ISO 27000 Foundation Certification The PDCA Cycle 3

Question 1

Which of the following best describes the relationship between PDCA and ISO/IEC 27001's Annex A controls?

Accepted Answer

Annex A controls are selected and implemented as part of Do, following risk treatment decisions made in Plan

Answer

Risk treatment in Plan identifies which Annex A controls are needed, and these are then implemented during the Do phase.

Question 2

What document produced in the Plan phase specifies which risks will be treated and how?

Accepted Answer

Risk Treatment Plan

Answer

The Risk Treatment Plan documents selected risk treatment options and the controls needed for each identified risk.

Question 3

In which PDCA phase would management review of the ISMS typically occur?

Accepted Answer

Check

Answer

Management review is a monitoring activity in the Check phase that evaluates the ISMS performance and suitability.

Question 4

A security team patches a critical vulnerability immediately after it is discovered. Which PDCA phase does this reactive patching represent?

Accepted Answer

Act

Answer

Reacting to a discovered problem with a corrective action falls within the Act phase of the PDCA cycle.

Question 5

Which of the following is an output of the 'Check' phase in an ISO 27001 ISMS?

Accepted Answer

Audit reports and nonconformity records

Answer

Audit reports and nonconformity records are typical outputs of the Check phase's monitoring and measurement activities.

ISO 27000 Foundation Certification Practice Test