ISMS Requirements: Clauses 4 to 10

Which clauses of ISO/IEC 27001 contain the auditable requirements?

• AClauses 4 to 10✓
• BClauses 1 to 3
• CClauses 5 to 8
• DAnnex A only

Answer: Every "shall" in the standard sits in Clauses 4 to 10. Clauses 1 to 3 cover scope, normative references and terms, and contain no requirements to audit against.

Which clause requires the organisation to determine external and internal issues relevant to its purpose?

• AClause 6
• BClause 5
• CClause 8
• DClause 4✓

Answer: Clause 4 covers context of the organisation: external and internal issues, interested parties and their requirements, the scope, and the ISMS itself. It is the clause everything downstream depends on.

Amendment 1:2024 to ISO/IEC 27001 introduced climate change considerations. Which clauses did it change?

• AClauses 6.1 and 6.2
• BAnnex A.5 and A.8
• CClauses 4.1 and 4.2✓
• DClauses 9.1 and 9.3

Answer: Amendment 1:2024 added a requirement to determine whether climate change is a relevant issue under 4.1, and a note that interested parties can have climate-related requirements under 4.2. It changes two clauses and is in force.

Which clause makes top management accountable for the information security policy?

• AClause 4
• BClause 9
• CClause 7
• DClause 5✓

Answer: Clause 5 covers leadership: commitment, the policy itself, and organisational roles, responsibilities and authorities. Accountability that cannot be delegated sits here.

Where are the requirements for information security objectives set out?

• AClause 6✓
• BClause 8
• CClause 10
• DClause 5

Answer: Clause 6 covers planning: actions to address risks and opportunities, the risk assessment and treatment requirements, and the information security objectives and planning to achieve them.

Which clause covers competence, awareness, communication and documented information?

• AClause 8
• BClause 6
• CClause 5
• DClause 7✓

Answer: Clause 7 covers support: resources, competence, awareness, communication and documented information. It is the clause that supplies what the ISMS needs in order to run.

Which clause requires the organisation to plan, implement and control the processes needed to meet its information security requirements?

• AClause 7
• BClause 9
• CClause 8✓
• DClause 6

Answer: Clause 8 covers operation, including operational planning and control, and the performance of the risk assessment and risk treatment at planned intervals or when significant change occurs.

Which clause contains monitoring, measurement, internal audit and management review?

• AClause 9✓
• BClause 10
• CClause 7
• DClause 8

Answer: Clause 9 is performance evaluation: 9.1 monitoring, measurement, analysis and evaluation; 9.2 internal audit; 9.3 management review.

In ISO/IEC 27001:2022, what does Clause 10.1 cover?

• AContinual improvement✓
• BInternal audit
• CManagement review
• DNonconformity and corrective action

Answer: The 2022 edition orders Clause 10 as 10.1 continual improvement and 10.2 nonconformity and corrective action. That is the reverse of the 2013 edition, which is a common trap for anyone revising from older material.

An auditor asks to see how the organisation determined which interested parties are relevant. Which clause is being audited?

• AClause 4.2✓
• BClause 9.2
• CClause 6.1.2
• DClause 5.1

Answer: Clause 4.2 requires the organisation to determine interested parties relevant to the ISMS and their relevant requirements. Amendment 1:2024 added a note that those requirements can include climate-related ones.

Which of the following is a requirement of Clause 7.5 on documented information?

• AIt must be available and suitable for use where and when it is needed✓
• BIt must be held in a single central repository under one document owner
• CIt must be reviewed and reissued annually, without exception for any document
• DIt must be approved by an external certification body before it takes effect

Answer: Clause 7.5 requires documented information to be available and suitable for use where and when needed, and adequately protected. It does not mandate a single repository, a fixed review cycle, or external approval.

What does ISO/IEC 27001 require regarding the information security policy?

• AIt must be available as documented information and communicated within the organisation✓
• BIt must be reviewed and approved by the internal audit function before issue
• CIt must be published on the organisation’s public website for interested parties
• DIt must be rewritten in full at the start of each three-year certification cycle

Answer: Clause 5.2 requires the policy to be available as documented information, communicated within the organisation, and available to interested parties as appropriate. Public publication is not required, and approval sits with top management rather than internal audit.

Is Annex A normative or informative in ISO/IEC 27001:2022?

• AInformative
• BNormative✓
• CNormative only for certified organisations
• DIt is an appendix instead

Answer: Annex A is normative, which is why the Statement of Applicability must account for every one of its controls. Its content is a reference set of controls, but the requirement to consider them is binding.

An organisation wants to exclude a clause requirement it finds inconvenient. What does ISO/IEC 27001 permit?

• AExclusions are permitted where the certification body agrees
• BClauses 6 and 8 may be excluded by smaller organisations
• CAny clause may be excluded provided the reason is documented
• DThe requirements in Clauses 4 to 10 cannot be excluded at all✓

Answer: The requirements in Clauses 4 to 10 cannot be excluded. Annex A controls may be excluded with justification in the Statement of Applicability, but that flexibility does not extend to the clauses themselves.

Which clause requires the organisation to retain documented information as evidence of the results of the risk assessment?

• AClause 9.3
• BClause 8.2✓
• CClause 4.1
• DClause 7.2

Answer: Clause 8.2 requires the organisation to perform information security risk assessments at planned intervals or when significant changes occur, and to retain documented information of the results.

What does Clause 7.2 require in relation to people doing work under the organisation’s control?

• AThat they are directly employed rather than contracted
• BThat they sign a confidentiality agreement annually
• CThat they hold a recognised information security certification appropriate to the role
• DThat they are competent on the basis of education, training or experience✓

Answer: Clause 7.2 requires the organisation to determine the necessary competence and ensure people are competent on the basis of appropriate education, training or experience, taking action where needed. It does not prescribe certifications or employment status.