ISMS Self-Test Template (68 ISO/IEC 27001 Questions with Answer Key)

64 multiple-choice and scenario questions in 9 sections plus 4 open scenarios, pass marks, separate answer key with explanations, results log

ISMS・ISO/IEC 27001フルISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10 and Annex A (cited only); ISO/IEC 17021-1:2015; ISO/IEC 27006-1:2024self test更新 2026/11/01

エディタで開く.mdをダウンロード

使い方: Use it at the end of a learning track, before someone takes an ISMS role, or as a team refresher before an audit. Fill the pass marks and the results log first, and keep the answer key separate when scoring. The main pitfall is using the score as the only evidence of competence.

プレビュー

ISMS Self-Test: [Organization name]

A self-test of 68 questions on information security management systems (ISMS) under ISO/IEC 27001:2022 + Amd 1:2024: 64 multiple-choice questions, many of them short scenarios, in nine topic sections, plus four open scenario questions. A separate answer key explains every answer and points to the clause and the learning module to revisit. It supports the evaluation of competence and awareness (clauses 7.2 and 7.3) and is the final check of isms/isms-learning-path. All questions are original; no ISO text is reproduced. Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	LRN-ISMS-08
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@isms-manager]
Approvers/reviewers	[@ciso], [@internal-audit-lead]
Last updated	YYYY-MM-DD
Classification	[Internal; answer key Restricted while the test is used for assessment]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024; certification context ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024
Questions	64 multiple choice (scored), 4 open scenario (mentor-marked)
Linked learning path	LRN-ISMS-01
Next scheduled review	YYYY-MM-DD

Approvals

Role	Name	Decision	Date
ISMS manager	[@isms-manager]	[Prepared]	YYYY-MM-DD
CISO or security lead	[@ciso]	[Approved / Approved with changes]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	2026-11-01	[@isms-manager]	First version, 64 multiple-choice and 4 open questions
1.1 (Example)	YYYY-MM-DD	[@isms-manager]	Q22 reworded after item analysis showed it was ambiguous

Purpose and instructions
Scoring and pass marks
Section A: family and fundamentals
Section B: context and leadership (clauses 4 and 5)
Section C: planning and risk (clause 6)
Section D: support (clause 7)
Section E: operation (clause 8)
Section F: performance evaluation (clause 9)
Section G: improvement (clause 10)
Section H: Annex A controls
Section I: certification
Section J: open scenario questions
Answer key
Results log
Size tiers: running the test
Records and evidence
References

1. Purpose and instructions

Instructions for learners:

Answer without notes, the standard or other help. The test checks what you can apply from memory, as you would in an audit interview.
For multiple-choice questions, choose one answer: the best one. Some wrong options are partly true; pick the most complete and accurate.
Allow about 90 minutes for sections A to I and 30 minutes for section J (Example times).
The fictional organisations in scenarios are:
- Quillmere Analytics Ltd: B2B SaaS analytics platform, 46 staff (38 employees, 8 contractors), one office plus remote staff, production on one public cloud provider in two regions, processor of customer personal data, part-time ISMS manager (0.5 FTE).
- Quillmere Health Systems: clinical scheduling software and managed service, 320 staff, two offices and one colocation suite, processor for hospitals and controller for its own staff and marketing data, a full-time ISMS manager plus a 3-person security team.
- Quillmere Group: manufacturing and services, 2,400 staff, 6 sites in 4 countries, OT and IT, already certified to ISO 9001 and ISO 22301, CISO with a 14-person security office.
The risk scale used in this library: likelihood 1 to 5 times impact 1 to 5, score 1 to 25; bands Low 1-4, Medium 5-9, High 10-16, Critical 17 to 25 (in practice 20 and 25). Default acceptance: Low by the risk owner; Medium by the risk owner plus the department head; High by top management with a treatment decision; Critical not without treatment unless top management records a decision.

2. Scoring and pass marks

Each multiple-choice question scores 1 point: 64 points in total. Open scenario questions in section J are marked by a mentor as "meets" or "does not meet" using the model answers.

