Trial CertiProf Lead Auditor#1 (Day3)

In which of its clauses ISO 27001:2022 asks to consider?

• Stakeholders that are relevant to the information security management

  system

• The requirements of these stakeholders that are relevant to information

  security.

• Which of these requirements will be addressed through the Information

  Security Management System.

ISO 27001:2022 states that when the organization determines the need for

changes to the ISMS, the changes shall be carried out in a planned manner in its

clause :

• Clause 6.3

• Clause 10.2

• Clause 4.2

Annex A of ISO 27001:2022 defines 4 categories (organizational, people,

physical and technological) to group the 93 information security controls.

• True

• False

Once the audit has been carried out, the auditor in charge of the audit must

prepare the Audit Report. This report establishes:

a. Audit objectives

b. Scope of the audit.

c. Auditees and the audit period.

d. Documentation of the contact person.

e. Documentation of the lead auditor and other auditors.

f. Dates and locations where the audit activities took place.

g. Audit criteria.

h. Audit statements.

i. Audit Conclusions.

• All are correct.

• All except d and e.

• Only i.

The audit objectives define what is to be achieved with the individual audit.

• True

• False

The Statement of Applicability (SoA) must contain:

a. The controls necessary to implement the chosen information security

risk treatment option(s).

b. Justification of inclusions.

c. Whether or not the necessary controls are implemented.

d. Justification for exclusions from any of the controls in annex A.

• All are correct.

• All except b and c.

• Only a.

During the closing meeting the lead auditor should explain, for example, any

related post-audit activities (e.g., implementation and review of corrective

actions, handling of audit complaints, appeals process).

• a) True.

• False.

Regarding documented information, ISO 27001:2022 indicates it may include:

• Documented information of external origin, determined by the organization as

  necessary for the planning and operation of the information security

  management system.

• Documented information required by the information security management

  system and by this international regulation.

• Documented information that the organization has determined is necessary

  for the effectiveness of the information security management system.

• All of the above.

The audit plan refers to:

• A set of one or more audits planned for a specific period of time and directed

  toward a specific purpose.

• Description of the activities and arrangements for an audit.

ISO 19011:2018 determines nonconformities and improvement

opportunities as noncompliance to requirements of the audited regulation.

• True.

• False.