ISMP Practice Questions

According to the information security risk management process defined in ISO/IEC 27001, an organization must first establish its risk criteria, which includes the criteria for risk acceptance. These criteria define the level of risk the organization is willing to tolerate. Only after a risk has been identified, analyzed, and evaluated against these pre-defined acceptance criteria can a decision be made on whether treatment is necessary. This foundational step ensures that decisions about risk treatment are consistent, objective, and aligned with the organization's strategic goals and risk appetite. Without these criteria, there is no basis for making informed decisions on how to handle identified risks.

B. How to apply appropriate controls to reduce the risks: This is a part of the risk treatment phase itself, which occurs after it has been decided that a risk is unacceptable.

C. Mitigation plans: These are specific outcomes of the risk treatment process. Developing them is a form of treatment, not a prerequisite for considering it.

D. The development of own guidelines: While important for the overall framework, establishing specific risk acceptance criteria is the direct, necessary input for the treatment decision.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 6.1.2 (Information security risk assessment): This clause mandates that the organization shall "establish and maintain information security risk criteria that include: 1) the risk acceptance criteria...". This step is part of the risk assessment process, which precedes the risk treatment process.

Clause 6.1.3 (Information security risk treatment): This clause details the process of selecting and implementing risk treatment options, which is performed based on the results of the risk assessment. This confirms that criteria must be established before treatment is considered.

2. ISO/IEC 27005:2022 - Guidance on managing information security risks.

Clause 7.2 (Risk criteria): This section details the establishment of criteria for performing risk evaluation and for accepting risks. It states, "The organization should define criteria for evaluating the significance of risks and for supporting decision-making processes."

Clause 8.2 (Risk evaluation): This clause explains that the purpose of risk evaluation is to "support decisions" by "comparing the results of risk analysis with the risk criteria established in 7.2, in order to determine where additional action is needed." This explicitly places the establishment of criteria before the decision on treatment (additional action).

The principle of physical security zoning is to group areas with similar security requirements and access levels. A lobby and a public restaurant are both public-facing areas, designed for open access by visitors, clients, and the general public. They share a similar, low-security profile where the primary controls are focused on reception and general monitoring. Combining them into a single "public" or "unrestricted" zone is a logical and efficient application of the zoning principle, as it effectively isolates these open areas from more sensitive, restricted parts of the facility.

A. A boardroom requires high confidentiality and restricted access, which is a much higher security level than a general office space.

B. A computer room is a critical, high-security area, demanding far more stringent environmental and access controls than a typical storage facility.

D. Human Resource rooms contain sensitive personal data requiring strict access control, a significantly higher security level than general-purpose meeting rooms.

1. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Clause 7.2 Physical entry: This control's objective is to ensure only authorized individuals get physical access. The implementation guidance advises creating physical security perimeters to protect areas. It states, "The design of physical security perimeters should take into account... the separation of publicly accessible areas (e.g. reception area) from internal areas." This directly supports separating public zones (Lobby, Restaurant) from internal zones (Offices, HR rooms, Boardroom).

2. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson.

Chapter 13, Section 13.1, Physical Security: This chapter, common in university information security curricula, discusses physical facility design. It outlines the need to establish outer and inner perimeters, separating publicly accessible areas from work areas and restricted areas. The text explains that areas like lobbies should be in an outer perimeter, while sensitive areas like data centers or HR offices require placement within more secure inner perimeters. This aligns with not combining public and restricted-function rooms.

The most effective and standard way to begin setting information security controls is by establishing a security baseline. A baseline defines a consistent, mandatory minimum level of security that applies to all systems and components across the organization. This approach ensures a uniform security posture and simplifies management and auditing. Once the baseline is implemented, a risk analysis can be performed to identify specific threats and vulnerabilities that may require additional controls beyond the baseline standard. This structured methodology is a fundamental principle in established information security management frameworks.

A. A risk analysis is performed to identify needs for controls beyond the baseline, making it a subsequent, not an initial, step.

B. Default factory standards are often insecure and are considered a primary vulnerability, not a secure foundation for an organization's security.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53, Revision 5). Section 2.3, "Control Selection Process," p. 16. This document explicitly describes the process of selecting an initial baseline of controls as a foundational step.

(Available at: https://doi.org/10.6028/NIST.SP.800-53r5)

2. Von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. This academic paper discusses the evolution of security practices, implicitly supporting the foundational nature of baselines (standard information security controls) before addressing more complex cyber threats.