Use	Pass mark (Example)	How it is computed
T3 ISMS manager and T4 internal auditor	80% overall	52 of 64 (80% of 64 is 51.2, rounded up) and at least 3 of 4 open questions "meets"
T2 control owner	70% on sections relevant to their controls	For example sections D, E and H: 6 + 5 + 8 = 19 questions, pass at 14 (70% of 19 is 13.3, rounded up)
T5 risk owner	70% on section C	7 of 10
Team refresher before an audit	No pass mark	Review wrong answers as a group

Section	Topic	Questions	Points
A	Family and fundamentals	Q01 to Q08	8
B	Context and leadership	Q09 to Q16	8
C	Planning and risk	Q17 to Q26	10
D	Support	Q27 to Q32	6
E	Operation	Q33 to Q37	5
F	Performance evaluation	Q38 to Q45	8
G	Improvement	Q46 to Q50	5
H	Annex A controls	Q51 to Q58	8
I	Certification	Q59 to Q64	6
	Total		64

3. Section A: family and fundamentals

Q01. Which standard contains the requirements an organisation's ISMS is certified against?

A. ISO/IEC 27000:2026
B. ISO/IEC 27002:2022
C. ISO/IEC 27001:2022 + Amd 1:2024
D. ISO/IEC 27005:2022

Q02. How is Annex A of ISO/IEC 27001:2022 organised?

A. 114 controls in 14 domains
B. 93 controls in 4 themes
C. 93 controls in 14 themes
D. 37 controls in 4 themes

Q03. What did Amendment 1:2024 add to ISO/IEC 27001:2022?

A. New Annex A controls for environmental protection
B. A requirement to publish a carbon footprint report
C. A new clause 11 on sustainability
D. A requirement to determine whether climate change is a relevant issue, and a note that interested parties can have climate-related requirements

Q04. An employee e-mails a full customer list to a personal e-mail address. Which information security property is mainly affected?

A. Confidentiality
B. Integrity
C. Availability
D. Accountability

Q05. Which description best fits ISO/IEC 27002:2022?

A. Requirements an organisation is certified against
B. Requirements for certification bodies
C. Guidance on implementing information security controls, with attributes to group them
D. Requirements for privacy information management

Q06. Who makes the decision to grant ISO/IEC 27001 certification?

A. The lead auditor, at the closing meeting
B. The accreditation body
C. The organisation's ISMS manager
D. The certification body, through people who did not conduct the audit

Q07. What is the status of certificates issued against ISO/IEC 27001:2013?

A. They remain valid until 2027
B. They expired at the end of the transition period, 2025-10-31
C. They were converted automatically to the 2022 edition
D. They stay valid while surveillance audits continue

Q08. Which edition of ISO/IEC 27701 is a stand-alone, certifiable privacy management system standard?

A. ISO/IEC 27701:2025
B. ISO/IEC 27701:2019
C. ISO/IEC 27701:2022
D. None; ISO/IEC 27701 can only be used as an extension of ISO/IEC 27001

4. Section B: context and leadership (clauses 4 and 5)

Q09. Under clause 4, which item must be kept as documented information?

A. The list of internal and external issues
B. The list of interested parties
C. The scope of the ISMS
D. The process map

Q10. Scenario. Quillmere Analytics Ltd runs its production platform on one public cloud provider in two regions. Its scope statement covers "the company and the analytics platform" and says nothing about the cloud provider. What is the auditor most likely to question?

A. Nothing: the cloud provider is outside the scope
B. Whether interfaces and dependencies with the cloud provider were considered when setting the scope
C. Why the cloud provider itself is not certified by Quillmere's certification body
D. Why A.5.23 has not been excluded from the Statement of Applicability

Q11. Which requirement was added to clause 4.2 in the 2022 edition?

A. Survey every interested party once a year
B. Publish the list of interested parties
C. List every customer by name
D. Decide openly which stakeholder expectations the ISMS will take on

Q12. Which two commitments must the information security policy contain?

A. To meet the obligations that apply, and to keep making the ISMS better
B. To prevent all incidents, and to achieve certification
C. To buy approved tools, and to train every manager
D. To report to the certification body, and to publish the risk register

Q13. Clause 5.3 asks top management to assign responsibility and authority for which two things?

