ISMS Self-Test Template (68 ISO/IEC 27001 Questions with Answer Key)

ISMS Self-Test: [Organization name]

A self-test of 68 questions on information security management systems (ISMS) under ISO/IEC 27001:2022 + Amd 1:2024: 64 multiple-choice questions, many of them short scenarios, in nine topic sections, plus four open scenario questions. A separate answer key explains every answer and points to the clause and the learning module to revisit. It supports the evaluation of competence and awareness (clauses 7.2 and 7.3) and is the final check of isms/isms-learning-path. All questions are original; no ISO text is reproduced. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and instructions
2. Scoring and pass marks
3. Section A: family and fundamentals
4. Section B: context and leadership (clauses 4 and 5)
5. Section C: planning and risk (clause 6)
6. Section D: support (clause 7)
7. Section E: operation (clause 8)
8. Section F: performance evaluation (clause 9)
9. Section G: improvement (clause 10)
10. Section H: Annex A controls
11. Section I: certification
12. Section J: open scenario questions
13. Answer key
14. Results log
15. Size tiers: running the test
16. Records and evidence
17. References

1. Purpose and instructions

Instructions for learners:

1. Answer without notes, the standard or other help. The test checks what you can apply from memory, as you would in an audit interview.
2. For multiple-choice questions, choose one answer: the best one. Some wrong options are partly true; pick the most complete and accurate.
3. Allow about 90 minutes for sections A to I and 30 minutes for section J (Example times).
4. The fictional organisations in scenarios are:
   • Quillmere Analytics Ltd: B2B SaaS analytics platform, 46 staff (38 employees, 8 contractors), one office plus remote staff, production on one public cloud provider in two regions, processor of customer personal data, part-time ISMS manager (0.5 FTE).
   • Quillmere Health Systems: clinical scheduling software and managed service, 320 staff, two offices and one colocation suite, processor for hospitals and controller for its own staff and marketing data, a full-time ISMS manager plus a 3-person security team.
   • Quillmere Group: manufacturing and services, 2,400 staff, 6 sites in 4 countries, OT and IT, already certified to ISO 9001 and ISO 22301, CISO with a 14-person security office.
5. The risk scale used in this library: likelihood 1 to 5 times impact 1 to 5, score 1 to 25; bands Low 1-4, Medium 5-9, High 10-16, Critical 17 to 25 (in practice 20 and 25). Default acceptance: Low by the risk owner; Medium by the risk owner plus the department head; High by top management with a treatment decision; Critical not without treatment unless top management records a decision.

2. Scoring and pass marks

Each multiple-choice question scores 1 point: 64 points in total. Open scenario questions in section J are marked by a mentor as "meets" or "does not meet" using the model answers.

3. Section A: family and fundamentals

Q01. Which standard contains the requirements an organisation's ISMS is certified against?

• A. ISO/IEC 27000:2026
• B. ISO/IEC 27002:2022
• C. ISO/IEC 27001:2022 + Amd 1:2024
• D. ISO/IEC 27005:2022

Q02. How is Annex A of ISO/IEC 27001:2022 organised?

• A. 114 controls in 14 domains
• B. 93 controls in 4 themes
• C. 93 controls in 14 themes
• D. 37 controls in 4 themes

Q03. What did Amendment 1:2024 add to ISO/IEC 27001:2022?

• A. New Annex A controls for environmental protection
• B. A requirement to publish a carbon footprint report
• C. A new clause 11 on sustainability
• D. A requirement to determine whether climate change is a relevant issue, and a note that interested parties can have climate-related requirements

Q04. An employee e-mails a full customer list to a personal e-mail address. Which information security property is mainly affected?

• A. Confidentiality
• B. Integrity
• C. Availability
• D. Accountability

Q05. Which description best fits ISO/IEC 27002:2022?

• A. Requirements an organisation is certified against
• B. Requirements for certification bodies
• C. Guidance on implementing information security controls, with attributes to group them
• D. Requirements for privacy information management

Q06. Who makes the decision to grant ISO/IEC 27001 certification?

• A. The lead auditor, at the closing meeting
• B. The accreditation body
• C. The organisation's ISMS manager
• D. The certification body, through people who did not conduct the audit

Q07. What is the status of certificates issued against ISO/IEC 27001:2013?

