The PDCA Cycle Flashcards
6 cards from real ISO 27000 Foundation Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 The PDCA Cycle flashcards as text
An organization is defining the scope of its ISMS, identifying interested parties, and conducting its initial information security risk assessment. According to the PDCA cycle, which phase is the organization currently in?
Answer: Plan
The 'Plan' phase involves establishing the foundation of the ISMS. This includes understanding the organization's context, defining the scope, setting security objectives, and performing the risk assessment to create a risk treatment plan, all of which are described in the scenario.
What is the PRIMARY purpose of the 'Act' phase within the ISMS PDCA cycle?
Answer: To address nonconformities and make continual improvements to the ISMS.
The 'Act' phase focuses on continual improvement. It involves taking corrective actions based on the results of management reviews and internal audits (from the 'Check' phase) to address nonconformities and enhance the overall effectiveness of the ISMS.
A cybersecurity team is deploying a new firewall, configuring access control lists, and conducting mandatory security awareness training for all employees. These activities are characteristic of which phase of the PDCA cycle?
Answer: Do
The 'Do' phase is where the plans established in the 'Plan' phase are put into action. This includes implementing the risk treatment plan and deploying the selected security controls, such as new hardware, software configurations, and training programs.
How does the output of the 'Check' phase directly influence the 'Act' phase in the ISMS PDCA cycle?
Answer: It provides performance results, audit findings, and nonconformities that trigger corrective actions.
The 'Check' phase involves monitoring, measurement, analysis, internal audits, and management reviews. The outputs, such as audit reports and performance metrics, identify nonconformities and areas for improvement, which are the direct inputs for the 'Act' phase, where corrective actions are planned and executed.
An organization implements a new data encryption policy (Do). During a subsequent internal audit, it is discovered that the encryption is slowing down critical business processes, a finding which is presented in a management review (Check). The organization then updates the policy and technology to use a more efficient encryption algorithm (Act). This entire sequence BEST illustrates which core principle of ISO 27001?
Answer: Continual Improvement
This scenario perfectly demonstrates the principle of Continual Improvement, which is the engine of the PDCA cycle. The organization is not just implementing controls but is actively monitoring their effectiveness, identifying issues, and taking action to improve the ISMS, ensuring it remains suitable, adequate, and effective over time.
Which of the following activities is performed during the 'Plan' phase of the PDCA cycle for an ISMS?
Answer: Performing a risk assessment and selecting risk treatment options.
The 'Plan' phase is dedicated to establishing the ISMS. A core activity of this phase, as outlined in ISO 27001, is to conduct a formal risk assessment to identify threats and vulnerabilities and then to select appropriate risk treatment options which will be documented in the Risk Treatment Plan.