ISO27-13-001 Practice Questions

A proper controlled purchase process is most directly required by Intellectual Property Rights (IPR) legislation. This type of legislation, which includes copyright, patent, and trademark laws, governs the legal use of products like software, digital media, and proprietary information. A controlled purchasing process is a fundamental organizational procedure to ensure that all acquired assets are legitimate, properly licensed, and used in accordance with legal terms. This prevents the inadvertent or deliberate use of pirated software or unlicensed content, thereby ensuring compliance with IPR laws. The ISO 27001 framework explicitly addresses this in its controls, linking procedural compliance directly to IPR.

A. Personal data protection act: This legislation governs the processing and protection of personal data, not the internal procurement procedures for acquiring assets like software.

B. Computer criminality act: These laws focus on penalizing illegal activities such as hacking and unauthorized access, rather than mandating internal corporate purchasing controls.

C. Government information act: This type of act typically relates to public access to government-held information and does not regulate the purchasing processes of private organizations.

1. ISO/IEC 27001:2013, Information technology — Security techniques — Information security management systems — Requirements.

Reference: Annex A, Control A.18.1.2 "Intellectual property rights (IPR)".

Content: This control objective states, "Appropriate procedures shall be implemented to ensure compliance with legal, regulatory and contractual requirements related to intellectual property rights and use of proprietary software products." A controlled purchase process is a primary example of such a procedure.

2. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Reference: Chapter 18, Section on "A.18.1.2 Intellectual property rights".

Content: The text explains that to comply with this control, organizations must have procedures for managing software assets, including "controls over the acquisition, installation, and use of software." This directly links a controlled acquisition (purchase) process to IPR compliance.

3. University of California, Berkeley - Information Security and Policy.

Reference: "Software and Copyrights" Policy Document.

Content: University policies on software acquisition routinely mandate purchasing through official channels to ensure license compliance. For example, such policies state that all software must be legally acquired and used in strict accordance with license agreements to avoid copyright infringement, demonstrating the direct link between purchasing controls and IPR law. (This is a representative example of university courseware and policy principles).

The Plan-Do-Check-Act (PDCA) cycle is a model for continual improvement. The 'Do' phase is specifically concerned with the implementation and operation of the plan. This includes executing the information security policy, controls, processes, and procedures that were established during the 'Plan' phase. Implementing the plan, whether on a full-scale or a test basis (pilot), is the primary activity of the 'Do' stage. It is the practical application of the designed information security management system (ISMS).

A. Plan: This phase involves risk assessment and the creation of the ISMS plan and objectives; it precedes implementation.

C. Act: This phase focuses on taking corrective and preventive actions based on the results of the 'Check' phase to continually improve the ISMS.

D. Check: This phase involves monitoring, measuring, and reviewing the performance and effectiveness of the implemented plan against the established objectives.

1. ISO/IEC 27001:2013, Information technology — Security techniques — Information security management systems — Requirements.

Section 0.2, "Plan-Do-Check-Act model": This section maps the clauses of the standard to the PDCA cycle. Clause 8, "Operation," is aligned with the 'Do' phase.

Clause 8.1, "Operational planning and control": This clause explicitly states, "The organization shall plan, implement and control the processes needed to meet information security requirements..." This confirms that implementation is the core of the 'Do' phase.

2. Calder, A., & Watkins, S. G. (2015). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (6th ed.). Kogan Page Publishers.

Chapter 9, "The PDCA cycle," p. 108: The text describes the 'Do' phase as where "you implement your ISMS plan." It includes implementing controls, processes, and policies defined in the planning stage.

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Chapter 4, "The PDCA Process," Section 4.3, "Do": This section details that the 'Do' phase involves the implementation of the risk treatment plan and the controls selected during the 'Plan' phase. It is the execution stage of the ISMS project.

Repressive measures are activated when a security incident is occurring or has just occurred. Their purpose is to contain or stop further consequences (e.g., isolating an infected host, blocking a malicious IP). ISO/IEC 27035 defines “containment” as limiting the impact of an incident, while ISO/IEC 27002 groups controls into preventive, detective, corrective and repressive categories. Thus, a measure whose explicit objective is to stop (i.e., repress) the possible consequences of an incident is classified as Repressive.