• A. They remain valid until 2027
• B. They expired at the end of the transition period, 2025-10-31
• C. They were converted automatically to the 2022 edition
• D. They stay valid while surveillance audits continue

Q08. Which edition of ISO/IEC 27701 is a stand-alone, certifiable privacy management system standard?

• A. ISO/IEC 27701:2025
• B. ISO/IEC 27701:2019
• C. ISO/IEC 27701:2022
• D. None; ISO/IEC 27701 can only be used as an extension of ISO/IEC 27001

4. Section B: context and leadership (clauses 4 and 5)

Q09. Under clause 4, which item must be kept as documented information?

• A. The list of internal and external issues
• B. The list of interested parties
• C. The scope of the ISMS
• D. The process map

Q10. Scenario. Quillmere Analytics Ltd runs its production platform on one public cloud provider in two regions. Its scope statement covers "the company and the analytics platform" and says nothing about the cloud provider. What is the auditor most likely to question?

• A. Nothing: the cloud provider is outside the scope
• B. Whether interfaces and dependencies with the cloud provider were considered when setting the scope
• C. Why the cloud provider itself is not certified by Quillmere's certification body
• D. Why A.5.23 has not been excluded from the Statement of Applicability

Q11. Which requirement was added to clause 4.2 in the 2022 edition?

• A. Survey every interested party once a year
• B. Publish the list of interested parties
• C. List every customer by name
• D. Decide openly which stakeholder expectations the ISMS will take on

Q12. Which two commitments must the information security policy contain?

• A. To meet the obligations that apply, and to keep making the ISMS better
• B. To prevent all incidents, and to achieve certification
• C. To buy approved tools, and to train every manager
• D. To report to the certification body, and to publish the risk register

Q13. Clause 5.3 asks top management to assign responsibility and authority for which two things?

• A. Purchasing security tools and approving budgets
• B. Approving firewall changes and access requests
• C. Keeping the ISMS in line with the standard, and telling leadership how the ISMS is doing
• D. Hiring auditors and selecting the certification body

Q14. Scenario. The chief executive of Quillmere Health Systems says: "Security is the IT team's job. I don't attend ISMS reviews." Which clause is most at risk?

• A. 7.5 Documented information
• B. 5.1 Leadership and commitment
• C. 8.3 Information security risk treatment
• D. 10.1 Continual improvement

Q15. Which response best meets the climate change addition in clause 4.1?

• A. Ignore it, because it is only a note
• B. Add a new control to the Statement of Applicability
• C. Buy carbon offsets for the data centre
• D. Record a decision on whether climate change is a relevant issue for the ISMS, with the reasoning

Q16. Which clause treats the ISMS as a set of connected processes, including how they hand work to each other?

• A. 4.4
• B. 7.4
• C. 9.3
• D. 10.2

5. Section C: planning and risk (clause 6)

Q17. A risk is rated likelihood 4 and impact 4 on the library scale. What is its score and band?

• A. 8, Medium
• B. 16, Critical
• C. 16, High
• D. 20, Critical

Q18. Under the library's default acceptance rules, who may accept a risk with a score of 6?

• A. Only the board
• B. The risk owner together with the department head
• C. Any employee who identifies it
• D. The certification body

Q19. A risk scores 20 on the library scale. Which statement is correct?

• A. It is Critical and cannot be accepted without treatment, except by a documented top management decision
• B. It is High and the risk owner may accept it
• C. It is Medium and may be retained
• D. It must always be transferred to an insurer

Q20. Clause 6.1.2 requires the risk assessment process to produce results that are:

• A. Identical every year
• B. Approved by the certification body
• C. Expressed in money
• D. Repeatable, so two assessments of the same risk reach a comparable answer

Q21. Which item is not required content of the Statement of Applicability?

• A. The necessary controls
• B. The justification for including each control
• C. Whether each control is implemented
• D. The purchase cost of each control

Q22. Scenario. Quillmere Analytics Ltd's Statement of Applicability marks A.8.30 (outsourced development) as "Not applicable: not needed", with no other reason. During the audit, the auditor learns that a contractor builds the mobile app. How is this most likely to be treated?

• A. Acceptable, because Annex A is a reference list
• B. An opportunity for improvement only
• C. A nonconformity: the exclusion is not justified and contradicts what happens in practice
• D. No issue, because contractors are outside the ISMS

Q23. Under clause 6.1.3, who approves the risk treatment plan and accepts the residual information security risks?

