ISO-IEC-27001-FOUNDATION Practice Questions

ISO/IEC 27001 is the standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). A core part of this is the information security risk management process (Clauses 6.1.2 and 8.2).

ISO/IEC 27002 serves as a supplementary code of practice. It provides a reference set of generic information security controls and offers detailed implementation guidance for the controls listed in Annex A of ISO/IEC 27001. Therefore, after an organization uses the ISO/IEC 27001 process to identify necessary controls, it can refer to ISO/IEC 27002 for advice on how to implement them. Statement 1 is true, while statement 2 is false.

B. Only 2 is true: This is incorrect. ISO/IEC 27001 defines the requirements for the risk management process, not ISO/IEC 27002, which is a guidance document for controls.

C. Both 1 and 2 are true: This is incorrect because statement 2 is false. ISO/IEC 27002 does not provide the process for information security risk management.

D. Neither 1 or 2 is true: This is incorrect because statement 1 accurately describes the relationship where ISO/IEC 27002 provides implementation guidance for controls selected via the ISO/IEC 27001 process.

---

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Annex A, Note 1: "The information security controls listed in Annex A are directly derived from and aligned with those listed in ISO/IEC 27002:2022." This confirms the direct link and that 27002 provides the detail for the controls referenced in 27001.

Clause 6.1.2: This clause details the requirements for the "Information security risk assessment" process, establishing that the process requirements are within ISO/IEC 27001 itself.

2. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Introduction, 0.1 General: "This document provides a reference set of generic information security controls including implementation guidance... It is designed to be used by organizations... for selecting, implementing and managing controls..." This explicitly states its purpose is to provide implementation guidance for controls.

3. University of Oslo, Course IN5250 – "Security in operating systems and software" Lecture Notes.

Lecture 1: Introduction to Information Security Management, Slide 18, "ISO 27000 series": The slide deck clarifies the relationship: "ISO 27001 - ISMS Requirements (What to do)" and "ISO 27002 - Code of practice for IS controls (How to do it)". This academic source supports that 27001 defines requirements and 27002 provides implementation guidance.

The sentence is a direct reference to the requirements outlined in Clause 4.2 of the ISO/IEC 27001 standard. This clause, titled "Understanding the needs and expectations of interested parties," mandates that an organization must first identify relevant interested parties and then determine their specific information security requirements. These requirements are then considered when establishing the scope and controls of the Information Security Management System (ISMS).

B. number: The standard requires identifying which parties are relevant, not simply counting them. The focus is on the substance of their needs, not the quantity of stakeholders.

C. structure: The internal organizational structure of interested parties is outside the scope of this requirement. The ISMS is concerned with their needs, not their internal hierarchy.

D. influence: While the influence of an interested party might help determine its relevance, the standard explicitly requires the determination of their requirements, not a formal assessment of their influence.

1. International Organization for Standardization (ISO). (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Section 4.2, "Understanding the needs and expectations of interested parties," states: "The organization shall determine: a) the interested parties that are relevant to the information security management system; and b) the relevant requirements of these interested parties."

2. von Solms, R., & von Solms, B. (2018). "Information Security Governance." In Cybersecurity and Privacy in Cyber Physical Systems. CRC Press. This academic text, when discussing the foundational clauses of ISO 27001, explains that Clause 4.2 is a critical input for the ISMS, requiring the organization to understand stakeholder requirements to define the system's scope and objectives.

3. The University of Alabama in Huntsville. (n.d.). Courseware for IS 660: Information Security Management. In modules covering ISO 27001 implementation, the curriculum details Clause 4.2, emphasizing the process of identifying stakeholders (interested parties) and documenting their specific information security requirements as a foundational step.

An ISO/IEC 27001 practitioner is an individual within an organization who is competent in the standard's requirements. According to Clause 9.2 of ISO/IEC 27001, the organization must conduct internal audits at planned intervals. These first-party audits are a fundamental activity for verifying the effectiveness and conformity of the Information Security Management System (ISMS). A qualified internal practitioner is the appropriate person to perform this function, ensuring they remain objective and impartial by not auditing their own direct responsibilities. The other options describe third-party audits that require specific accreditation and external authority, which are outside the practitioner's scope.

A. Surveillance audits are conducted by external Certification Bodies, not internal staff. Auditing one's own area also violates the core audit principle of impartiality.