(DOI: https://doi.org/10.1016/j.cose.2013.04.004)

3. Tipton, H. F., & Krause, M. (Eds.). (2007). Information Security Management Handbook (6th ed., Vol. 1). Auerbach Publications. Chapter 2, "The Information Security Program," discusses establishing a baseline of minimum-security requirements as a fundamental element of a comprehensive security program.

(ISBN: 978-0849374951)

The integrity of the unit price is the most critical classification aspect. Integrity ensures that the price data is accurate, complete, and has not been altered without authorization. An incorrect price, whether due to error or malicious attack, can lead to significant financial losses for the company (e.g., selling products at a fraction of their cost) or a complete loss of sales and customer trust (if priced too high). While availability is crucial for a 24-hour service, the consequences of an integrity failure for financial data are typically more severe and damaging to the business's viability than a temporary loss of availability.

A. Confidentiality: The unit price in a public webshop is public information intended for all visitors; therefore, confidentiality is the least important concern.

C. Availability: While the price must be available for a sale to occur, an available but incorrect price (an integrity failure) can cause more significant financial and reputational damage.

1. ISO/IEC 27000:2018, Information technology — Security techniques — Information security management systems — Overview and vocabulary.

Section 3.28: Defines integrity as the "property of accuracy and completeness." For transactional data like pricing, accuracy is paramount to prevent financial loss and maintain business viability. The standard emphasizes that the importance of C, I, and A depends on the context, and for financial data, integrity is typically the highest priority.

2. NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations.

Appendix F, Security Control Catalog, SI-7 Software, Firmware, and Information Integrity: This control family highlights the need to protect the integrity of information at all points in its lifecycle. The document implicitly supports that for data like pricing, where accuracy directly impacts financial outcomes, integrity controls are of the highest importance. The impact of an integrity loss is often categorized as high or catastrophic for financial systems.

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 387-408.

Section A.3: Design Principles, Complete Mediation: This foundational paper in computer security discusses principles that support data integrity. While not using the term "integrity" in the modern sense, the principle of checking every access to every object is fundamental to preventing unauthorized modification of critical data like price, underscoring its importance over simple availability. The consequences of acting on incorrect data are highlighted as a primary security concern.

The main argument for an open security design is rooted in Kerckhoffs's Principle, a fundamental concept in cryptography and security engineering. This principle posits that a system's security should not rely on the secrecy of its design or implementation (i.e., security by obscurity). Instead, an open design allows for rigorous and extensive public scrutiny by a wide community of security researchers, academics, and ethical hackers. This broad, independent peer review process is far more effective at identifying and rectifying potential vulnerabilities than a small, internal team could ever be. The resulting architecture is more robust because its strength has been proven through transparent, extensive testing.

A. Open designs are easily configured: Configuration complexity is a function of the system's architecture and features, not whether its design is public or secret.

B. Open designs have more functionality: The range of functionality is a design choice and is entirely independent of whether the system's design is open or proprietary.

1. Anderson, R. J. (2008). Security Engineering: A Guide to Building Dependable Distributed Systems (2nd ed.). Wiley Publishing. In Chapter 21, Section 21.1.1, "The Open Design Principle," Anderson states, "The open design of a system to public scrutiny is the only reliable way of finding out whether it is a good one... Systems that have been subjected to years of determined attack by clever people are the only ones you can trust." This directly supports that extensive testing is the key benefit.

2. Pfleeger, C. P., Pfleeger, S. L., & Margulies, J. (2015). Security in Computing (5th ed.). Prentice Hall. In Chapter 1, Section 1.4.2, "Principle of Open Design," the authors explain, "The principle of open design states that the security of a mechanism should not depend on the secrecy of its design or implementation... decades of experience have shown that open design is a more effective development practice... public scrutiny is a powerful tool for finding and eliminating security vulnerabilities."

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278–1308. https://doi.org/10.1109/PROC.1975.9939. This foundational paper on computer security principles lists "Open design" as a key principle (Section I.A.4), stating, "The design should not be secret... It is better to expose the design to public scrutiny so that flaws can be discovered."

The primary goal of a risk assessment program is to provide decision-makers with the necessary information to make informed choices about managing risk. The process is not complete after analysis or control implementation, but only when a formal decision has been made about the residual risks. When authorized management formally accepts the remaining risks, it signifies that these risks are now aligned with the organization's tolerance and appetite. This act of acceptance is the culmination of the risk management cycle, confirming that the level of risk is acceptable in the context of the organization's strategic goals.