• A. The risk owners
• B. The internal auditor
• C. The certification body
• D. Every member of staff

Q24. Which of these is a measurable information security objective?

• A. Improve our security culture
• B. Reduce the time to remove leavers' access to under 24 hours by 2027-06-30
• C. Be secure at all times
• D. Comply with ISO/IEC 27001

Q25. What does clause 6.3 (planning of changes) require?

• A. A documented change plan for every IT change
• B. Nothing new: it was already in the 2013 edition
• C. Changes to the ISMS are carried out in a planned way; there is no explicit documented information requirement
• D. Notification of the certification body before any change

Q26. Which of these is not a risk treatment option?

• A. Reduce the risk with controls
• B. Avoid the risk by stopping the activity
• C. Share the risk, for example through insurance or a contract
• D. Ignore the risk without any record or decision

6. Section D: support (clause 7)

Q27. What documented information does clause 7.2 explicitly require?

• A. Evidence of competence
• B. A CV for every employee
• C. The annual training budget
• D. Certificates issued by the certification body

Q28. Which item is not something people must be aware of under clause 7.3?

• A. The information security policy
• B. How their own work helps the ISMS succeed
• C. The source code of the security monitoring tools
• D. The consequences of ignoring ISMS rules

Q29. What must the organisation determine for communication under clause 7.4?

• A. Only the content of press releases
• B. The message, its timing, the audience and the channel
• C. Only incident notifications to authorities
• D. Only reports to the board

Q30. Scenario. Engineers at Quillmere Health Systems work from a copy of the access control policy downloaded two years ago. The approved version has changed twice since. Which clause is most directly involved?

• A. 7.5.3 Control of documented information
• B. 9.3 Management review
• C. 6.2 Objectives
• D. 8.3 Risk treatment

Q31. How should documents of external origin, such as the security schedule of a customer contract, be handled?

• A. Ignored, because the organisation did not write them
• B. Copied word for word into the information security policy
• C. Published on the website
• D. Tracked and kept under suitable control, like internal documents

Q32. What is the main difference between a document and a record?

• A. There is no difference
• B. A document describes how things are done and is revised; a record proves what happened and should not be altered afterwards
• C. A record is a draft document
• D. Documents must be on paper

7. Section E: operation (clause 8)

Q33. When does clause 8.2 require information security risk assessments to be performed?

• A. Only before the certification audit
• B. Every month
• C. On a set schedule, and again whenever something big changes or is about to
• D. Only after an incident

Q34. Scenario. Quillmere Health Systems moved its scheduling service into a new colocation suite three months ago. The risk register was last updated 14 months ago; the planned interval is 12 months. How is this most likely to be treated?

• A. Conforming, because the move was an IT project
• B. A likely nonconformity: the planned interval was missed and a significant change was not assessed
• C. An observation only, because the risk register exists
• D. A matter for clause 10.1 only

Q35. What does clause 8.1 expect for externally provided processes, products or services relevant to the ISMS?

• A. Nothing: they are the supplier's problem
• B. They must be brought in-house
• C. The supplier must hold its own ISO/IEC 27001 certificate
• D. The organisation keeps them under its own control

Q36. What does clause 8.3 require?

• A. Implement the risk treatment plan and keep the results
• B. Buy cyber insurance
• C. Run an annual penetration test
• D. Notify the certification body of each treatment action

Q37. Which is the best evidence that a quarterly access review control operates?

• A. A policy statement that access is reviewed quarterly
• B. A manager's verbal assurance
• C. Dated review records showing decisions taken and access removed
• D. The access management tool's product brochure

8. Section F: performance evaluation (clause 9)

Q38. Clause 9.1 asks the organisation to determine all of the following except:

• A. Which things to track
• B. How the tracking and the review of results will be done
• C. Who reviews the results, and on what schedule
• D. The salary band of the internal auditor

Q39. What does objectivity and impartiality of internal auditors mean in practice?

• A. Internal auditors must always be external consultants
• B. Auditors do not audit their own work
• C. The ISMS manager audits every process personally
• D. No internal audits are held in the first year

Q40. Which factors should the internal audit programme take into account?

