Performance Evaluation and Improvement Flashcards
7 cards from real ISO 27000 Foundation Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Performance Evaluation and Improvement flashcards as text
Which of the following is an example of a leading indicator in ISMS performance measurement?
Answer: Number of employees who completed security awareness training this month
Leading indicators predict future performance, such as training completion rates, whereas lagging indicators like incident counts reflect past events.
What is the role of management review outputs in the ISMS improvement process?
Answer: They include decisions and actions related to continual improvement opportunities
ISO 27001 Clause 9.3 states that management review outputs must include decisions and actions related to continual improvement opportunities and any need for changes to the ISMS.
When establishing an audit programme under ISO 27001, which factor should influence audit frequency?
Answer: The importance of the processes concerned and results of previous audits
ISO 27001 requires that the audit programme consider the importance of processes and the results of previous audits when determining frequency.
What does 'effectiveness' mean in the context of ISMS performance evaluation?
Answer: The extent to which planned activities are realized and planned results achieved
Effectiveness in ISO management systems means the extent to which planned activities are carried out and planned results are achieved.
An organization discovers its patch management metrics have not been collected for three months. Which PDCA phase does corrective action for this failure belong to?
Answer: Act
The Act phase of PDCA addresses nonconformities and corrective actions to fix failures identified during the Check (monitoring/measurement) phase.
Which statement about ISMS audit independence is correct according to ISO 27001?
Answer: Auditors must be independent of the activities they audit
ISO 27001 Clause 9.2 requires that auditors are selected to ensure objectivity and impartiality, meaning they cannot audit their own work.
What is the difference between monitoring and measurement in ISO 27001?
Answer: Monitoring involves ongoing oversight while measurement assigns quantitative values to results
Monitoring is the continuous observation of status, while measurement assigns specific quantitative or qualitative values to enable objective evaluation.