ISO 27000 Foundation Certification Performance Evaluation and Improvement 3 — Questions and Answers
Question 1: Which of the following is an example of a leading indicator in ISMS performance measurement?
- Number of security incidents in the past quarter
- Number of employees who completed security awareness training this month (Correct answer)
- Total financial loss from breaches last year
- Number of vulnerabilities exploited in production systems
Correct answer: Number of employees who completed security awareness training this month
Leading indicators predict future performance, such as training completion rates, whereas lagging indicators like incident counts reflect past events.
Question 2: What is the role of management review outputs in the ISMS improvement process?
- They replace the need for corrective actions
- They include decisions and actions related to continual improvement opportunities (Correct answer)
- They are filed for regulatory purposes and require no follow-up
- They determine which employees receive performance bonuses
Correct answer: They include decisions and actions related to continual improvement opportunities
ISO 27001 Clause 9.3 states that management review outputs must include decisions and actions related to continual improvement opportunities and any need for changes to the ISMS.
Question 3: When establishing an audit programme under ISO 27001, which factor should influence audit frequency?
- The cost of hiring external auditors
- The importance of the processes concerned and results of previous audits (Correct answer)
- The number of employees in the IT department
- The organization's marketing calendar
Correct answer: The importance of the processes concerned and results of previous audits
ISO 27001 requires that the audit programme consider the importance of processes and the results of previous audits when determining frequency.
Question 4: What does 'effectiveness' mean in the context of ISMS performance evaluation?
- Completing all planned security activities within budget
- The extent to which planned activities are realized and planned results achieved (Correct answer)
- Achieving the lowest possible number of security incidents
- Deploying the maximum number of technical security controls
Correct answer: The extent to which planned activities are realized and planned results achieved
Effectiveness in ISO management systems means the extent to which planned activities are carried out and planned results are achieved.
Question 5: An organization discovers its patch management metrics have not been collected for three months. Which PDCA phase does corrective action for this failure belong to?
- Plan
- Do
- Check
- Act (Correct answer)
Correct answer: Act
The Act phase of PDCA addresses nonconformities and corrective actions to fix failures identified during the Check (monitoring/measurement) phase.
Question 6: Which statement about ISMS audit independence is correct according to ISO 27001?
- Auditors may audit their own work if they are certified
- Auditors must be independent of the activities they audit (Correct answer)
- Only external auditors can be considered independent
- Independence is optional if the organization is small
Correct answer: Auditors must be independent of the activities they audit
ISO 27001 Clause 9.2 requires that auditors are selected to ensure objectivity and impartiality, meaning they cannot audit their own work.
Question 7: What is the difference between monitoring and measurement in ISO 27001?
- Monitoring is done by auditors; measurement is done by management
- Monitoring involves ongoing oversight while measurement assigns quantitative values to results (Correct answer)
- Measurement is informal; monitoring is formal and documented
- There is no practical difference — the terms are interchangeable
Correct answer: Monitoring involves ongoing oversight while measurement assigns quantitative values to results
Monitoring is the continuous observation of status, while measurement assigns specific quantitative or qualitative values to enable objective evaluation.
ISO 27000 Foundation Certification Performance Evaluation and Improvement 3
Which of the following is an example of a leading indicator in ISMS performance measurement?