ISO 27000 Foundation Annex A Control Themes Questions and Answers — Questions and Answers
Question 1: An organization is updating its information security policies to include guidelines for the use of cloud services, threat intelligence, and ICT readiness for business continuity. According to the ISO 27001:2022 Annex A structure, these controls primarily fall under which theme?
- People Controls
- Physical Controls
- Organizational Controls (Correct answer)
- Technological Controls
Correct answer: Organizational Controls
The ISO 27001:2022 Annex A is structured into four themes. Controls like defining policies, threat intelligence, and ensuring readiness for business continuity are foundational, governance-level activities. These are categorized under Organizational Controls, which deal with the overarching framework and management of information security.
Question 2: A company is implementing a 'Clean Desk and Clear Screen' policy, installing privacy screens on monitors in open-plan offices, and establishing procedures for the secure disposal of storage media. These measures are examples of controls from which Annex A theme?
- Organizational Controls
- Technological Controls
- People Controls
- Physical Controls (Correct answer)
Correct answer: Physical Controls
These controls are all designed to protect tangible assets and secure the physical environment. 'Clean Desk and Clear Screen' policies, privacy screens, and secure media disposal are all part of the Physical Controls theme, which addresses the protection of the organization's premises and tangible assets from physical threats.
Question 3: A financial institution is conducting a security review. They are evaluating the effectiveness of their employee security awareness training, background verification screening for new hires, and the formal disciplinary process for security violations. Which Annex A control theme are they focusing on?
- People Controls (Correct answer)
- Organizational Controls
- Technological Controls
- Physical Controls
Correct answer: People Controls
The controls being evaluated—security awareness training, screening, and disciplinary processes—are all centered on managing security risks related to human factors. The People Controls theme specifically covers the entire employee lifecycle to mitigate risks arising from human error, negligence, or malicious intent.
Question 4: Which of the following controls is a primary example of a Technological Control as defined in the ISO 27001:2022 Annex A themes?
- Information security awareness, education, and training
- Securing offices, rooms, and facilities
- Management of privileged access rights (Correct answer)
- Information security policy and procedures
Correct answer: Management of privileged access rights
The management of privileged access rights is a Technological Control. This theme includes controls implemented through technology, such as access control systems, encryption, network security, and secure coding. The other options fall under People (training), Physical (securing offices), and Organizational (policies) controls respectively.
Question 5: A startup is building its Information Security Management System (ISMS). To protect its source code and customer data, the IT team is tasked with implementing data masking, web filtering, and secure coding practices. These controls belong to which of the four main Annex A themes?
- Organizational Controls
- Technological Controls (Correct answer)
- People Controls
- Physical Controls
Correct answer: Technological Controls
Data masking, web filtering, and secure coding are all technical measures applied to systems and applications to protect data. They are quintessential examples of Technological Controls, which focus on strengthening cyber defenses and protecting digital assets through technology.
Question 6: The ISO 27001:2022 standard restructured the Annex A controls from 14 domains into four main themes. Which theme encompasses the broadest, highest-level controls concerning information security governance, policies, and risk management?
- Physical Controls
- People Controls
- Technological Controls
- Organizational Controls (Correct answer)
Correct answer: Organizational Controls
The Organizational Controls theme serves as the foundation for the ISMS. It includes the broadest controls that define the organization's overall approach to information security, such as policies, roles and responsibilities, asset management, and supplier relationships.
ISO 27000 Foundation Annex A Control Themes Questions and Answers
An organization is updating its information security policies to include guidelines for the use of cloud services, threat intelligence, and ICT readiness for business continuity.
According to the ISO 27001:2022 Annex A structure, these controls primarily fall under which theme?