ISO27-13-001 practice question 19 of 35

A planning process that introduced the concept of planning as a cycle that forms the basis for continuous improvement is called:

Full set: 100 questions
Answer options
A:  time based planning.
B: plan, do, check, act. Correct answer
C: planning for continuous improvement.
D: RACI Matrix
Correct Answer:
B. plan, do, check, act.
Explanation

The Plan-Do-Check-Act (PDCA) model, also known as the Deming Cycle, is a foundational, iterative four-stage methodology for continuous improvement. It is explicitly adopted by the ISO/IEC 27001 standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The standard's clauses are structured around this cycle: Plan: Establish the ISMS (Clauses 4-7). Do: Implement and operate the ISMS (Clause 8). Check: Monitor and review the ISMS (Clause 9). Act: Maintain and improve the ISMS (Clause 10). This cyclical nature ensures that the management system evolves and improves over time.

Why Incorrect

A. time based planning: This is a project management technique for scheduling tasks against a timeline, not a cyclical model for process improvement.
C. planning for continuous improvement: This is a descriptive phrase of a goal or activity, not the name of a specific, standardized process model like PDCA.
D. RACI Matrix: This is a tool used to define and clarify roles and responsibilities (Responsible, Accountable, Consulted, Informed), not a planning cycle.

References

1. International Organization for Standardization (ISO). (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Section 0.3.2, "Plan-Do-Check-Act model," states, "This document applies the Plan-Do-Check-Act (PDCA) model, which is applied to all ISMS processes... The PDCA model ensures the continual improvement of the ISMS."

2. Humphreys, E. (2008). Information security management standards: a practitioner's guide. Computer Law & Security Review, 24(1), 36-45. Page 38 discusses the PDCA cycle as the core of ISO 27001, stating, "The standard is based on the well-known Plan-Do-Check-Act (PDCA) model for quality management systems... to achieve continual improvement." DOI: https://doi.org/10.1016/j.clsr.2007.11.004

3. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers. Chapter 8, "The PDCA cycle," details how the entire ISO 27001 standard is built upon the Plan-Do-Check-Act methodology as its framework for continuous improvement.

Scroll to Top