E - ISO 27001:2022 Lead Implementer CertiProf

If significant changes occur or are proposed, the organization must:

• Have a management review board

• Conduct an information security risk assessment

• Review and update your information security objectives

• Implement controls to mitigate new risks

If one of the goals of an organization's information security is to prevent unauthorized disclosure of confidential information if a laptop is stolen, the controls chosen to address the risk and in the Feasibility Statement should include:

• Protection against malware

• Screening

• Encryption

• User responsibility

The scope of the audit is always the same as the scope of the management system.

• True

• False

To maintain compliance with software license requirements, which control will the organization implement?

• 8.3.1 - Separation of development, test, and production environment

• 5.1 - Policies for Information Security

• 5.3.2 - Intellectual Property Rights (IPRs)

• 5.15 - Access Control

Information security risk assessment should be conducted:

• Every six months

• At planned intervals

• Every year

• Only if directed by the Auditor

Audit reports must be distributed to:

• Recipients determined by the audit team leader

• Recipients determined by the management of the audited organization

• Recipients determined in the audit procedures or plan

• Recipients determined by the representative of the management of the audited organization

Which factor will be considered in determining the feasibility of an audit?

• Guidelines for Acceptance Officers

• Availability of sufficient information to plan the audit

• Sufficient cooperation from the audit team

• Issues related to the audit report

The Eligibility Statement must include the necessary controls to implement the selected risk treatment options, both applied and not applied, and:

• A list of all assets to which the controls and related risks apply

• Justification for the selection of controls and any control exclusions

• A list of all related policies and procedures and the associated controls

• The total risk value calculated, sorted from highest to lowest

The auditor's working documents may include:

• Checklists, plans, and evidence collection forms

• Instructions for the facilities to be audited

• Code of ethics for auditors

• Identification, including photos

Information received as audit evidence must:

• Be documented

• Be identified at least twice

• Be verifiable

• Be confirmed by guidelines