Performance Evaluation and Improvement Flashcards
6 cards from real ISO 27000 Foundation Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Performance Evaluation and Improvement flashcards as text
According to ISO 27001, which of the following is the primary purpose of monitoring, measurement, analysis, and evaluation of the ISMS?
Answer: To evaluate information security performance and the effectiveness of the ISMS.
ISO 27001 Clause 9.1 requires the organization to evaluate the information security performance and the effectiveness of the Information Security Management System (ISMS). This process provides the data needed for management reviews and continual improvement, ensuring the ISMS is achieving its intended outcomes.
An organization's internal audit of its ISMS was conducted by the IT systems administrators, who audited the server configurations and network access controls they had personally implemented. Which fundamental principle of ISO 27001's internal audit requirements has been violated?
Answer: The need for objectivity and impartiality in the audit process.
ISO 27001 Clause 9.2 requires that auditors be selected to ensure objectivity and impartiality of the audit process. Auditors cannot audit their own work, as it creates a conflict of interest and undermines the integrity and objectivity of the audit findings.
Which of the following is a mandatory input for the management review process as defined in ISO 27001?
Answer: Feedback on information security performance, including trends in nonconformities and audit results.
ISO 27001 Clause 9.3 explicitly lists the required inputs for a management review. This includes feedback on the ISMS performance, such as trends in nonconformities, corrective actions, monitoring results, and audit results, to ensure top management has a comprehensive view of the ISMS's effectiveness.
A company's monitoring activities reveal that a critical server has not been patched for a known vulnerability, which is a nonconformity with their patch management policy. According to ISO 27001's requirements for corrective action, what is the most appropriate next step after applying the immediate patch?
Answer: Conduct a root cause analysis to determine why the patching process failed.
ISO 27001 Clause 10.2 requires that when a nonconformity occurs, the organization must evaluate the need for action to eliminate the causes of the nonconformity to prevent it from recurring. This involves reviewing the nonconformity and determining its root cause, which goes beyond simply fixing the immediate problem.
An organization's management review meeting has just concluded. The minutes show that top management has decided to allocate more budget for security awareness training and to revise the information security objectives for the next year. These decisions are an example of what?
Answer: Outputs of the management review.
According to ISO 27001 Clause 9.3.3, the outputs of the management review must include decisions related to continual improvement opportunities and any needed changes to the ISMS. Allocating resources (budget) and revising objectives are classic examples of these required outputs.
Which activity BEST demonstrates the principle of 'continual improvement' within an ISMS as required by ISO 27001 Clause 10?
Answer: Using the results from internal audits and management reviews to make targeted changes to the ISMS.
Continual improvement (Clause 10.1) is a core principle of ISO 27001, requiring the organization to continually improve the suitability, adequacy, and effectiveness of the ISMS. This is achieved by taking action based on the results of performance evaluation activities like internal audits (Clause 9.2) and management reviews (Clause 9.3), creating a cycle of improvement.