ISO 27000 Foundation Certification ISMS Implementation and Operation 2

Question 1

During ISMS implementation, which document formally authorizes the start of the information security management system?

Accepted Answer

Management mandate or authorization

Answer

Top management must formally authorize and mandate the ISMS before implementation begins, demonstrating committed leadership.

Question 2

What is the primary purpose of a Statement of Applicability (SoA) in an ISO 27001 ISMS?

Accepted Answer

To document which Annex A controls are applicable and their justification

Answer

The SoA documents selected controls from Annex A, justifies their inclusion or exclusion, and confirms implementation status.

Question 3

Which ISO 27001 clause requires organizations to determine and provide resources needed for the ISMS?

Accepted Answer

Clause 7 — Support

Answer

Clause 7 (Support) addresses resources, competence, awareness, communication, and documented information required for ISMS operation.

Question 4

When implementing security controls, what does the term 'residual risk' mean?

Accepted Answer

Risk remaining after treatment measures have been applied

Answer

Residual risk is the level of risk that persists after controls are implemented and cannot be fully eliminated.

Question 5

In the ISMS operational context, what does 'operational planning and control' primarily require?

Accepted Answer

Planning, implementing, and controlling processes needed to meet security requirements

Answer

ISO 27001 Clause 8 requires organizations to plan, implement, control, and review processes that address information security requirements.

ISO 27000 Foundation Certification Practice Test