ISO 27000 Foundation Certification Cheat Sheet 2026

The 30 highest-yield ISO 27000 Foundation Certification facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Context of the organization, as required by ISO 27001 Clause 4, influences ISMS scope by identifying: → Internal and external issues relevant to information security
2. Which clause of ISO/IEC 27001 deals with remedial action? → 10.1
3. Which of the following BEST describes 'information security risk treatment' according to ISO 27005? → Selecting and implementing measures to modify risk
4. What is the role of an internal audit in an ISO 27001 ISMS? → To provide independent assurance that the ISMS conforms to requirements
5. Who is responsible for defining the scope of the ISMS in ISO 27001? → Top management
6. An organization's server room lacks a fire suppression system. According to the vocabulary of ISO 27000, this deficiency is best described as a(n): → Vulnerability
7. Which of the following is a key characteristic of an effective information security policy? → It should be approved by top management and communicated to all relevant parties
8. How does ISO 27001 define 'competence' in the context of ISMS personnel? → The ability to apply knowledge and skills to achieve intended results
9. An employee accidentally emails a confidential client list to the wrong recipient. Which CIA property has been compromised? → Confidentiality
10. According to ISO 27001, who holds ultimate accountability for the ISMS? → Top management
11. Which term describes the combination of the likelihood of a threat exploiting a vulnerability and the resulting impact on the organization? → Risk
12. What is the relationship between information security incident management and business continuity planning? → Major security incidents may trigger business continuity plans, making them complementary
13. In the ISMS operational context, what does 'operational planning and control' primarily require? → Planning, implementing, and controlling processes needed to meet security requirements
14. In ISO 27001, what is the relationship between ISMS scope and the Statement of Applicability (SoA)? → The SoA lists which Annex A controls apply based on the defined scope
15. Which ISO 27001 clause specifically requires the organization to determine the scope of the ISMS? → Clause 4 – Context of the organization
16. ISO 27000 defines 'information security' as preserving which three core properties? → Confidentiality, integrity, and availability
17. Which of the following best describes a 'corrective action' under ISO 27001 Clause 10.1? → An action taken to eliminate the cause of a detected nonconformity
18. What is meant by 'continual improvement' in the context of ISO 27001 governance? → Recurring activities to enhance ISMS performance and effectiveness over time
19. Which of the following best describes 'documented information' in the context of ISO 27001 ISMS operation? → Information that must be controlled and maintained, in any format or media
20. What has to be done as part of the monitoring, measuring, analysis, and evaluation process? → Evaluate the effectiveness of the ISMS
21. Where in the standard is a reference to controls and control goals to be found? → Annex A
22. What is the purpose of assigning information security roles and responsibilities in ISO 27001? → To ensure accountability and clarity in protecting information assets
23. Under ISO 27001, what must an organization do when a nonconformity is identified? → Take corrective action to eliminate the cause and prevent recurrence
24. What is a vulnerability as defined in the ISO 27000 vocabulary? → A weakness of an asset or control that can be exploited by one or more threats
25. Which of the following best describes 'risk appetite' in an information security context? → The amount and type of risk an organization is willing to accept
26. In a PDCA cycle for ISMS, which output from the 'Act' phase becomes an input to the next 'Plan' phase? → Corrective action results and improvement proposals
27. In the context of an ISO 27001 ISMS, what is the primary responsibility of a 'Risk Owner'? → To approve the risk treatment plan and accept the residual risk for a specific risk.
28. Which ISO 27000 series standard provides requirements for establishing an Information Security Management System (ISMS)? → ISO 27001
29. In ISO 27000 terminology, what is a 'vulnerability'? → A weakness that could be exploited by a threat
30. Which of the following must be documented (in Clause 6) according to ISO 27001:2013? → Risk assessment