C. Audits of Accredited Training Organizations are performed by the body that provides their accreditation (e.g., APMG), not by an unrelated practitioner.

D. Audits of Certification Bodies are conducted by a national Accreditation Body (e.g., UKAS, ANAB) to verify the CB's competence and independence.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 9.2, "Internal audit": This clause mandates that "The organization shall conduct internal audits at planned intervals..." and requires the selection of auditors to "ensure objectivity and the impartiality of the audit process." This directly supports the role of an internal practitioner in conducting internal audits.

2. ISO/IEC 19011:2018 - Guidelines for auditing management systems.

Clause 3.1, Note 3: This clause distinguishes between audit types. Internal audits (first-party audits) are conducted by the organization itself. This is the domain of the practitioner. Surveillance, certification, and accreditation audits are types of external (third-party) audits.

3. Humphreys, E. (2020). ISO/IEC 27001:2022 - A Pocket Guide. IT Governance Publishing.

Chapter 9, "Performance evaluation": This guide, often used in academic and professional training, explains that the internal audit programme (Clause 9.2) is a key internal process managed by the organization to prepare for external certification and ensure ongoing compliance. It is a function performed by competent internal resources.

ISO/IEC 27001:2022, Clause 9.2.2, mandates that an organization's internal audit programme must be planned, established, and maintained. A key input for this planning is "the importance of the processes concerned." This risk-based approach ensures that audit efforts and resources are prioritized and focused on the processes most critical to the organization's information security objectives. Audits for high-importance processes may be more frequent or in-depth compared to those for less critical processes, thereby making the audit programme more effective and efficient.

A. The standard requires auditors to be objective and impartial, but does not mandate the use of third parties for internal audits.

B. This is directly contrary to the standard, which requires that the "results of previous audits" MUST be considered when planning the programme.

D. The standard does not prescribe a fixed audit cycle. Audit frequency must be determined based on process importance and risk, not a generic timeframe.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 9.2.2 states: "The organization shall plan, establish, implement and maintain an audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting, which shall take into consideration the importance of the processes concerned and the results of previous audits."

2. Calder, A., & Watkins, S. (2020). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page.

Chapter 12, Section 'The Audit Programme', explains that the audit programme should be risk-based, meaning that the frequency and intensity of audits should reflect the business importance and risk level of the processes being audited.

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Chapter 15, Section '9.2 Internal Audit', clarifies that the audit programme needs to be dynamic, taking into account process importance and past performance (audit results) to determine what to audit and when.

According to ISO/IEC 27001:2022, when planning and establishing the information security risk assessment process, the organization is explicitly required to define and maintain risk acceptance criteria. These criteria are fundamental to the risk management process as they establish the threshold for which risks are considered acceptable and which ones require treatment. Without these predefined criteria, risk evaluation and treatment decisions would be inconsistent and subjective, undermining the entire purpose of the Information Security Management System (ISMS).

A. The risk assessment must be applied to all information and assets within the defined ISMS scope; excluding parts is contrary to the standard's requirements.

B. The standard requires measuring the effectiveness of the ISMS as a whole (Clause 9.1), not specifically defining how to measure the effectiveness of the risk assessment method itself.

D. This is incorrect. ISO/IEC 27001 Clause 6.1.2 details several specific requirements for defining the risk assessment and treatment process, including risk criteria.

1. ISO/IEC 27001:2022, "Information security, cybersecurity and privacy protection — Information security management systems — Requirements":

Clause 6.1.2 c) 2) states that the information security risk assessment process shall "establish and maintain information security risk acceptance criteria". This is a direct and mandatory requirement.

2. ISO/IEC 27005:2022, "Information security, cybersecurity and privacy protection — Guidance on managing information security risks":

Section 6.3, "Risk criteria", provides detailed guidance on establishing risk criteria, including risk acceptance criteria. It explains that these criteria are "terms of reference against which the significance of risk is evaluated" and are crucial for making risk treatment decisions.

3. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page.

Chapter 11, "Risk Management", explains that a key step in the risk assessment methodology is to "define your risk acceptance criteria," which reflects the organization's risk appetite and is essential before evaluating identified risks. This text is widely used in academic and professional settings for ISO 27001 implementation.

