Planning the ISMS Implementation

What must exist before an ISMS implementation project can properly begin?

• AA mandate from top management, with the authority and resources it implies✓
• BA signed contract with an accredited certification body for the audit
• CA completed risk assessment covering every asset within the intended scope
• DA full inventory of information assets, with an owner named against each

Answer: The mandate is what gives the project its authority, budget and access. The risk assessment and asset inventory are outputs of work that the mandate authorises, and the certification body is engaged much later.

What is the purpose of a gap analysis at the start of an ISMS implementation?

• ATo determine the internal audit programme for the next certification cycle
• BTo identify which of the 93 Annex A controls can be excluded from the SoA
• CTo calculate the residual risk that will remain across the scope once treatment is complete
• DTo establish the distance between current practice and the requirements of the standard✓

Answer: A gap analysis measures what already exists against what the standard requires, which is what makes the implementation plan realistic. Control exclusion belongs to the Statement of Applicability and residual risk to treatment.

An organisation excludes an outsourced payroll service from the ISMS scope. What does ISO/IEC 27001 still require in relation to that service?

• ALittle, because it is outside the scope
• BThe supplier must hold its own ISO 27001 certificate
• CThe service must be brought into scope before certification
• DThe interfaces and dependencies with it must be addressed✓

Answer: Excluding something from scope does not exclude the risk it carries. Clause 4.3 requires the interfaces and dependencies between activities inside the scope and those performed by other organisations to be considered.

Which of these is the clearest example of a scope defined so as to be indefensible at audit?

• AA scope limited to a single business unit within a larger legal entity
• BA scope that excludes a system which processes in-scope information✓
• CA scope limited to one geographic site where several sites are operated
• DA scope that includes third-party data centres operated under contract

Answer: Scope may legitimately be limited by business unit, site or service. What it cannot do is exclude something that processes in-scope information, because the interface is then unmanaged and the boundary is not real.

What document must the scope of the ISMS be maintained as?

• AA section of the information security policy
• BDocumented information✓
• CAn annex to the SoA
• DA signed board resolution

Answer: Clause 4.3 requires the scope to be available as documented information. Where it physically lives is the organisation’s choice, but it must exist in that form.

When determining the scope, which of the following must the organisation consider?

• AExternal and internal issues, interested-party requirements, and interfaces and dependencies✓
• BThe cost of certification, the audit timetable and the resources available
• CThe Annex A controls it intends to implement
• DOnly the systems that store personal data

Answer: Clause 4.3 requires scope to be determined considering the issues from 4.1, the requirements from 4.2, and the interfaces and dependencies with other organisations. Control selection happens later and does not drive scope.

What is the primary purpose of a business case for an ISMS implementation?

• ATo document the risk acceptance criteria the organisation will apply
• BTo satisfy the documented-information requirement that Clause 5 places on it
• CTo justify the investment and secure the commitment needed to sustain it✓
• DTo record which Annex A controls have been excluded, and on what grounds

Answer: ISO/IEC 27001 does not require a business case, but no implementation survives without leadership commitment, and the business case is how that is won. Risk criteria and exclusions are separate artefacts with their own homes.

Which of these best describes the relationship between the information security policy and the ISMS objectives?

• AThe two are alternative ways of expressing the same requirement
• BThe policy is derived from the objectives
• CThe objectives are published as an annex to the policy
• DThe policy provides the framework within which objectives are set✓

Answer: Clause 5.2 requires the policy to include a framework for setting information security objectives. The direction runs from policy to objectives, not the other way round.

What does ISO/IEC 27001 require of information security objectives?

• AThey must be measurable where practicable, and monitored✓
• BThey must be reviewed only at management review
• CThey must be identical to the risk acceptance criteria
• DThey must be expressed as financial targets

Answer: Clause 6.2 requires objectives to be consistent with the policy, measurable if practicable, monitored, communicated and updated as appropriate. Nothing requires them to be financial.

Who should be accountable for the ISMS implementation project?

• AEvery member of staff equally
• BThe internal audit function
• CThe lead auditor appointed by the certification body
• DA named role with the authority to direct resources✓

Answer: Clause 5.3 requires top management to assign responsibilities and authorities. Internal audit must remain independent of what it audits, so it cannot own delivery, and the certification body has no role in implementation.

An organisation has many candidate improvements and limited resources. What should drive the order of work?

• AThe cost of each control, starting with the cheapest to demonstrate progress
• BThe order in which Annex A lists the controls, working through A.5 to A.8
• CThe preference expressed by the certification body at the Stage 1 audit
• DThe results of the risk assessment and the treatment plan✓

Answer: The risk assessment establishes which risks matter and the treatment plan sequences the response. Annex A is a reference list in numerical order and carries no priority.

Which of these is an appropriate input when determining the internal issues under Clause 4.1?

• AThe findings of the previous certification audit and nothing beyond them
• BThe audit criteria the certification body publishes for ISMS assessments
• CThe list of Annex A controls the organisation has already implemented
• DThe organisation’s culture, structure and existing contractual obligations✓

Answer: Internal issues include governance, structure, roles, policies, objectives, capabilities, culture and contractual relationships. Existing controls and audit criteria are not what 4.1 is asking about.

A newly appointed implementer finds no documented scope, no policy and no risk assessment. Which should be established first?

• AThe scope, because the policy and risk assessment both depend on it✓
• BThe policy, because Clause 5 precedes Clause 6
• CThe risk assessment, because it identifies what needs protecting
• DAll three simultaneously, since the standard sets no order

Answer: Scope determines what the ISMS covers, and both the policy and the risk assessment operate within it. Assessing risk before the boundary exists produces a result nobody can act on.

What is the role of interested-party requirements in planning an ISMS?

• AThey are inputs that shape scope, objectives and risk criteria✓
• BThey apply only to regulators and customers
• CThey replace the need for a risk assessment
• DThey must all be met in full before certification can be recommended

Answer: Clause 4.2 requires the organisation to determine interested parties and which of their requirements are relevant. Relevant requirements feed the scope, objectives and criteria; not every stated wish becomes a requirement.

An implementation plan sets no dates and names no owners. Which requirement does this most directly fail?

• AClause 7.5, which requires the control of documented information across the ISMS
• BClause 6.2, which requires planning of what will be done, by whom and when✓
• CClause 4.1, which requires determination of internal issues
• DClause 9.2, which requires an audit programme

Answer: Clause 6.2 requires the organisation to plan how to achieve its objectives: what will be done, what resources are required, who is responsible, when it will be completed and how results will be evaluated.

Which statement about the ISMS scope is correct?

• AIt must cover the entire legal entity, including every business unit
• BIt must include every system that holds data of any kind, in any location
• CIt may be narrower than the whole organisation, provided the boundary is defensible✓
• DIt is fixed at the point of certification and cannot be changed afterwards

Answer: Scope may be limited by business unit, site or service. What matters is that the boundary is justified and the interfaces are managed; the scope can also be changed later through the normal change and review process.