ISO 27000 Foundation Certification Performance Evaluation and Improvement 2 — Questions and Answers
Question 1: Which ISO 27001 clause specifically addresses the monitoring and measurement of the ISMS?
- Clause 6 – Planning
- Clause 9 – Performance Evaluation (Correct answer)
- Clause 8 – Operation
- Clause 10 – Improvement
Correct answer: Clause 9 – Performance Evaluation
Clause 9 of ISO 27001 covers Performance Evaluation, which includes monitoring, measurement, analysis, and evaluation of the ISMS.
Question 2: What must an organization determine when deciding what to monitor and measure in its ISMS?
- Which employees are responsible for each control
- What methods will be used and when results will be analyzed (Correct answer)
- The budget allocated to each information security control
- Which external auditors will review the measurements
Correct answer: What methods will be used and when results will be analyzed
ISO 27001 Clause 9.1 requires organizations to determine what to monitor and measure, the methods to use, and when results will be analyzed and evaluated.
Question 3: In the context of ISO 27001, what is the primary purpose of an internal audit?
- To replace the management review process
- To provide information on whether the ISMS conforms to requirements and is effectively implemented (Correct answer)
- To satisfy external customer contractual obligations only
- To identify employees who are not following security policies
Correct answer: To provide information on whether the ISMS conforms to requirements and is effectively implemented
Internal audits determine whether the ISMS conforms to the organization's own requirements and ISO 27001, and whether it is effectively implemented and maintained.
Question 4: How often must an organization conduct internal ISMS audits according to ISO 27001?
- Annually without exception
- Every three years to align with certification cycles
- At planned intervals determined by the organization (Correct answer)
- Only when a security incident occurs
Correct answer: At planned intervals determined by the organization
ISO 27001 requires internal audits at planned intervals, but the frequency is left to the organization to determine based on risk and importance.
Question 5: What is a key input that management review meetings must consider under ISO 27001 Clause 9.3?
- The organization's annual revenue figures
- Results of previous management reviews and the status of actions (Correct answer)
- Employee satisfaction survey results
- Marketing strategy alignment with security goals
Correct answer: Results of previous management reviews and the status of actions
ISO 27001 Clause 9.3 explicitly lists the status of actions from previous management reviews as a required input to management review.
Question 6: Which of the following best describes a 'Key Performance Indicator' (KPI) in an ISMS context?
- A legal requirement from a regulator
- A measurable value that demonstrates how effectively an ISMS objective is being achieved (Correct answer)
- A type of security incident report
- A contractual obligation with a third-party vendor
Correct answer: A measurable value that demonstrates how effectively an ISMS objective is being achieved
KPIs are measurable values that show the degree to which an ISMS objective is being achieved, enabling data-driven performance evaluation.
Question 7: What should be done with documented information resulting from monitoring and measurement activities?
- Deleted after each audit cycle to reduce storage costs
- Shared only with executive management
- Retained as evidence of the results (Correct answer)
- Submitted to ISO certification bodies immediately
Correct answer: Retained as evidence of the results
ISO 27001 Clause 9.1 requires that documented information be retained as evidence of the monitoring and measurement results.