A. Once the controls are implemented: Implementing controls is a risk treatment step; the resulting residual risk may still be unacceptable to the organization.

B. Once the transference of the risk is complete: Risk transference is only one of several risk treatment options and does not represent the goal for all identified risks.

D. When the risk analysis is completed: Risk analysis is an early phase that identifies and evaluates risk; it precedes the crucial decision-making and acceptance stages.

1. NIST Special Publication 800-30, Revision 1, "Guide for Conducting Risk Assessments." Section 2.4, "Risk Response," page 21, states: "Risk acceptance is the appropriate risk response when the identified risk is within the organizational risk tolerance... Risk acceptance is a formal process with a designated official accepting the risk on behalf of the organization." This highlights that the goal is achieved through a formal acceptance decision by a proper authority.

2. ISO/IEC 27005:2018, "Information security risk management." Clause 8.4, "Risk acceptance," specifies that management should make a formal decision to accept residual risks. The standard emphasizes that "The management decision to accept the risk, and the justification for it, should be recorded." This confirms that the process concludes with an authorized, documented decision.

3. Carnegie Mellon University, Software Engineering Institute, "The CERT Risk Analysis Method." The method's final steps involve presenting findings to decision-makers who then choose a course of action, including accepting the risk. The process is designed to "provide a sound basis for management decisions," which is the ultimate goal. (Referenced in courseware like CMU's "Managing Information Security Risks"). The accomplishment is the informed decision, not just the analysis.

An internal fraud investigation protocol must adhere to legal and privacy regulations. A workstation is company property, and employees generally have a reduced expectation of privacy when using it, especially when a clear Acceptable Use Policy is in place. This policy should state that company assets are subject to monitoring and investigation for legitimate business purposes, including security incident response. Therefore, investigating the contents of a company-owned workstation is a standard, legally defensible measure within a corporate investigation. This approach respects the critical legal distinction between corporate assets and an employee's personal property and communications.

A. A private laptop is personal property. Seizing or investigating it without a warrant or explicit consent is a severe privacy violation and generally illegal.

C. A private mailbox is protected by privacy laws (e.g., GDPR, ECPA). Accessing it without legal authorization constitutes an unlawful interception of communication.

D. Phone tapping is a highly regulated surveillance activity that typically requires a court order, making it unsuitable for a standard internal company protocol.

1. ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security controls, Control 5.31 (Legal, statutory, regulatory and contractual requirements). The implementation guidance for this control requires organizations to identify and comply with all relevant legislation, which includes privacy laws that govern the boundaries of internal investigations, distinguishing between corporate and personal property.

2. Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (3rd ed.). Chapter 3, "Legal Aspects of Digital Forensics," discusses the legal authority for searches. It clarifies that employers have the right to search their own property (e.g., a company-owned workstation) but not an employee's personal property without consent or legal authority (pp. 95-98).

3. University of California, Berkeley School of Law, Course Material. Legal precedent, often taught in cybercrime and privacy law courses, supports this distinction. For example, the U.S. case United States v. Ziegler, 474 F.3d 1184 (9th Cir. 2007), established that an employer could consent to a government search of an employee's work computer because the company owned the equipment and had a policy in place that eliminated any reasonable expectation of privacy. This principle is widely applied to internal corporate investigations.

Following a risk assessment, the next critical step in the risk management process is risk evaluation. This involves comparing the identified risks against pre-established risk criteria to determine their significance. These criteria define the organization's risk appetite and the threshold for what level of risk is acceptable. This evaluation is fundamental because it dictates the appropriate treatment strategy. Without clear acceptance criteria, decisions to mitigate, transfer, avoid, or accept risk would be arbitrary and inconsistent, undermining the entire risk management effort.

A. Immediate remediation is not always the correct or cost-effective action; risks must first be evaluated against acceptance criteria to prioritize them and determine the appropriate response.

C. Designing controls is a specific risk treatment option (mitigation). This step is premature without first evaluating the risk to decide if mitigation is the necessary treatment.

D. Risk treatment must be cost-effective. The principle of proportionality dictates that the cost of a control should not exceed the value of the asset it protects or the potential loss.

1. ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Section 6.1.2, Information security risk assessment process, item c) 2): States that the process must include "establishing and maintaining information security risk criteria" which includes "criteria for accepting risks".

Section 6.1.3, Information security risk treatment: This clause follows the risk assessment clause, indicating that treatment decisions are made based on the output of the assessment, which includes comparison against the established criteria.

