ISO-IEC-27001-LEAD-IMPLEMENTER practice question 26 of 35

Scenario 8: SecureLynx is one Of the largest cybersecurity advisory and consulting companies that helps private sector organizations prevent security…

Full set: 290 questions

Domain Performance evaluation, monitoring, and measurement of an ISMS based on ISO/IEC 27001

Scenario 8: SecureLynx is one Of the largest cybersecurity advisory and consulting companies that helps private sector organizations prevent security threats. improve security systems. and achieve business SecureLynr is committed to complying with national and international standards to enhance the company'S resilience and credibility_ SecureLynx has Started implementing an ISMS based on ISO/IEC 27001 as part of its relentless pursuit of security. As part of the internal audit activities. the top management reviewed and approved the audit objectives to assess the effectiveness of SecureLynx•s ISMS During the audit, the internal auditor evaluated whether top management Supports activities associated with the ISMS and if the toles and responsibilities Of relevant parties are Clearly defined. This rigorous examination is a testament to SecureLynx'S commitment to continuous improvernent and alignment of security measures with organizational goals. SecureLynx employs an innovative dashboard that visually represents implemented processes and controls to ensure transparency and accountability within the Organization. This tool Offers stakeholders a real- time overview of security measures. empowering them to make informed decisions and swiftly respond to emerging threats. As part of this initiative, Paula was appointed to a new position entrusted with the responsibility Of collecting, recordlng, and Stoting data to measure the effectiveness Of the ISMS- Furthermore, SecureLynx conducts management reviews every six months to ensure its Systems are robust and continually improving. These reviews serve as a crucial mechanism for assessing the efficacy Of security measures and identifying areas for enhancement. SecureLynx's dedication to implementing and maintaining a robust ISMS exemplifies its commitment to innovation and Client satisfaction. Based on the scenario above, answer the following question. Based on scenario 8, has SecureLynx appropriately conducted management reviews?
Answer options
A: No, management reviews should only occur when there are significant changes to the company’s ISMS
B: No, ISO/IEC 27001 requires management reviews to be conducted annually
C: Yes, management reviews are intended to be conducted periodically Correct answer
Correct Answer:
C. Yes, management reviews are intended to be conducted periodically
Explanation

ISO/IEC 27001, Clause 9.3.1, mandates that top management must review the Information Security Management System (ISMS) at "planned intervals." The standard deliberately does not prescribe a fixed frequency, such as annually or semi-annually. This flexibility allows an organization to determine a review schedule that is appropriate for its specific context, risk environment, and rate of change. SecureLynx's practice of conducting management reviews every six months perfectly aligns with this requirement, as it constitutes a periodic, planned interval, ensuring the ISMS's ongoing suitability, adequacy, and effectiveness.

Why Incorrect

A. Management reviews are a proactive, scheduled activity to ensure ongoing effectiveness, not solely a reactive measure to significant changes.
B. ISO/IEC 27001 does not mandate an annual frequency; it requires reviews at "planned intervals" determined by the organization itself.

References

1. International Organization for Standardization (ISO). (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 9.3.1 General: States, "Top management shall review the organization’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness." This text confirms that the interval is planned by the organization, not fixed by the standard.

2. PECB Group Inc. (2023). PECB Certified ISO/IEC 27001 Lead Implementer Training Course Material.

Domain 5: Monitoring, measurement, analysis and evaluation of the ISMS, Module: Management Review: The official training material explains that the frequency of management reviews should be defined by the organization based on its needs and the stability of the ISMS. It clarifies that there is no mandatory frequency like "annually" and that semi-annually is a common and acceptable practice.

3. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page.

Chapter 12, Section: '9.3 Management review': This authoritative text, often used in university curricula, notes that "The standard requires management reviews to be conducted at ‘planned intervals’... The frequency of the review is for the organization to decide, but it is typically conducted annually or, in more dynamic organizations, semi-annually." (p. 161). This supports that a six-month interval is appropriate.

Keep practicing

Take the free ISO-IEC-27001-LEAD-IMPLEMENTER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other ISO-IEC-27001-LEAD-IMPLEMENTER practice questions

Scroll to Top