Implementing the ISMS

In the documented information hierarchy, which sets the minimum acceptable configuration rather than the maximum?

• AA specification
• BA baseline✓
• CA policy
• DA guideline

Answer: Baselines set the minimum. Guidelines are discretionary, specifications state a measurable requirement and policies state intent, so none of those carries the meaning the question is after.

What is the difference between awareness and competence in an ISMS?

• AAwareness is annual and competence is continuous
• BAwareness applies to general staff, while competence applies only to management
• CThey are the same requirement expressed in two clauses
• DAwareness is knowing why it matters; competence is being able to do the work✓

Answer: Clause 7.2 covers competence - the ability to do the job, based on education, training or experience. Clause 7.3 covers awareness - understanding the policy, one’s contribution, and the implications of not conforming.

What does Clause 7.4 require the organisation to determine about internal and external communications?

• AThat a press office approves external statements
• BWhat to communicate, when, with whom and how✓
• CThat all communications are encrypted in transit
• DThat communications are retained for seven years

Answer: Clause 7.4 requires the organisation to determine the need for internal and external communications relevant to the ISMS, including what, when, with whom and how. It does not prescribe technical or retention measures.

An event indicating a possible breach of policy or failure of a control has occurred, but nothing has been compromised. What is it?

• AA vulnerability
• BAn information security incident
• CAn information security event✓
• DA nonconformity

Answer: An event is an occurrence indicating a possible breach or control failure. An incident is one or more events that actually compromise information security; a nonconformity is a failure to meet a requirement.

Which term describes a flaw that someone noticed before anything happened?

• AA weakness✓
• BA nonconformity
• CAn event
• DAn incident

Answer: A weakness is a flaw identified before it has been exploited or caused an event. Distinguishing event, incident and weakness is exactly what the incident-reporting controls hang on.

Which Annex A control covers the reporting of information security events by personnel?

• AA.6.8 Information security event reporting✓
• BA.5.25 Assessment and decision on information security events
• CA.5.26 Response to information security incidents
• DA.5.24 Information security incident management planning and preparation

Answer: A.6.8 sits in the people theme and covers a person reporting what they have observed. A.5.25 is where the organisation then decides whether the event is an incident - a different actor and a different step.

Which control covers the organisation deciding whether a reported event is actually an incident?

• AA.5.27 Learning from information security incidents
• BA.5.28 Collection of evidence
• CA.6.8 Information security event reporting
• DA.5.25 Assessment and decision on information security events✓

Answer: A.5.25 is the assessment and decision step: the organisation classifies the event. Reporting it is A.6.8, and learning from it afterwards is A.5.27.

Why does the control on collection of evidence emphasise procedures for identification and preservation?

• ABecause evidence must be retained for a fixed statutory period
• BBecause evidence may need to be admissible in later proceedings✓
• CBecause the certification body requires original media
• DBecause ISO/IEC 27001 mandates a forensic function

Answer: A.5.28 addresses identifying, collecting, acquiring and preserving evidence, and admissibility is the reason the procedure matters. The standard does not mandate a forensic team or a single retention period.

An organisation rolls out a new control but tells nobody it has changed. Which requirement is most directly at risk?

• AClause 6.1.2, which defines the risk assessment process
• BClause 9.2, the internal audit programme
• CClause 4.3, the scope of the ISMS
• DClause 7.3, awareness of the ISMS and its requirements✓

Answer: Clause 7.3 requires people doing work under the organisation’s control to be aware of the policy, their contribution to the ISMS and the implications of not conforming. A control nobody knows about cannot be followed.

What is the purpose of the control on learning from information security incidents?

• ATo use what happened to strengthen and improve controls✓
• BTo satisfy the evidence requirements of Clause 9.2
• CTo apportion responsibility for the incident
• DTo determine whether to notify the certification body

Answer: A.5.27 exists so that knowledge gained from incidents reduces the likelihood or impact of future ones. Attributing blame is not its purpose, and it is not an audit-evidence mechanism.

Which of these best describes ICT readiness for business continuity as introduced in 2022?

• AA requirement to maintain a hot standby data centre in a separate region
• BPlanning, implementing and testing ICT capability to meet continuity objectives✓
• CA replacement for the organisation’s wider business continuity planning
• DA control that applies only where services are hosted by a cloud provider

Answer: A.5.30 requires ICT readiness to be planned, implemented, maintained and tested against business continuity objectives and ICT continuity requirements. It supports continuity planning rather than replacing it, and mandates no particular architecture.

An organisation documents a procedure but never follows it. At audit, what is this?

• AAcceptable, provided the procedure is under version control
• BA nonconformity, because the requirement is not being met in practice✓
• CAn observation, since the procedure exists
• DAn opportunity for improvement only

Answer: Conformity is judged on what actually happens, not on what is written down. A documented procedure that is not followed is a failure to fulfil a requirement, which is the definition of a nonconformity.

What does the standard require in relation to outsourced processes that affect information security?

• AThey require the supplier to be certified to ISO/IEC 27001
• BThey must be brought in-house before certification
• CThey are excluded automatically from the ISMS
• DThey must be determined and controlled✓

Answer: Clause 8.1 requires the organisation to ensure that externally provided processes, products or services relevant to the ISMS are controlled. Supplier certification can be one way of gaining assurance, but the standard does not require it.

Which of these is the strongest evidence that an awareness programme is effective?

• AA statement in the information security policy that awareness is mandatory
• BA measurable change in behaviour, such as fewer reported policy breaches of a given type✓
• CA copy of the training material held under version control and reviewed
• DA signed attendance sheet showing every member of staff attended the briefing

Answer: Attendance records and materials evidence that training happened, not that it worked. Clause 9.1 pushes towards evaluating performance, and a change in behaviour is the outcome the awareness control is aiming at.