2. ISO/IEC 27005:2022 Information security, cybersecurity and privacy protection — Guidance on managing information security risks.

Section 8.4, Risk evaluation: "The purpose of risk evaluation is to support decisions. Risk evaluation involves comparing the results of risk analysis with the risk criteria established in 7.3 in order to determine where additional action is needed." This explicitly places the comparison against criteria (evaluation) before deciding on treatment.

3. NIST Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View.

Section 2.2, The Risk Management Process, Page 9: The framework outlines a multi-tiered approach where risk response (treatment) is determined based on the organization's defined risk tolerance. Establishing this tolerance is equivalent to setting criteria for risk acceptance. The "Respond" step explicitly involves evaluating alternatives based on this tolerance.

The primary purpose of a person's picture on a smart card is for visual authentication. When the card is presented for access, a human, such as a security guard, can visually compare the photograph on the card to the person presenting it. This process verifies that the individual is the legitimate owner of the card, thereby authenticating their identity. This is a crucial step in preventing unauthorized use of lost or stolen cards, particularly for physical access control where a human guard is present.

B. To authorize the owner of the card: Authorization concerns the permissions granted (e.g., which doors to open), which are managed by the card's chip or a central database, not the visual photograph.

C. To identify the role of the card owner: While a card may indicate a role through text or color-coding, the photograph's specific purpose is to link the card to a unique individual, not their job function.

D. To verify the iris of the card owner: Iris verification is a sophisticated biometric process requiring a specialized scanner to analyze the live eye; a static photograph on a card cannot be used for this purpose.

1. National Institute of Standards and Technology (NIST) Federal Information Processing Standards Publication (FIPS) 201-3, "Personal Identity Verification (PIV) of Federal Employees and Contractors" (January 2022).

Section 4.1.1, "Visual Authentication," states: "The PIV cardholder’s facial image is printed on the front of the PIV card to allow for visual identity verification by a human guard. The guard shall verify that the cardholder’s appearance matches the facial image on the card." This directly confirms the picture is for authentication.

2. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations" (September 2020).

Appendix F, "Glossary," defines Authentication as: "Verifying the identity of a user, process, or device, as a prerequisite to allowing access to resources in an information system." The visual check of a photo against a person is a direct application of this principle.

3. Pfleeger, C. P., Pfleeger, S. L., & Margulies, J. (2015). Security in Computing (5th ed.). Prentice Hall.

Chapter 1, Section 1.4, "Authenticating Users," discusses methods of authentication. It explains that authentication is the act of proving an asserted identity. A photo ID is a classic example where a guard performs authentication by comparing the photo (a stored characteristic) to the person.

The selection of information security controls is a fundamental part of the risk treatment phase. According to the information security risk management process defined in standards like ISO/IEC 27001, risk treatment logically follows risk assessment. An organization must first complete the risk assessment—which involves identifying, analyzing, and evaluating risks—to understand its specific threat landscape and vulnerabilities. Only with this comprehensive understanding can appropriate and cost-effective controls be selected to mitigate the identified risks to an acceptable level. Choosing controls before or during the assessment would be premature and not based on a formal evaluation of risk.

B. The scoping meeting defines the boundaries of the Information Security Management System (ISMS); specific risks have not yet been assessed, making control selection premature.

C. The kick-off meeting is for project initiation; the detailed risk information required for selecting appropriate controls is not yet available.

D. During the risk assessment, the focus is on identifying, analyzing, and evaluating risks, which provides the necessary input for the subsequent control selection phase.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Reference: Clause 6.1.2, "Information security risk assessment," and Clause 6.1.3, "Information security risk treatment." The structure of the standard explicitly places the risk treatment process (which includes selecting controls) after the risk assessment process. The output of 6.1.2 is the input for 6.1.3.

2. University of Cambridge, University Information Services. "Information Security Risk Management Process."

Reference: The process diagram and description show a clear sequence where "Risk Assessment" (Step 2) is completed before "Risk Treatment" (Step 3). The document states, "The purpose of risk treatment is to select and implement appropriate controls to reduce risks identified in the risk assessment." This confirms controls are considered after the assessment.

3. Von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. https://doi.org/10.1016/j.cose.2013.04.004

Reference: Page 100, Section 3. This peer-reviewed article discusses the evolution of information security management based on ISO 27001. It describes the risk management cycle where risk analysis and evaluation (assessment) precede the implementation of countermeasures (controls), reinforcing the correct sequence of activities.