Learning
Learning
Loading practice session...
ISO 27001 · Exam domain
433 practice questions in this domain. AI-tutored explanations for every answer.
Sign in to practice all 433 questions with progress tracking and AI explanations.
1. According to ISO 27001, who is required to approve the high-level Information Security Policy (ISMS Policy) to satisfy the requirements of Clause 5.2?
Explanation
Clause 5.2 specifically requires Top Management (Board/CEO) to approve the high-level ISMS Policy. The CISO or IT Director may approve topic-specific policies under Annex A 5.1, but only Top Management can approve the singular ISMS Policy.
2. Under Annex A 5.1, who is authorized to approve topic-specific information security policies (e.g., Access Control Policy, Cryptographic Policy)?
Explanation
Annex A 5.1 requires topic-specific policies to be approved by Management, which can be delegated to roles such as the CISO or IT Director. This differs from Clause 5.2, which mandates Top Management approval for the high-level ISMS Policy.
3. An organization publishes its information security policies on the corporate intranet and requires all employees to attend annual security awareness training that covers policy content. What requirement of Annex A 5.1 is still likely not being met?
Explanation
Annex A 5.1 requires not just communication (publishing on intranet) or awareness (training), but documented acknowledgement that personnel have received, read, and understood the policies. This typically requires signed confirmation (physical or digital), distinguishing it from general awareness training under Annex A 6.3.
4. An organization reviewed its information security policies after three years, justifying the delay by stating 'no significant changes occurred in our operating environment.' An auditor would likely find this non-compliant with Annex A 5.1 for which reason?
Explanation
Annex A 5.1 requires reviews at 'planned intervals' (which must be defined by the organization, typically annually) and when significant changes occur. Simply waiting for changes is insufficient; the organization must have a defined schedule. While three years might be acceptable if formally justified as the planned interval, the justification 'no changes occurred' indicates an ad-hoc approach rather than a planned interval.
5. In the 'Governance Pyramid' model for ISO 27001 documentation, which document resides at the Peak (Level 1) and serves as the 'constitution' for the ISMS?
Explanation
The Peak of the pyramid (Clause 5.2) is the singular, high-level Information Security Policy approved by Top Management. Topic-specific policies like Access Control or Clear Desk reside at Layer 2 (Annex A 5.1), while Procedures reside at Layer 3.
Practice all 433+ questions in this domain
Start free practice →