ISO 27000 Foundation Certification ISMS Implementation and Operation 2 — Questions and Answers
Question 1: During ISMS implementation, which document formally authorizes the start of the information security management system?
- Risk treatment plan
- Statement of Applicability
- Management mandate or authorization (Correct answer)
- Asset inventory register
Correct answer: Management mandate or authorization
Top management must formally authorize and mandate the ISMS before implementation begins, demonstrating committed leadership.
Question 2: What is the primary purpose of a Statement of Applicability (SoA) in an ISO 27001 ISMS?
- To list all employees who handle sensitive data
- To document which Annex A controls are applicable and their justification (Correct answer)
- To define the organization's security budget
- To record all identified information security incidents
Correct answer: To document which Annex A controls are applicable and their justification
The SoA documents selected controls from Annex A, justifies their inclusion or exclusion, and confirms implementation status.
Question 3: Which ISO 27001 clause requires organizations to determine and provide resources needed for the ISMS?
- Clause 4 — Context of the Organization
- Clause 6 — Planning
- Clause 7 — Support (Correct answer)
- Clause 9 — Performance Evaluation
Correct answer: Clause 7 — Support
Clause 7 (Support) addresses resources, competence, awareness, communication, and documented information required for ISMS operation.
Question 4: When implementing security controls, what does the term 'residual risk' mean?
- Risk that has been fully eliminated by controls
- Risk remaining after treatment measures have been applied (Correct answer)
- Risk transferred entirely to a third party
- Risk that was never identified during assessment
Correct answer: Risk remaining after treatment measures have been applied
Residual risk is the level of risk that persists after controls are implemented and cannot be fully eliminated.
Question 5: In the ISMS operational context, what does 'operational planning and control' primarily require?
- Hiring a dedicated CISO for every department
- Planning, implementing, and controlling processes needed to meet security requirements (Correct answer)
- Outsourcing all IT operations to a managed service provider
- Conducting annual penetration tests only
Correct answer: Planning, implementing, and controlling processes needed to meet security requirements
ISO 27001 Clause 8 requires organizations to plan, implement, control, and review processes that address information security requirements.
Question 6: Which activity ensures that ISMS processes continue to function correctly after initial implementation?
- One-time gap analysis at project launch
- Ongoing monitoring, measurement, and review (Correct answer)
- Annual replacement of all security policies
- Limiting ISMS scope to reduce complexity
Correct answer: Ongoing monitoring, measurement, and review
Continuous monitoring and measurement are essential to verify that ISMS controls remain effective throughout operation.
Question 7: What should an organization do when a planned information security objective cannot be achieved on schedule?
- Remove the objective from the ISMS scope permanently
- Escalate to top management and revise the plan with corrective actions (Correct answer)
- Keep the objective private to avoid negative audit findings
- Immediately certify the ISMS anyway and address gaps later
Correct answer: Escalate to top management and revise the plan with corrective actions
Unmet objectives must be escalated with a revised plan, ensuring accountability and corrective action in line with ISO 27001 requirements.
