ISO-IEC-27001-LEAD-IMPLEMENTER practice question 9 of 35

Scenario 5: Operaze is a small software development company that develops applications for various companies around the world. Recently, the company…

Full set: 290 questions

Domain Implementing an ISMS based on ISO/IEC 27001

Scenario 5: Operaze is a small software development company that develops applications for various companies around the world. Recently, the company conducted a risk assessment to assess the information security risks that could arise from operating in a digital landscape. Using different testing methods, including penetration Resting and code review, the company identified some issues in its ICT systems, including improper user permissions, misconfigured security settings, and insecure network configurations. To resolve these issues and enhance information security, Operaze decided to implement an information security management system (ISMS) based on ISO/IEC 27001. Considering that Operaze is a small company, the entire IT team was involved in the ISMS implementation project. Initially, the company analyzed the business requirements and the internal and external environment, identified its key processes and activities, and identified and analyzed the interested parties In addition, the top management of Operaze decided to Include most of the company's departments within the ISMS scope. The defined scope included the organizational and physical boundaries. The IT team drafted an information security policy and communicated it to all relevant interested parties In addition, other specific policies were developed to elaborate on security issues and the roles and responsibilities were assigned to all interested parties. Following that, the HR manager claimed that the paperwork created by ISMS does not justify its value and the implementation of the ISMS should be canceled However, the top management determined that this claim was invalid and organized an awareness session to explain the benefits of the ISMS to all interested parties. Operaze decided to migrate Its physical servers to their virtual servers on third-party infrastructure. The new cloud computing solution brought additional changes to the company Operaze's top management, on the other hand, aimed to not only implement an effective ISMS but also ensure the smooth running of the ISMS operations. In this situation, Operaze's top management concluded that the services of external experts were required to implement their information security strategies. The IT team, on the other hand, decided to initiate a change in the ISMS scope and implemented the required modifications to the processes of the company. Based on scenario 5. after migrating to cloud. Operaze's IT team changed the ISMS scope and implemented all the required modifications Is this acceptable?
Answer options
A: Yes, because the ISMS scope should be changed when there are changes to the external environment
B: No, because the company has already defined the ISMS scope
C: No, because any change in ISMS scope should be accepted by the management Correct answer
Correct Answer:
C. No, because any change in ISMS scope should be accepted by the management
Explanation

According to ISO/IEC 27001, top management holds the ultimate responsibility and accountability for the Information Security Management System (ISMS). Clause 4.3 requires the organization to determine the scope, and Clause 5.1 ("Leadership and commitment") mandates that top management demonstrates this commitment, which includes establishing the information security policy and objectives that are aligned with the scope. While the scope is not static and should be reviewed following significant changes (such as migrating to the cloud), any modification to such a fundamental component must be formally reviewed and approved by top management. The IT team's unilateral action to change the scope bypasses this critical governance process, making it unacceptable.

Why Incorrect

A. While external changes can trigger a scope review, the authority to approve the change rests with top management, not the IT team alone.
B. This is incorrect because the ISMS scope is not static. It must be reviewed and can be changed to reflect new contexts, boundaries, or dependencies.

References

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 4.3: "The organization shall determine the boundaries and applicability of the information security management system to establish its scope... The scope shall be maintained as documented information." This establishes the scope as a formal, documented element.

Clause 5.1 (a, b): "Top management shall demonstrate leadership and commitment with respect to the information security management system by: a) ensuring that the information security policy and the information security objectives are established and are compatible with the strategic direction of the organization; b) ensuring the integration of the information security management system requirements into the organization’s processes". This places the authority and responsibility for the ISMS's strategic elements, including its scope, firmly with top management.

2. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page.

Chapter 8, Section: 'Defining the ISMS scope': The text emphasizes that defining the scope is a strategic decision that must be made by top management, as it directly impacts the resources, responsibilities, and business objectives the ISMS will support. Any changes would require the same level of strategic approval.

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Chapter 4, Section 4.3 'Scope': This section details that the scope definition is a critical early step that requires management buy-in and approval. It states, "The scope statement needs to be approved by management... Any changes to the scope will need to be managed through a change control process." This confirms that changes are not to be made unilaterally by operational teams.

Keep practicing

Take the free ISO-IEC-27001-LEAD-IMPLEMENTER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other ISO-IEC-27001-LEAD-IMPLEMENTER practice questions

Scroll to Top