ISO/IEC 27001, Clause 7.2 (Competence), mandates that an organization must determine the necessary competence of personnel performing work that affects its information security performance. The standard requires the organization to ensure these persons are competent based on appropriate education, training, or experience. A key and explicit requirement within this clause is to "retain appropriate documented information as evidence of competence." Therefore, holding up-to-date records on training, skills, experience, and qualifications is a required action to demonstrate and ensure that personnel are competent to perform their assigned ISMS tasks.

A. Identifying products relates to resource management or continual improvement, not the direct assessment or documentation of personnel competence.

B. The standard requires competence appropriate to the role; it does not mandate a specific, universal certification for all personnel.

C. Implementing compliance controls is an operational activity (Clause 8), not the specific action of ensuring and documenting personnel competence (Clause 7.2).

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 7.2 Competence: This clause states the organization shall: "d) retain appropriate documented information as evidence of competence." This directly supports option D as a mandatory action.

2. von Solms, R., & von Solms, B. (2018). "Information Security Governance." In Cybersecurity, pp. 27-50. Springer, Cham.

In discussing the "Support" clauses of ISO 27001, the authors emphasize that for an ISMS to be effective, the organization must not only ensure competence but also maintain records as proof. This aligns with the requirement to hold documented information on qualifications and training. (DOI: https://doi.org/10.1007/978-3-319-95189-82)

3. University of Oslo, Department of Informatics. (n.d.). IN5250 – Security in operating systems and software: Lecture on ISMS.

Course materials covering ISO/IEC 27001 implementation detail the requirements of Clause 7.2. They explain that competence can be achieved through various means (training, experience) and highlight that evidence of this competence must be documented and retained by the organization. This directly validates the action described in option D.

According to ISO/IEC 27001:2022, the information security policy and its topic-specific policies must be reviewed to ensure their ongoing suitability, adequacy, and effectiveness. The standard explicitly mandates this review process to occur "at planned intervals or if significant changes occur." This dual trigger ensures that policies are not only checked periodically as part of a regular cycle (e.g., annually) but are also updated proactively in response to major events, such as changes in business objectives, legal environments, technology, or the threat landscape. This approach maintains the relevance and effectiveness of the organization's information security posture.

A. Every six months: The standard does not prescribe a fixed six-month interval. It allows organizations the flexibility to define their own "planned intervals" based on their specific context and needs.

B. Annually: While an annual review is a common practice and a valid "planned interval," it is not a strict requirement of the standard. Mandating it as the only option is incorrect.

C. According to a schedule defined by the Certification Body: The Certification Body audits for conformity to the standard; it does not define the organization's internal operational schedules. The organization itself is responsible for defining its policy review intervals.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 5.2 Policy, item c): States that the information security policy shall be "reviewed at planned intervals or if significant changes occur, to ensure its continuing suitability, adequacy and effectiveness."

Annex A, Control 5.1 Policies for information security: The control objective states, "The information security policy and topic-specific policies should be reviewed at planned intervals and if significant changes occur, to ensure their continuing suitability, adequacy and effectiveness."

2. University of Cambridge, Information Security Office. (2023). Information Security Policy.

Section: Policy Review: "The Information Security Policy and supporting policies will be reviewed at least annually, or when significant changes occur to the organisational or technical infrastructure." This document exemplifies the implementation of the ISO 27001 requirement, combining a defined "planned interval" (annually) with the trigger for "significant changes." (Available from the University of Cambridge official website).

3. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page.

Chapter 11, Section: '5.2 Policy': This academic and professional reference, widely used in university curricula, explains that a key requirement for the information security policy is that it must be reviewed at planned intervals and also when significant changes occur. This reinforces the dual nature of the review trigger as specified in the standard.

Statement 2 is correct. An internal audit is conducted by the organization itself to review its own Information Security Management System (ISMS) for conformity and is therefore classified as a first-party (1st party) audit. A certification audit is conducted by an independent, accredited certification body to assess conformity with the ISO/IEC 27001 standard, making it a third-party (3rd party) audit.

Statement 1 is incorrect because the certification process involves a three-year cycle. It begins with an initial certification audit, followed by annual surveillance audits, and concludes with a re-certification audit before the certificate expires. Describing the "certification audit" as an annual event is an inaccurate simplification of this cycle.

A. Only 1 is true: This is incorrect. Statement 1 is factually inaccurate regarding the frequency and terminology of certification audits, which operate on a three-year cycle, not a single annual event.

C. Both 1 and 2 are true: This is incorrect because Statement 1 is inaccurate. While Statement 2 is true, the combination is false.