• A. How much each process matters, and what earlier audits found
• B. Only the areas that are cheapest to audit
• C. Only Annex A controls
• D. Only IT systems

Q41. Which of these is a required management review input?

• A. The company's share price
• B. The marketing plan
• C. Changes in the needs and expectations of interested parties
• D. The annual sales forecast

Q42. Which outputs of the management review must be recorded?

• A. A new corporate logo
• B. The full internal audit report
• C. The complete risk register
• D. What leadership decided to improve or change in the ISMS

Q43. Scenario. Quillmere Analytics Ltd has no one who can audit the ISMS without auditing their own work, so it engages an independent auditor for its internal audit. Is this acceptable?

• A. No: internal audits must be done by employees
• B. Yes, if the auditor is competent and objective, and Quillmere manages the programme and acts on the results
• C. Only for organisations with more than 500 staff
• D. Only with prior approval from the certification body

Q44. What is the difference between monitoring and measurement?

• A. Monitoring tracks how something is doing over time; measurement puts a number on it using a defined method
• B. There is no difference
• C. Measurement may only be done by the certification body
• D. Monitoring is only done quarterly

Q45. In common certification body practice (not a clause), what is usually expected before the Stage 2 audit?

• A. Three full years of records
• B. A risk register with no High or Critical risks
• C. At least one full internal audit and one management review completed
• D. A penetration test certificate

9. Section G: improvement (clause 10)

Q46. What is the difference between a correction and a corrective action?

• A. They are the same thing
• B. A correction fixes the specific problem; a corrective action removes its cause so it does not recur
• C. A corrective action is always quicker
• D. A correction requires a root cause analysis

Q47. Scenario. An internal audit at Quillmere Group finds three leaver accounts still active 20 days after the leavers' departure. The policy requires removal within 1 business day. The operations team disables the three accounts and closes the finding the same day. What is missing?

• A. Nothing: the accounts are disabled
• B. Notification of the certification body
• C. A new information security policy
• D. Cause analysis, a check for similar cases, a corrective action and a later effectiveness review

Q48. What documented information does clause 10.2 require?

• A. The nature of the nonconformities, the actions taken and the results of corrective actions
• B. Only the names of the auditors
• C. Nothing
• D. Only records of major nonconformities

Q49. In ISO/IEC 27001:2022, which sub-clause covers continual improvement?

• A. 10.2
• B. 9.4
• C. 10.1
• D. 10.3

Q50. What is an opportunity for improvement?

• A. Another name for a nonconformity
• B. A point where requirements are met but the ISMS could work better
• C. A major finding that blocks certification
• D. A reason to suspend the certificate

10. Section H: Annex A controls

Q51. Which control is new in the 2022 edition of Annex A?

• A. A.5.15 access control rules
• B. A.8.13 information backup
• C. A.6.1 screening
• D. A.5.7 threat intelligence

Q52. How many controls are in the technological theme (A.8)?

• A. 34
• B. 37
• C. 14
• D. 8

Q53. Which control covers data masking?

• A. A.5.12
• B. A.7.7
• C. A.8.11
• D. A.8.24

Q54. Which of these is a people control?

• A. A.8.20 network security
• B. A.6.7 remote working
• C. A.7.4 physical security monitoring
• D. A.5.23 cloud services

Q55. What is the status of Annex A controls?

• A. A reference list used to check that no necessary control is missed; every exclusion needs a justification in the Statement of Applicability
• B. All 93 are mandatory for every organisation
• C. Optional, with no need to record a decision
• D. Only for organisations above 500 staff

Q56. Scenario. Quillmere Analytics Ltd hosts all production in the cloud and has no server room. Its office has network switches and Wi-Fi access points. How should it decide on A.7.11 (supporting utilities)?

• A. Exclude it automatically with the reason "cloud"
• B. Implement backup generators at the office
• C. Leave it out of the Statement of Applicability
• D. Decide from the risk assessment: the provider covers its data centres (assured under A.5.23), office utilities may still matter for office network equipment, and the decision is justified either way

Q57. Which values belong to the "cybersecurity concepts" attribute in ISO/IEC 27002:2022?

• A. Plan, do, check, act
• B. Confidentiality, integrity, availability
• C. Identify, Protect, Detect, Respond, Recover
• D. Preventive, detective, corrective

Q58. Which control covers configuration management?

