Question 1 of 10 · Fundamental principles and concepts of an information security management system
What is residual risk?
Residual risk is what remains after treatment and must be accepted by risk owners. Inherent risk is before treatment, and transfer or removal are treatments.
Question 2 of 10 · Information security management system requirements
What does the information security policy provide?
Clause 5.2 requires an information security policy that suits the organization's purpose, includes objectives or a framework for setting them, and commits to satisfying applicable requirements and to continual improvement. Detailed procedures sit beneath the policy, audit results feed management review, and the risk register is an output of risk assessment.
Question 3 of 10 · Planning of an ISMS implementation based on ISO/IEC 27001
Why should planning consider legal and contractual requirements?
Legal, regulatory and contractual requirements are interested-party requirements and also an Annex A control area (5.31). They are not optional, deferred or automatic.
Question 4 of 10 · Implementation of an ISMS based on ISO/IEC 27001
What does control 7.4, physical security monitoring, require?
Control 7.4 requires continuous monitoring, such as alarms and video, for unauthorized physical access. The distractors are weak or partial.
Question 5 of 10 · Monitoring and measurement of an ISMS based on ISO/IEC 27001
Why should monitoring results be analyzed, not just collected?
Clause 9.1 requires analysis and evaluation to judge performance and effectiveness. Collection alone does not.
Question 6 of 10 · Continual improvement of an ISMS based on ISO/IEC 27001
What is continual improvement in the ISMS?
Clause 10.1 requires the organization to continually improve the suitability, adequacy and effectiveness of the ISMS. It is not a project that ends at certification, it does not mean adding controls for their own sake, and fixing nonconformities is only one source of improvement.
Question 7 of 10 · Preparation for an ISMS certification audit
What can happen if an organization fails to maintain its ISMS after certification?
Certification bodies can suspend or withdraw certificates for serious or persistent nonconformities or failure to allow surveillance. ISO itself does not fine organizations.
Question 8 of 10 · Fundamental principles and concepts of an information security management system
What does ISO/IEC 27001 specify?
ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an ISMS, including the Annex A control set. Detailed control guidance is in ISO/IEC 27002, the standard is technology neutral, and organizations choose their own risk assessment method as long as it meets clause 6.1.2.
Question 9 of 10 · Information security management system requirements
What is the role of interested parties' requirements in the ISMS?
Clause 4.2 requires the organization to determine relevant interested parties, their requirements and which of those will be addressed through the ISMS, and clause 4.3 uses them to set the scope. They add to the standard's requirements rather than replacing them. Control exclusions are justified through risk treatment, not decided by interested parties.
Question 10 of 10 · Planning of an ISMS implementation based on ISO/IEC 27001
What is the first step in identifying information security risks under an asset-based approach?
Asset-based identification starts with assets and owners, then threats, vulnerabilities and consequences. Insurance, the SoA and audit dates come later.
0 of 10
Fundamental principles and concepts of an information security management system
Information security management system requirements
Planning of an ISMS implementation based on ISO/IEC 27001
Implementation of an ISMS based on ISO/IEC 27001
Monitoring and measurement of an ISMS based on ISO/IEC 27001
Continual improvement of an ISMS based on ISO/IEC 27001
Preparation for an ISMS certification audit
Which domains cost you the points? Members see a breakdown by domain and a study plan built from it.