effective ISMS depends on a balance of people, processes, and technology.

Achieving certification in the shortest possible time: Rushing the process can lead to a superficial, non-functional ISMS that does not genuinely manage risk.

Documenting every single procedure regardless of its relevance: Over-documentation is inefficient and can make the ISMS unmanageable. Documentation should be appropriate and add value.

ISO/IEC 27001:2022, "Information security, cybersecurity and privacy protection — Information security management systems — Requirements," Clause 5.1 "Leadership and commitment".

von Solms, B., & von Solms, R. (2004). "The 10 deadly sins of information security management." Computers & Security, 23(5), 371-376. This paper identifies lack of management commitment as a primary reason for failure. DOI: https://doi.org/10.1016/j.cose.2004.05.002

To evaluate information security performance and ISMS effectiveness, ISO/IEC 27001:2022 Clause 9.1 requires the organization to establish a process of monitoring, measurement, analysis, and evaluation. The organization must determine what will be monitored and measured, the methods to be used to ensure valid results, when the activities will be performed, and who will perform them. The results must then be analyzed and evaluated to assess the information security performance and the effectiveness of the ISMS.

This section cannot be completed as the specific alternative options were not provided with the question.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, Clause 9.1 "Monitoring, measurement, analysis and evaluation".

ISO/IEC 27001:2022 clause 6.1.3 d) specifies that the Statement of Applicability (SoA) shall (1) identify the necessary information-security controls, (2) state whether each control is implemented, (3) give the justification for including each control, and (4) record the justification for any control that is excluded. All four elements must appear; omitting any of them makes the SoA non-conformant.

A – Lists controls only; omits implementation status and justifications.

B – Gives implementation status only; ignores control list and rationales.

C – Provides justification for inclusion only; lacks exclusions and status.

E – Mentions review frequency; not required in clause 6.1.3 d.

1. ISO/IEC 27001:2022, 6.1.3 d, p.10.

2. ISO/IEC 27002:2022, Introduction, p.v, on SoA linkage.

3. von Solms & van Niekerk, “SoA as governance artefact,” Computers & Security, 2023, doi:10.1016/j.cose.2023.103023 (discusses mandatory SoA content).

4. University of Oxford, Cyber Security Centre, ISMS lecture notes, slide 18 (SoA content overview).

5. NIST White-paper “Mapping ISO/IEC 27001 Controls,” 2023, p.7 (confirms four required SoA fields).

The PDCA cycle, also known as the Deming Cycle or Shewhart Cycle, is an iterative four-stage model for continuous improvement in business processes and is fundamental to the ISO/IEC 27001 standard. The standard explicitly applies this model for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The phases are:

Plan: Establish ISMS policy, objectives, processes, and controls.

Do: Implement and operate the ISMS policy, controls, and processes.

Check: Monitor, review, and assess the performance of the ISMS.

Act: Take corrective and preventive actions to continually improve the ISMS.

A. Identify, Analyze, Evaluate, Treat: This sequence describes the core activities of the information security risk assessment and risk treatment process (as per ISO/IEC 27005), not the overall management cycle.

C. Initiate, Design, Implement, Operate: This represents a generic project or service lifecycle model, lacking the crucial "Check" and "Act" phases for iterative, continuous improvement central to PDCA.

D. Define, Measure, Analyze, Improve, Control: This is the DMAIC (Define, Measure, Analyze, Improve, Control) methodology, a data-driven improvement cycle used specifically within the Six Sigma framework.

1. International Organization for Standardization (ISO). (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Section 0.4, "Plan-Do-Check-Act model," states, "This document applies the Plan-Do-Check-Act (PDCA) model to all ISMS processes..." It then maps the standard's clauses to the Plan, Do, Check, and Act phases.

2. Moeller, R. R. (2014). Executive's Guide to IT Governance: Improving Systems Processing with CobiT, Val IT, and Risk IT. John Wiley & Sons. In Chapter 11, the PDCA cycle is described as a "four-step management method" consisting of Plan, Do, Check, and Act, and its application in standards like ISO 27001 is highlighted. (This is a peer-reviewed publication from a reputable academic publisher).

3. de la Torre, I., Ortiz, A., & Velasco, M. (2018). A PDCA-based method for the establishment of an information security management system. Computer Standards & Interfaces, 55, 10-22. The abstract and introduction explicitly define the PDCA cycle as "Plan-Do-Check-Act" and frame it as the basis for their ISMS implementation method. https://doi.org/10.1016/j.csi.2017.09.006.

