A. ISO 27001:2022 Lead Implementer

Based on CertiProf's ISO/IEC 27001:2022 Lead Implementer program training guide. Part of the information security management system includes organizational structure, policies, plans, responsibilities, procedures, processes and resources. How could the documented information structure be defined?

• They can be manuals.
• They are instructions, plans and formats.
• They are documented procedures in the management system.
• All of the above.

You are working on implementing ISO/IEC 27001:2022. Some specific policies you should consider are: 1. Physical security policy. 2. Desktop policy. 3. Access Control Policy. 4. Remote Work Policy. 5. Software Use Policy.

• ISO/IEC 27001:2022 defines that you should only have one Information Security Policy and not so many specific policies.
• Only 1 and 2.
• Only 2, 3 and 4 should be evaluated to be defined in an information security management system.
• 1 to 5 are specific policies to be considered in the implementation of an ISMS.

You are working as an ISMS Lead Implementer, under your experience what could be an order to consider in the implementation?

1. Define policy, define scope, assess risks, select controls, prepare a SOA (Statement of Application).

2. Prepare a SOA (Statement of Application), define scope, define policy, assess risks, select controls.

3. Define scope, assess risks, define policy, select controls, prepare a SOA (Statement of Application).

4. Define scope, define policy, eliminate risks, prepare a SOA (Statement of Application), select controls.

Under a PDCA approach, what would be the best steps to follow?

• Option 4.
• Option 1.
• Option 3.
• Option 2.

To comply with the requirement of the ISO/IEC 27001:2022 standard, we must establish an internal audit plan that allows us to review the ISMS management system. What is the purpose of the internal audit?

• Provide information about whether the ISMS meets the organization's own requirements for its ISMS as well as those of ISO/IEC 27001:2022.
• To ensure that all controls are aligned to the standard and to check that the ISMS we have implemented meets the wishes of top management.
• Validate the results of external reviews.
• Obtain objective evidence and evaluate it objectively to determine the extent to which the audit criteria are met.

You are working as an ISO/IEC 27001:2022 lead implementer. You state that the organization must make a statement of applicability (SOA). The statement of applicability shall contain:

• All controls stated as necessary.
• The justification for the inclusion of the control.
• Whether or not the control is implemented.
• The justification for the exclusion of any of the controls.
• All of the above.

The person responsible for information security wants to establish a list of security controls as part of his work on actions to address risks and opportunities. What does he have to do first, before security risk treatment options can be selected?

• Conduct monitoring.
• Establish surveillance.
• Formulate an information security policy.
• Conduct a risk assessment.

Control 5.9 Inventory of information and other associated assets has been redesigned considering as part of management: 1. Inventory. 2. Ownership of assets. 3. Duties.

• Only 1 and 2 are correct.
• Only 3 is correct.
• Only 1 and 3 are correct.
• All options are related to control.

Based on CertiProf's ISO/IEC 27001:2022 Lead Implementer program training guide. What is a GAP analysis?

• The identification of the difference between an organization's current level of information security and its desired level of information security. Gap refers to the space between "where we are" (the present) and "where we want to be" (the goal to be achieved).
• Identifies information security risks and establishes the controls that cover those risks.
• It is the process for evaluating the effectiveness of the ISMS.
• The identification of the difference between the past level of information security in the organization and the current level of information security.

The risk analysis, gap analysis, and security policies belong to which stage of the PDCA cycle?

• Act.
• Check.
• Do.
• Plan.

As an ISMS lead implementer, you know that security testing in the development and acceptance processes is a control that should be validated, if necessary, by all organizations that decide to implement an Information Security Management System according to the ISO/IEC 27001:2022 standard. What is the purpose of these tests using this 8.29 control?

• To always ensure that the control is implemented given its worldwide importance related to software developments.
• To comply with the wishes of the executive committee.
• To validate that security requirements are met when applications or codes are implemented in a production environment.
• To avoid non-compliance with contractual legal obligations related to information security and software development.