Clause 6.1 (Actions to Address Risks and Opportunities) has some common strategies among the risk treatment options, which one(s) of the following are valid:

• A. Transfer.

• B. Mitigate.

• • C. Assume.

• • D. All of the above.

The activity within the ISMS of approving and securing the necessary resources for the ISMS is a responsibility of:

• A. The IT Security Manager.

• B. The IT Manager.

• • C. The person responsible for the QMS.

• • D. The top management.

The activity within the ISMS of ensuring the integration of information security management system requirements into the organization's processes is the responsibility of:

• A. The top management.

• B. The IT Security Manager.

• • C. The person responsible for the QMS.

• • D. The Operations Manager.

What control is required for documented information?

• Each document is classified as an asset.

• 1. Records must be retained for three years.

• 1. Documents are protected from loss of integrity.

• 1. Only the owner of the document can update the document.

Which of the following activities correspond to top management responsibilities?

• • Ensure compliance with the information security policy.

• • Allocate resources necessary to maintain the system.

• • Supporting the drive for continuous improvement.

• All of the above.

The information security policy must be known by:

• • IT Security Manager.

• • Everyone.

• 1. QMS manager.

• 1. IT Manager.

The activity within the ISMS of communicating the importance of effective information security management and compliance with ISMS requirements is a responsibility of:

• The top management.

• The IT Security Manager.

• • The person responsible for the QMS.

• • The IT Manager.

Who is required to perform the review of the ISMS to ensure its suitability, adequacy and effectiveness?

• Top management.

• The external company performing the certification audit.

• • The process owners.

• • The internal audit team.

Identify the missing words in the following sentence.

The organization shall establish, ........................……. security management system.

• Operate, review.

• Manage, check.

• Implement, maintain.and continually improve an information

• Monitor, measure.

What should be taken into account in determining the scope of the information security management system?

• • The results of the gap analysis.

• • Legal, regulatory, contractual requirements.

• • The objectives of the organization.

• All of the above.