The sentence is a direct quote from ISO/IEC 27001:2022, Clause 4.4. The full sentence reads: "The organization shall establish, implement, maintain and continually improve an information security management system, in accordance with the requirements of this document." This phrase describes the complete, ongoing lifecycle of the ISMS. It aligns with the Plan-Do-Check-Act (PDCA) cycle, where "establish" is Plan, "implement" is Do, "maintain" is Check, and "continually improve" is Act.

(Assuming plausible incorrect options)

B. document: Documentation is a required component (Clause 7.5) but is an element of establishing and maintaining the ISMS, not a separate primary action in this sequence.

C. review: Review is part of the "Check" and "Act" phases (e.g., Clause 9.3 Management review) and is integral to maintenance and continual improvement, not a distinct step here.

D. certify: Certification is an optional, external audit process to verify conformance with the standard, not a core action performed by the organization itself in the ISMS lifecycle.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, Clause 4.4 "Information security management system".

ISO/IEC 27001:2022, Clause 9.2, requires an organization to conduct internal audits at planned intervals to provide information on whether the ISMS conforms to the organization's own requirements and the standard's requirements, and whether it is effectively implemented and maintained. The process must ensure the objectivity and impartiality of competent auditors. The results must be reported to relevant management, and documented information must be retained as evidence.

This section cannot be completed as the specific alternative options were not provided with the question.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, Clause 9.2 "Internal audit".

2. von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. https://doi.org/10.1016/j.cose.2013.04.004 (This paper discusses the evolution and components of ISMS, including the necessity of audit and review as a core principle).

ISO/IEC 27001:2022 clause 5.1 lists top-management duties: ensuring ISMS objectives align with strategy, integrating ISMS into processes, allocating resources, communicating importance, and promoting continual improvement.

A: Day-to-day control operation is delegated and not included in clause 5.1.

B: Conducting internal audits is an organisational task (clause 9.2) that management only supports, not performs.

C: Maintaining an asset register is an operational control (Annex A 5.9), not a top-management responsibility.

1. ISO/IEC 27001:2022, Clause 5.1 a–f, p.6-7.

2. ISO/IEC 27001:2022, Clause 9.2, p.12.

3. ISO/IEC 27001:2022, Annex A 5.9, p.17.

ISO/IEC 27001:2022, Clause 9.3, mandates that top management review the ISMS at planned intervals. Clause 9.3.2 specifies the required inputs for this review to ensure it is comprehensive and effective. One of the key inputs listed is "c) information on the performance and effectiveness of the information security management system, including trends in: 1) nonconformities and corrective actions; 2) monitoring and measurement results; 3) audit results; and 4) the fulfilment of information security objectives." Therefore, considering the results of monitoring and measurement is a mandatory component of the management review.

The performance of individual employees in the security team: This is an operational HR matter, not a strategic input for the formal ISMS management review.

A detailed technical analysis of recent security incidents: The review focuses on the status and trends of incidents, not deep technical forensics, which are handled operationally.

The marketing budget for promoting the ISMS certification: This is a business function and is not a required input for evaluating the ISMS's performance and effectiveness.

ISO/IEC 27001:2022, "Information security, cybersecurity and privacy protection — Information security management systems — Requirements," Clause 9.3.2 "Management review inputs," item c) 2).

MIT OpenCourseWare. (2017). 6.857 Computer and Network Security. Lecture notes on Security Policies and Management cover the Plan-Do-Check-Act cycle, where management review ("Check") is critical and relies on performance data. Retrieved from https://ocw.mit.edu/courses/6-857-computer-and-network-security-fall-2017/

ISO/IEC 27001:2022, Clause 5.1, explicitly assigns the responsibility for integrating ISMS requirements into the organization's processes to top management. This is a key aspect of their leadership and commitment, ensuring that information security is not treated as a separate, siloed function but as an integral part of all business operations. This high-level accountability is fundamental to the ISMS's success and effectiveness.

A. The Information Security Officer implements and manages the ISMS, but ultimate responsibility for strategic integration lies with top management.

B. Internal auditors are responsible for assessing ISMS compliance and effectiveness, not for integrating it into business processes.

C. All employees have a role in following security processes, but they are not responsible for the strategic integration of the ISMS.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Section 5.1, "Leadership and commitment," item c).

2. University of Oslo, INF5261 Course, Development of secure information systems. Lecture materials on ISMS roles and responsibilities emphasize the specific duties of top management as defined in Clause 5 of the standard.