Annex A Control Themes Flashcards
6 cards from real ISO 27000 Foundation Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Annex A Control Themes flashcards as text
The 2022 revision of ISO/IEC 27001 restructured the Annex A controls into four high-level themes. Which of the following correctly lists these four themes?
Answer: Organizational, People, Physical, and Technological
The ISO/IEC 27001:2022 standard updated Annex A by consolidating the previous 14 domains into four distinct themes: A.5 Organizational controls, A.6 People controls, A.7 Physical controls, and A.8 Technological controls. This structure simplifies the categorization of the 93 controls.
An organization is implementing a new mandatory security awareness training program and updating its disciplinary process for information security policy violations. Under which ISO/IEC 27001:2022 Annex A theme would these controls primarily be classified?
Answer: People controls
Controls related to the human element of security, such as screening, awareness training, and disciplinary processes, fall under the 'People controls' theme (A.6). This theme focuses on mitigating risks associated with human error or malicious action throughout the employment lifecycle.
An IT department is focused on implementing data leakage prevention measures, managing the secure configuration of servers, and deploying malware protection. These activities are most representative of which Annex A control theme?
Answer: Technological controls
Controls such as data leakage prevention (A.8.12), configuration management (A.8.9), and protection against malware (A.8.7) are all examples of 'Technological controls' (A.8). This theme covers the technical safeguards applied to systems, networks, and applications to protect information.
Which of the following controls is primarily categorized under the 'Physical controls' theme (A.7) in ISO/IEC 27001:2022 Annex A?
Answer: Securing offices, rooms, and facilities
Securing offices, rooms, and facilities (A.7.3) is a core component of the 'Physical controls' theme. This theme is concerned with preventing unauthorized physical access, damage, and interference to the organization's premises and the information within them.
A company is defining its overall information security policies, assigning security roles and responsibilities, and establishing its process for information classification. These foundational activities fall under which Annex A control theme?
Answer: Organizational controls
The 'Organizational controls' theme (A.5) establishes the governance framework for the ISMS. This includes creating policies (A.5.1), defining roles and responsibilities (A.5.2), and classifying information (A.5.12), which are all high-level, process-oriented controls.
An auditor is reviewing a company's 'clear desk and clear screen' policy and the measures taken to secure equipment located off-premises. These specific controls are key components of which Annex A theme?
Answer: Physical controls
Both the 'clear desk and clear screen' policy (A.7.7) and the security of assets off-premises (A.7.9) are classified under 'Physical controls' (A.7). These controls aim to reduce the risk of unauthorized access, loss, and damage to information and equipment in the physical environment, whether on-site or remote.