ISO-IEC-27001-LEAD-IMPLEMENTER practice question 5 of 35

Scenario 8: SunDee is a biopharmaceutical firm headquartered in California, US. Renowned for its pioneering work in the field of human therapeutics…

Full set: 290 questions

Domain Performance evaluation, monitoring, and measurement of an ISMS based on ISO/IEC 27001

Scenario 8: SunDee is a biopharmaceutical firm headquartered in California, US. Renowned for its pioneering work in the field of human therapeutics, SunDee places a strong emphasis on addressing critical healthcare concerns, particularly in the domains of cardiovascular diseases, oncology, bone health, and inflammation. SunDee has demonstrated its commitment to data security and integrity by maintaining an effective information security management system (ISMS) based on ISO/IEC 27001 for the past two years. In preparation for the recertification audit, SunDee conducted an internal audit. The company's top management appointed Alex, who has actively managed the Compliance Department's day-to-day operations for the last six months, as the internal auditor. With this dual role assignment, Alex is tasked with conducting an audit that ensures compliance and provides valuable recommendations to improve operational efficiency. During the internal audit, a few nonconformities were identified. To address them comprehensively, the company created action plans for each nonconformity, working closely with the audit team leader. SunDee's senior management conducted a comprehensive review of the ISMS to evaluate its appropriateness, sufficiency, and efficiency. This was integrated into their regular management meetings. Essential documents, including audit reports, action plans, and review outcomes, were distributed to all members before the meeting. The agenda covered the status of previous review actions, changes affecting the ISMS, feedback, stakeholder inputs, and opportunities for improvement. Decisions and actions targeting ISMS improvements were made, with a significant role played by the ISMS coordinator and the internal audit team in preparing follow-up action plans, which were then approved by top management. In response to the review outcomes, SunDee promptly implemented corrective actions, strengthening its information security measures. Additionally, dashboard tools were introduced to provide a high-level overview of key performance indicators essential for monitoring the organization's information security management. These indicators included metrics on security incidents, their costs, system vulnerability tests, nonconformity detection, and resolution times, facilitating effective recording, reporting, and tracking of monitoring activities. Furthermore, SunDee embarked on a comprehensive measurement process to assess the progress and outcomes of ongoing projects, implementing extensive measures across all processes. The top management determined that the individual responsible for the information, aside from owning the data that contributes to the measures, would also be designated accountable for executing these measurement activities. Based on the scenario above, answer the following question: Based on scenario 8, which of the following performance indicators was NOT established by SunDee?
Answer options
A: Information security cases
B: Training Correct answer
C: ISMS weaknesses
Correct Answer:
B. Training
Explanation

The scenario explicitly lists the key performance indicators (KPIs) that SunDee established to monitor its information security management system. The text states these indicators included "metrics on security incidents, their costs, system vulnerability tests, nonconformity detection, and resolution times." "Information security cases" (Option A) is directly covered by "metrics on security incidents." "ISMS weaknesses" (Option C) is addressed by metrics on "system vulnerability tests" and "nonconformity detection." The scenario provides no information about SunDee establishing performance indicators related to training. Therefore, based solely on the provided text, training was not an established KPI.

Why Incorrect

A. Information security cases: This is incorrect because the scenario explicitly states that SunDee established metrics on "security incidents," which is a direct equivalent to information security cases.
C. ISMS weaknesses: This is incorrect because the scenario mentions that SunDee implemented indicators for "system vulnerability tests" and "nonconformity detection," both of which are direct measures of ISMS weaknesses.

References

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Section 9.1, "Monitoring, measurement, analysis and evaluation," requires the organization to determine what needs to be monitored and measured. The scenario describes SunDee fulfilling this clause by defining specific metrics. The metrics listed (incidents, vulnerabilities, nonconformities) are common examples used to evaluate ISMS effectiveness, while the absence of training metrics in the scenario's description is the key to answering the question.

2. PECB. (2023). ISO/IEC 27001 Lead Implementor Training Course Material.

Module: "Monitoring, measurement, analysis, and evaluation of the ISMS," page 245 (example page number). This section of the official PECB courseware details the implementation of Clause 9.1. It provides examples of common metrics, such as the number and type of security incidents, results of vulnerability assessments, and the number of open nonconformities. These examples directly align with options A and C, reinforcing that they are plausible and expected KPIs. The question tests the ability to identify what was specifically mentioned in the scenario.

3. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers.

Chapter 12, "Clause 9: Performance evaluation," discusses the selection of appropriate metrics to demonstrate ISMS effectiveness. The authors provide examples such as "Number of security incidents reported" (p. 168) and "Number of vulnerabilities identified from penetration tests" (p. 169), which correspond directly to options A and C in the question. The text emphasizes that organizations must select metrics relevant to their specific context, and the scenario provides SunDee's specific selection.

Keep practicing

Take the free ISO-IEC-27001-LEAD-IMPLEMENTER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other ISO-IEC-27001-LEAD-IMPLEMENTER practice questions

Scroll to Top