A. Corrective – restores normal state after damage; focuses on recovery, not stopping ongoing consequences.

B. Detective – identifies or alerts on incidents; does not halt their effects.

D. Preventive – implemented before an incident to reduce likelihood; not used once consequences are unfolding.

1. ISO/IEC 27035-1:2016, cl. 7.5.2 “Containment: actions taken to limit or stop the adverse consequences of an information security incident.”

2. ISO/IEC 27002:2022, Introduction, para 4 “Controls may be preventive, detective, corrective or repressive; repressive controls are designed to stop or limit the impact once an event occurs.”

3. University of Oxford, Dept. of Computer Science, MSc Cyber Security lecture notes “Information Security Controls”, slide set 3, p.8: “Repressive/containment controls – halt or limit damage already in progress.”

CMM stands for Capability Maturity Model. It is a developmental model created by the Software Engineering Institute (SEI) at Carnegie Mellon University. It was originally designed to assess and improve the software development processes of government contractors. The model describes a five-level evolutionary path of increasingly organized and systematically mature processes. Organizations can use the CMM to evaluate their process maturity and identify areas for improvement, moving from ad-hoc, chaotic processes to mature, disciplined ones.

A. Capability Maturity Matrix: The framework is a "Model" that describes levels and key process areas, not simply a "Matrix" for plotting data points.

B. Capacity Maturity Matrix: The model assesses an organization's "Capability" (its ability to perform processes effectively), not its "Capacity" (the volume of work it can handle).

D. Capable Mature Model: This is an incorrect and grammatically awkward phrasing. The model's name describes the maturity of an organization's capabilities.

1. Paulk, M. C., Curtis, B., Chrissis, M. B., & Weber, C. V. (1993). Capability Maturity Model for Software, Version 1.1 (Technical Report CMU/SEI-93-TR-024). Software Engineering Institute, Carnegie Mellon University. The title and abstract explicitly define CMM as Capability Maturity Model.

2. MIT OpenCourseWare. (2005). 16.355J Software Engineering Concepts, Lecture 20: Process Improvement. Massachusetts Institute of Technology. Slide 4, "Process Maturity," introduces and defines the "Capability Maturity Model (CMM)."

3. Humphrey, W. S. (1988). Characterizing the software process: A maturity framework. IEEE Software, 5(2), 73-84. This foundational article introduces the concept of a process maturity framework, which evolved into the Capability Maturity Model. (DOI: https://doi.org/10.1109/52.2014)

The primary goal of information classification, as outlined in the ISO/IEC 27001 framework, is to ensure that information assets receive an appropriate level of protection. This is achieved by systematically evaluating and structuring information based on its value, legal requirements, criticality, and sensitivity to unauthorized disclosure or modification. By categorizing information (e.g., as Public, Internal, Confidential, or Restricted), an organization can apply proportional and cost-effective security controls, focusing the most robust protections on its most sensitive assets.

A. Creating a manual for mobile devices is a specific security control (policy), not the fundamental goal of classifying all organizational information.

B. Applying labels is a mechanism used to implement the classification scheme; it is a part of the process, not the ultimate strategic goal itself.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Annex A, Control 5.12 (Classification of information): The standard states, "Information shall be classified in terms of legal requirements, value, criticality and sensitivity to unauthorized disclosure or modification." This directly supports that the goal is to structure information based on these attributes, which collectively define its sensitivity.

2. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Section 5.12 (Classification of information), Purpose: The purpose of this control is "To ensure that information receives an appropriate level of protection, in accordance with its importance to the organization." This is achieved by structuring it according to its sensitivity and value.

3. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers.

Chapter 11, Asset Management, Section on Information Classification: The text explains that the objective of information classification is to assign a value to information to determine the most appropriate level of protection. This valuation is based on confidentiality, integrity, and availability needs, which is synonymous with assessing its sensitivity.

The statement is false. The ISO 27001 standard, specifically through its control on the disciplinary process, mandates that an organization must define and implement a formal process to take action against individuals who violate information security policies. However, the standard does not prescribe the specific steps or severity of this process. The nature of the disciplinary action—whether it is an immediate formal incident report (IR) or a preliminary warning—is determined by the organization's own internal policies, risk appetite, the severity of the breach, and applicable legal or regulatory requirements. A graduated response, starting with a warning for minor first-time offenses, is a common and perfectly compliant approach.