• A. A.8.32
• B. A.8.9
• C. A.5.37
• D. A.8.19

11. Section I: certification

Q59. What is the main purpose of the Stage 1 audit?

• A. Review documentation, readiness and scope, and plan Stage 2
• B. Sample control operation across all sites for effectiveness
• C. Issue the certificate
• D. Carry out the first surveillance

Q60. When is the first surveillance audit after initial certification due?

• A. Exactly 6 months after Stage 2
• B. Any time within the three-year cycle
• C. 36 months after the certification decision
• D. No later than 12 months from the certification decision date

Q61. How long is a certification cycle?

• A. One year
• B. Three years
• C. Five years
• D. Unlimited while fees are paid

Q62. Who sets the audit time, and on what basis?

• A. The organisation, based on its budget
• B. The accreditation body, separately for each client
• C. The certification body, applying ISO/IEC 27006-1 (persons doing work under the organisation's control, complexity factors)
• D. A fixed five days for every organisation

Q63. Scenario. Quillmere Group asks whether the certification body must audit every one of its six sites. Which answer is best?

• A. Yes, every site must be audited in every audit
• B. Sampling of sites may be possible under ISO/IEC 27006-1 and IAF MD 1 (now Global ACI-TECH-3-001) when the conditions are met; the certification body decides
• C. Only one site is ever audited
• D. Sampling is only allowed when all sites are in one country

Q64. What should an organisation check first when choosing a certification body?

• A. That it is accredited for ISO/IEC 27001 by an accreditation body that is a signatory of the Global ACI MRA (formerly the IAF MLA), checked in the IAF CertSearch database
• B. That it is the cheapest offer
• C. That it will also implement the ISMS for you as a consultant
• D. That it guarantees a pass

12. Section J: open scenario questions

Q65. Scenario. At Quillmere Analytics Ltd, the risk "customer data exposed through a misconfigured storage bucket" is rated likelihood 3 and impact 4 before treatment. After configuration scanning and an approval step for public access are added, likelihood falls to 2 and impact stays at 4. State the score and band before and after treatment, and say who may accept the residual risk.

Q66. Scenario. The draft management review agenda at Quillmere Health Systems has three items: status of actions from the previous review, internal audit results, and status of the risk treatment plan. List the required inputs that are missing.

Q67. Scenario. Quillmere Group plans to certify its ISMS in phases, starting with headquarters and the data centre. Explain two things the scope statement must address for the first phase, given that the plants and the service centre are outside it.

Q68. Write one audit finding, in the format requirement, evidence and gap, for this observation: in a sample of 10 leavers from the last quarter, 3 still had active accounts 20 days after their departure, while the access control policy requires removal within 1 business day.

13. Answer key

13.1 Section A

13.2 Section B

13.3 Section C

13.4 Section D

13.5 Section E

13.6 Section F

13.7 Section G

13.8 Section H

13.9 Section I

13.10 Section J model answers

14. Results log

15. Size tiers: running the test

The library's working tiers are small (under 50 people), medium (50 to 500) and large or multi-site (over 500 or several sites).

When you add organisation-specific questions, number them after Q68 so that results for Q01 to Q68 stay comparable across versions.

16. Records and evidence

Map these records in isms/control-evidence-matrix (DOC-ISMS-033) under clause 7.2, clause 7.3 and control A.6.3.

17. References

IAF MD 1:2023 (multi-site certification) has been re-issued by Global Accreditation Cooperation Incorporated (Global ACI), which replaced IAF and ILAC on 2026-01-01, as Global ACI-TECH-3-001; check the current issue on the Global ACI website.

Related templates: isms/isms-learning-path, isms/isms-glossary, isms/iso-27001-clauses-explained, isms/certification-audit-explained, isms/isms-worked-walkthrough, isms/isms-competence-training-matrix, compliance/risk-methodology.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10 and Annex A, with certification questions based on ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. All questions, options, scenarios, explanations and model answers are original text. No ISO or IEC text, requirement wording, control titles in full or definitions are reproduced; you need the official standards to implement or audit an ISMS. Editions change: check the current edition on iso.org before you rely on this test, and update the questions when an edition changes. Pass marks and times are Example values. Passing this test does not certify a person or an organisation; certification decisions belong to accredited certification bodies. Template licence: MIT.