ISO 27000 Family of Standards Flashcards
6 cards from real ISO 27000 Foundation Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 ISO 27000 Family of Standards flashcards as text
An organization is implementing an Information Security Management System (ISMS) and needs detailed, practical guidance on how to implement the specific security controls listed in Annex A of ISO/IEC 27001. Which standard in the ISO 27000 family should they primarily consult for this purpose?
Answer: ISO/IEC 27002
ISO/IEC 27002 provides a reference set of generic information security controls including implementation guidance. It is designed to be used in conjunction with ISO/IEC 27001, offering detailed best practices for the controls listed in Annex A.
A company has successfully implemented an ISMS based on ISO/IEC 27001 and now wants to extend it to cover privacy management and the processing of Personally Identifiable Information (PII), aligning with regulations like GDPR. Which standard provides the requirements and guidance for establishing a Privacy Information Management System (PIMS) as an extension to an ISMS?
Answer: ISO/IEC 27701
ISO/IEC 27701 is specifically designed as a privacy extension to ISO/IEC 27001 and ISO/IEC 27002. It specifies the requirements for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS).
During an ISO/IEC 27001 audit, the auditor will ask for a key document that lists all controls from Annex A, indicates whether they have been implemented, and provides a justification for any exclusions. What is this mandatory document called?
Answer: Statement of Applicability (SoA)
The Statement of Applicability (SoA) is a mandatory document for ISO/IEC 27001 certification. It links the risk assessment to the implemented controls by listing all Annex A controls, justifying their inclusion or exclusion, and showing their implementation status.
An organization is in the 'Check' phase of the Plan-Do-Check-Act (PDCA) cycle for its ISMS. Which of the following activities is most characteristic of this phase?
Answer: Monitoring and reviewing the ISMS performance against policies.
The 'Check' phase of the PDCA cycle involves monitoring, measuring, analyzing, and evaluating the performance and effectiveness of the ISMS. This includes activities like internal audits and management reviews to see if the ISMS is performing as expected.
A risk assessment team is following the process outlined in ISO/IEC 27005. After identifying risks and analyzing their potential impact and likelihood, what is the immediate next step in the risk management process before deciding on risk treatment?
Answer: Risk Evaluation
According to the ISO/IEC 27005 risk management process, after Risk Analysis (assessing likelihood and impact), the next step is Risk Evaluation. This involves comparing the analyzed risks against the organization's pre-defined risk criteria to determine their significance and decide which risks require treatment.
Which of the following BEST describes the relationship between ISO/IEC 27001 and ISO/IEC 27002?
Answer: ISO/IEC 27002 defines the audit process, while ISO/IEC 27001 lists the auditable controls.
ISO/IEC 27001 is the management standard that defines the requirements for establishing, implementing, maintaining, and continually improving an ISMS; it is the standard against which organizations can be certified. ISO/IEC 27002 is a supporting standard that provides a code of practice and detailed implementation guidance for the controls listed in Annex A of ISO/IEC 27001.