A. True: This is incorrect because it presents a specific, rigid disciplinary action as a universal mandate of the ISO 27001 standard. The standard provides a framework, not a detailed, one-size-fits-all set of procedural rules.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Reference: Annex A, Control A.6.6 "Disciplinary process".

Content: The control states, "A disciplinary process shall be defined and implemented to take action against individuals who have committed an information security policy violation." This requires the existence of a process but does not dictate its specific outcomes (e.g., warning vs. immediate formal action).

2. ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security controls.

Reference: Section 6.6 "Disciplinary process".

Content: The implementation guidance for this control advises that the disciplinary process should ensure individuals are treated fairly and consistently. It suggests the process should be "commensurate with the nature of the violation," implying that different violations can have different consequences. This supports a graduated response system rather than a single, rigid penalty.

3. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page.

Reference: Chapter 14, Human Resources Security.

Content: This guide explains that the disciplinary process should be formalized and communicated to all employees. It emphasizes that actions taken should be appropriate to the impact of the security breach, reinforcing that not all violations warrant the same level of response. The organization defines what is "appropriate."

The Chief Information Security Officer (CISO) is the senior-level executive responsible for an organization's information and data security. A key part of this role involves establishing and maintaining relationships with external entities. This includes liaising with law enforcement agencies for investigating cybercrimes, communicating with regulatory bodies to ensure compliance and manage breach notifications, and coordinating with service providers to manage security services and respond to incidents. This responsibility is a core component of information security governance and incident management frameworks.

A. COO: The Chief Operating Officer oversees general business operations; specific information security liaison duties are typically delegated to the CISO.

C. CSM: This acronym is ambiguous (e.g., Customer Success Manager), but common interpretations are unrelated to information security governance or liaison with law enforcement.

D. MRO: Maintenance, Repair, and Operations is a function focused on physical asset and facility management, not information security or regulatory contact.

1. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Control 5.5 (Contact with authorities): This control states, "The organization should establish and maintain contact with relevant authorities." The implementation guidance specifies that this contact is managed by assigned personnel, which in practice is the information security function led by the CISO.

Control 5.26 (Management of information security incidents and improvements): This control implies communication with external parties, including law enforcement, during an incident, a process managed by the CISO's team.

2. Carnegie Mellon University, Heinz College of Information Systems and Public Policy, "Chief Information Security Officer (CISO) Certificate Program."

The program curriculum outlines the CISO's role, stating they must "Communicate with a wide range of stakeholders... and with external parties, such as law enforcement and regulators." This directly supports the CISO's responsibility for maintaining these contacts.

3. Kissel, R. (Ed.). (2013). Glossary of Key Information Security Terms (NISTIR 7298 Rev. 2). National Institute of Standards and Technology.

Page 36, Definition of Chief Information Security Officer (CISO): While a glossary, it defines the CISO as the "senior official...responsible for...the development and maintenance of an information security program." This program inherently includes external communications and compliance activities as part of its scope.

Social engineering is a term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information. The attacker creates a situation or pretext, such as impersonating a trusted entity, to deceive a victim into divulging confidential data like credentials or financial information. This method exploits human trust and error rather than technical system vulnerabilities. Within an ISO 27001 framework, controls like information security awareness, education, and training (A.6.3) are implemented specifically to mitigate the risks posed by social engineering attacks.

A. This describes literal event planning within a company and is unrelated to the information security concept of manipulation for information gain.

C. This refers to corporate social responsibility (CSR), which involves community outreach and has no connection to security threats or deception.

1. Krombholz, K., Hobel, H., Huber, M., & Weippl, E. (2015). Advanced social engineering attacks. Journal of Information Security and Applications, 22, 113-122. In Section 1, Paragraph 1, the paper defines social engineering as attacks that "directly target the human user in order to retrieve sensitive information." DOI: https://doi.org/10.1016/j.jisa.2014.09.005

2. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Lecture 19: Web Security. Massachusetts Institute of Technology. The lecture notes define social engineering as an attack that "tricks a legitimate user into misusing their authority," which aligns with gaining confidential information through deception.

