Performance Evaluation and Improvement Flashcards
7 cards from real ISO 27000 Foundation Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Performance Evaluation and Improvement flashcards as text
Which ISO 27001 clause specifically addresses the monitoring and measurement of the ISMS?
Answer: Clause 9 – Performance Evaluation
Clause 9 of ISO 27001 covers Performance Evaluation, which includes monitoring, measurement, analysis, and evaluation of the ISMS.
What must an organization determine when deciding what to monitor and measure in its ISMS?
Answer: What methods will be used and when results will be analyzed
ISO 27001 Clause 9.1 requires organizations to determine what to monitor and measure, the methods to use, and when results will be analyzed and evaluated.
In the context of ISO 27001, what is the primary purpose of an internal audit?
Answer: To provide information on whether the ISMS conforms to requirements and is effectively implemented
Internal audits determine whether the ISMS conforms to the organization's own requirements and ISO 27001, and whether it is effectively implemented and maintained.
How often must an organization conduct internal ISMS audits according to ISO 27001?
Answer: At planned intervals determined by the organization
ISO 27001 requires internal audits at planned intervals, but the frequency is left to the organization to determine based on risk and importance.
What is a key input that management review meetings must consider under ISO 27001 Clause 9.3?
Answer: Results of previous management reviews and the status of actions
ISO 27001 Clause 9.3 explicitly lists the status of actions from previous management reviews as a required input to management review.
Which of the following best describes a 'Key Performance Indicator' (KPI) in an ISMS context?
Answer: A measurable value that demonstrates how effectively an ISMS objective is being achieved
KPIs are measurable values that show the degree to which an ISMS objective is being achieved, enabling data-driven performance evaluation.
What should be done with documented information resulting from monitoring and measurement activities?
Answer: Retained as evidence of the results
ISO 27001 Clause 9.1 requires that documented information be retained as evidence of the monitoring and measurement results.