ISO 27000 Foundation Certification Scope of the ISMS 4

Question 1

Which ISO 27001 clause specifically requires the organization to determine the scope of the ISMS?

Accepted Answer

Clause 4 – Context of the organization

Answer

Clause 4.3 of ISO 27001 explicitly requires the organization to determine the boundaries and applicability of the ISMS to establish its scope.

Question 2

A software firm includes its development team in the ISMS scope but excludes the sales team. Customer contracts handled by sales contain sensitive data. What should the firm do?

Accepted Answer

Extend the scope to include sales or implement compensating controls for customer data handled by sales

Answer

When sensitive data is processed outside the ISMS scope, the organization must either expand the scope or ensure equivalent controls exist for that data.

Question 3

In the PDCA (Plan-Do-Check-Act) cycle applied to the ISMS, at which stage is the scope initially established?

Accepted Answer

Plan

Answer

ISMS scope is established during the Plan stage, along with risk assessment, objectives, and the selection of controls.

Question 4

An organization reviews its ISMS scope annually and expands it to include a newly acquired subsidiary. What does this reflect?

Accepted Answer

Continual improvement and adaptation of the ISMS to changing organizational context

Answer

Updating the ISMS scope in response to organizational changes reflects the continual improvement principle central to ISO 27001.

Question 5

Which of the following is an example of an internal issue that could influence ISMS scope?

Accepted Answer

The organization's culture and existing security maturity

Answer

Internal issues such as organizational culture, existing security practices, and maturity levels directly influence what is feasible and appropriate to include in the ISMS scope.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Scope of the ISMS 4