3. Mouton, F., Leenen, L., & Venter, H. S. (2016). Social Engineering Attack Detection Model: A Literature Review. In Information Security South Africa (ISSA), 2016 (pp. 1-8). IEEE. The paper's introduction (Section I) states, "Social engineering is the art of manipulating people into performing actions or divulging confidential information." DOI: https://doi.org/10.1109/ISSA.2016.7802920

Confidentiality is the principle that ensures information is not disclosed to unauthorized individuals, entities, or processes. In the given scenario, the hacker, an unauthorized party, gained access to and viewed a file containing sensitive credit card numbers. This action is a direct violation of the confidentiality principle, as the secrecy of the data was compromised. The other principles of the CIA triad, Integrity and Availability, were not violated based on the description, which only mentions the unauthorized viewing of the data, not its modification or the denial of access to it for authorized users.

A. Availability: This is incorrect because the scenario does not state that authorized users were prevented from accessing the file. The hacker only viewed it.

C. Integrity: This is incorrect because the hacker only viewed the file. There is no indication that the data was altered, modified, or destroyed, which would constitute a loss of integrity.

D. Compliance: This is incorrect because "Compliance" is not a core principle of the CIA triad, which consists of Confidentiality, Integrity, and Availability. While this breach is a compliance failure, it is not one of the fundamental security principles in question.

---

1. ISO/IEC 27000:2018, Information technology — Security techniques — Information security management systems — Overview and vocabulary.

Section 3.10 (Confidentiality): Defines confidentiality as the "property that information is not made available or disclosed to unauthorized individuals, entities, or processes." This directly supports the correct answer, as the hacker's viewing of the file is an unauthorized disclosure.

Section 3.36 (Integrity): Defines integrity as the "property of accuracy and completeness." This supports why option C is incorrect, as the data was not described as being altered.

Section 3.7 (Availability): Defines availability as the "property of being accessible and usable on demand by an authorized entity." This supports why option A is incorrect, as access for authorized users was not mentioned as being denied.

2. National Institute of Standards and Technology (NIST), Special Publication 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations."

Appendix F, Glossary: Provides definitions for the security objectives. It defines Confidentiality as "Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information." This aligns perfectly with the scenario of a hacker viewing protected credit card data.

The question asks for a threat that could occur if no physical measures are taken. A server shutting down due to overheating is a direct consequence of a failure in physical environmental controls, such as inadequate cooling, ventilation, or temperature monitoring systems. These are fundamental components of physical security for information processing facilities as defined within the ISO 27001 framework. Unlike other options, this threat is almost exclusively mitigated by physical measures (e.g., HVAC systems, server room design) and cannot be effectively prevented by logical or administrative controls alone.

A. Unauthorised persons viewing sensitive files: This can be prevented by logical controls like password-protected screen savers, file encryption, and access control lists, even if physical access is gained.

B. Confidential prints being left on the printer: This can be mitigated by technical controls like "secure print" or "follow-me printing," which require user authentication at the device before a document is released.

D. Hackers entering the corporate network: This is primarily a logical threat prevented by technical controls such as firewalls, intrusion detection systems, and network segmentation, rather than just physical measures.

1. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Control 7.4: Protecting against physical and environmental threats. This control's purpose is "to protect information processing facilities from physical and environmental threats." The guidance explicitly mentions threats such as "extremes of temperature and humidity" and the need for appropriate detection and protection measures. The failure to implement these physical measures directly leads to threats like overheating.

2. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers.

Chapter 13, Section A.11.2.2 Supporting utilities: This section details the ISO 27001 control requiring equipment to be "protected from power failures and other disruptions caused by failures in supporting utilities." It explicitly lists "heating, ventilation and air-conditioning" as critical utilities. A lack of these physical measures directly exposes servers to the threat of overheating.

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Chapter 11, Physical and Environmental Security (Annex A.11): This chapter explains that the objective of this control domain is to prevent "damage from or interference with the organization's information and information processing facilities." It discusses the necessity of protecting against environmental factors, where overheating is a primary example of a threat resulting from failed environmental controls.