D. Neither 1 or 2 is true: This is incorrect because Statement 2 provides a standard, correct definition of internal (1st party) and certification (3rd party) audits.

1. ISO/IEC 19011:2018, Guidelines for auditing management systems.

Section 3.1, Note 3 to entry: This standard explicitly defines the types of audits. It states, "Internal audits, sometimes called first-party audits, are conducted by, or on behalf of, the organization itself... Third-party audits are conducted by independent auditing organizations, such as those providing certification/registration of conformity to the requirements of ISO 9001 or ISO 14001." (This principle applies directly to ISO 27001 certification audits).

2. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 9.2.1 General: This clause mandates that "The organization shall conduct internal audits at planned intervals..." This supports the first part of Statement 1 but does not specify the frequency of external audits.

3. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers.

Chapter 14, "Certification and continual improvement," p. 188: This chapter details the certification process, explaining, "Certification is for a fixed period, usually three years, at the end of which you will need to apply for recertification... In the intervening years, your certification body will carry out periodic surveillance audits to ensure that you are continuing to maintain the ISMS." This confirms that the certification audit is not a single annual event.

According to ISO/IEC 27001:2022, Clause 10.2, when a nonconformity occurs, the organization must implement corrective actions as needed. The standard explicitly states, "Corrective actions shall be appropriate to the effects of the nonconformities encountered." This requirement ensures that the resources and effort invested in fixing a problem are proportional to the actual or potential impact of that problem on the organization's information security objectives. The response must be suitable for the severity and consequences of the identified issue.

A. The standard requires actions to be appropriate to the effects of the nonconformity, not proportionate to the likelihood of its recurrence.

C. Corrective actions may require changes to the ISMS, including policies, as stated in Clause 10.2 e) of the standard.

D. The standard requires an evaluation of the need to eliminate the cause, which does not mean the cause is always eliminated.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, Section 10.2 Continual improvement. The standard states: "When a nonconformity occurs, the organization shall: ... c) implement any action needed; ... Corrective actions shall be appropriate to the effects of the nonconformities encountered."

2. Calder, A., & Watkins, S. (2020). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page. In its analysis of Clause 10.1 (from the 2013 version, conceptually identical to 10.2 in the 2022 version), the guide emphasizes that the scale of the corrective action must match the scale of the problem it is intended to solve (Chapter 15, pp. 169-170).

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House. In the discussion on Clause 10.1, the author notes, "The final requirement... is that the corrective actions taken must be appropriate to the impacts of the nonconformities encountered. This is a test of proportionality." (Chapter 12, Section 10.1 Nonconformity and Corrective Action).

ISO/IEC 27001 explicitly requires organizations to retain documented information as evidence of the results of management reviews (Clause 9.3.3). A key output of these reviews includes decisions and actions related to continual improvement opportunities. Furthermore, Clause 10.2 (Continual improvement) mandates retaining documented information on the nature of nonconformities and the results of any corrective actions taken. Management decisions are integral to both processes. Therefore, records of these decisions are a required part of the ISMS documentation, serving as evidence that the continual improvement cycle is being managed and controlled.

B. The standard requires security awareness (Clause 7.3), but does not mandate that specific third-party awareness materials must be retained as documented information.

C. While the organization must provide resources (Clause 7.1), the standard does not explicitly require the budget itself to be maintained as mandatory documented information.

D. A statement of correspondence with other standards is not a requirement of ISO/IEC 27001. It may be useful for integrated systems but is not mandatory.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 9.3.3, Management review results: "The organization shall retain documented information as evidence of the results of management reviews." The outputs specified in this clause include "decisions and actions related to continual improvement opportunities".

Clause 10.2, Continual improvement: "When a nonconformity occurs, the organization shall... retain documented information as evidence of: a) the nature of the nonconformities and any subsequent actions taken; b) the results of any corrective action."

2. von Solms, R., & von Solms, B. (2018). "Information Security Governance." In Cybersecurity and Privacy in Cyber Physical Systems (pp. 25-42). Springer, Cham.

In discussing the implementation of ISO 27001, the authors highlight that evidence of management review and corrective actions are critical documented components for demonstrating governance and continual improvement, aligning with clauses 9.3 and 10.2. This underscores that records of decisions are not optional but a required artifact. (DOI: https://doi.org/10.1007/978-3-319-68320-92)