ISMS and ISO/IEC 27001 Requirements

The requirements of ISO/IEC 27001:2022 clauses 4 to 10 and Annex A: context, interested parties and scope, leadership and policy, risk assessment and treatment, the Statement of Applicability, support, operation, performance evaluation and improvement.

5 minutes 5 Questions

An Information Security Management System (ISMS) is a systematic, risk-based framework of policies, processes, people and technology that an organization uses to protect the confidentiality, integrity and availability of its information. It is part of the overall management system. ISO/IEC 27001 is…

Concepts covered
Documented Information RequirementsStructure of ISO/IEC 27001:2022Nonconformity, Corrective Action and Continual ImprovementInformation Security Objectives and Planning of ChangesInterested Parties and Their RequirementsCompetence, Awareness and CommunicationISMS Roles, Responsibilities and AuthoritiesDetermining the ISMS ScopeStatement of ApplicabilityInformation Security Risk Assessment ProcessMonitoring, Measurement, Internal Audit and Management ReviewAnnex A Controls and Their ThemesManagement System Concepts and PrinciplesLeadership, Commitment and the Information Security PolicyContext of the Organization: Internal and External IssuesIntegrated Management SystemsInformation Security Risk Treatment and Risk OwnersOperational Planning and Control
Test mode:
Start practice test

ISO 27001 LA - ISMS and ISO/IEC 27001 Requirements Example Questions

Test your knowledge of ISMS and ISO/IEC 27001 Requirements

Question 1

While preparing its Statement of Applicability, an online retailer decides to verify the backgrounds of all job candidates before they are hired. The depth of each check depends on how much sensitive customer data the role can reach. The ISMS manager must record which ISO/IEC 27001:2022 Annex A theme this control belongs to. Which theme applies, and why?

Correct Answer: People, because the control concerns measures applied to individual personnel

Screening is control A.6.1 in ISO/IEC 27001:2022 Annex A. It belongs to the People theme because it applies directly to individuals, with checks proportionate to business requirements, information classification and perceived risks.
The Organizational theme is tempting because HR policies exist, but a control's theme reflects what it acts upon, not who writes the governing policy. Organizational controls cover broader governance such as policies, roles and supplier management.
The Physical theme covers premises, equipment and secure areas, not candidate vetting, even when screening happens before site access is granted.
Key concept: classifying Annex A controls into the four themes (Organizational, People, Physical, Technological) by the control's subject.

Question 2

During a stage 1 audit of a cloud hosting company, the auditor reviews the Statement of Applicability. Annex A control 8.24 Use of cryptography is marked as applicable, with a justification linked to a risk of customer data disclosure. Its status is shown as not yet implemented, and the work is scheduled in the approved risk treatment plan. The ISMS manager asks whether this entry will be reported as a nonconformity. Which conclusion should the auditor reach?

Correct Answer: No nonconformity, because the Statement of Applicability is expected to show each included control and whether it is implemented yet

Clause 6.1.3 d) of ISO/IEC 27001:2022 requires the Statement of Applicability to list the necessary controls, give the justification for including them, and state whether they are implemented or not. An applicable control that is not yet implemented but is planned in an approved risk treatment plan is therefore a valid entry and not a nonconformity.
The minor nonconformity option is wrong because the standard has no rule that every applicable control must be fully operating before stage 2 begins. The major nonconformity option is wrong because a needed control cannot be marked non-applicable just because it is still being implemented. Doing so would falsify the risk-based justification.
Key concept: SoA content requirements and implementation status.

Question 3

During a stage 2 audit of a software company, the auditor confirms that top management approved a responsibility matrix. The matrix assigns incident escalation authority to system administrators and makes the ISMS manager responsible for reporting ISMS performance. The matrix is stored only in the ISMS manager's private folder. Separate interviews with several administrators at two sites show that none know they hold escalation authority, and their job descriptions do not mention it. Which conclusion is best supported by this evidence?

Correct Answer: Roles were assigned, but the evidence shows they were inadequately communicated across the organization

Clause 5.3 requires top management to ensure that responsibilities and authorities are both assigned and communicated. Here the approved matrix proves assignment, but storing it in a private folder, administrators' unawareness at both sites, and silent job descriptions together show it was never communicated.
The competence option fails because nothing shows the administrators lack the skills to escalate incidents. They simply do not know they hold the authority, so training records would not address the gap.
The delegation option fails because assigning operational roles while keeping approval and oversight is legitimate, and top management approved the matrix itself.
Key concept: Clause 5.3 requires roles to be assigned and also communicated within the organization.

More ISMS and ISO/IEC 27001 Requirements questions
248 questions (total)
Practice 100 questions
One session at a time, always new questions