A. Purchasing security tools and approving budgets
B. Approving firewall changes and access requests
C. Keeping the ISMS in line with the standard, and telling leadership how the ISMS is doing
D. Hiring auditors and selecting the certification body

Q14. Scenario. The chief executive of Quillmere Health Systems says: "Security is the IT team's job. I don't attend ISMS reviews." Which clause is most at risk?

A. 7.5 Documented information
B. 5.1 Leadership and commitment
C. 8.3 Information security risk treatment
D. 10.1 Continual improvement

Q15. Which response best meets the climate change addition in clause 4.1?

A. Ignore it, because it is only a note
B. Add a new control to the Statement of Applicability
C. Buy carbon offsets for the data centre
D. Record a decision on whether climate change is a relevant issue for the ISMS, with the reasoning

Q16. Which clause treats the ISMS as a set of connected processes, including how they hand work to each other?

A. 4.4
B. 7.4
C. 9.3
D. 10.2

5. Section C: planning and risk (clause 6)

Q17. A risk is rated likelihood 4 and impact 4 on the library scale. What is its score and band?

A. 8, Medium
B. 16, Critical
C. 16, High
D. 20, Critical

Q18. Under the library's default acceptance rules, who may accept a risk with a score of 6?

A. Only the board
B. The risk owner together with the department head
C. Any employee who identifies it
D. The certification body

Q19. A risk scores 20 on the library scale. Which statement is correct?

A. It is Critical and cannot be accepted without treatment, except by a documented top management decision
B. It is High and the risk owner may accept it
C. It is Medium and may be retained
D. It must always be transferred to an insurer

Q20. Clause 6.1.2 requires the risk assessment process to produce results that are:

A. Identical every year
B. Approved by the certification body
C. Expressed in money
D. Repeatable, so two assessments of the same risk reach a comparable answer

Q21. Which item is not required content of the Statement of Applicability?

A. The necessary controls
B. The justification for including each control
C. Whether each control is implemented
D. The purchase cost of each control

Q22. Scenario. Quillmere Analytics Ltd's Statement of Applicability marks A.8.30 (outsourced development) as "Not applicable: not needed", with no other reason. During the audit, the auditor learns that a contractor builds the mobile app. How is this most likely to be treated?

A. Acceptable, because Annex A is a reference list
B. An opportunity for improvement only
C. A nonconformity: the exclusion is not justified and contradicts what happens in practice
D. No issue, because contractors are outside the ISMS

Q23. Under clause 6.1.3, who approves the risk treatment plan and accepts the residual information security risks?

A. The risk owners
B. The internal auditor
C. The certification body
D. Every member of staff

Q24. Which of these is a measurable information security objective?

A. Improve our security culture
B. Reduce the time to remove leavers' access to under 24 hours by 2027-06-30
C. Be secure at all times
D. Comply with ISO/IEC 27001

Q25. What does clause 6.3 (planning of changes) require?

A. A documented change plan for every IT change
B. Nothing new: it was already in the 2013 edition
C. Changes to the ISMS are carried out in a planned way; there is no explicit documented information requirement
D. Notification of the certification body before any change

Q26. Which of these is not a risk treatment option?

A. Reduce the risk with controls
B. Avoid the risk by stopping the activity
C. Share the risk, for example through insurance or a contract
D. Ignore the risk without any record or decision

6. Section D: support (clause 7)

Q27. What documented information does clause 7.2 explicitly require?

A. Evidence of competence
B. A CV for every employee
C. The annual training budget
D. Certificates issued by the certification body

Q28. Which item is not something people must be aware of under clause 7.3?

A. The information security policy
B. How their own work helps the ISMS succeed
C. The source code of the security monitoring tools
D. The consequences of ignoring ISMS rules

Q29. What must the organisation determine for communication under clause 7.4?

A. Only the content of press releases
B. The message, its timing, the audience and the channel
C. Only incident notifications to authorities
D. Only reports to the board

Q30. Scenario. Engineers at Quillmere Health Systems work from a copy of the access control policy downloaded two years ago. The approved version has changed twice since. Which clause is most directly involved?

A. 7.5.3 Control of documented information
B. 9.3 Management review
C. 6.2 Objectives
D. 8.3 Risk treatment

Q31. How should documents of external origin, such as the security schedule of a customer contract, be handled?

A. Ignored, because the organisation did not write them
B. Copied word for word into the information security policy
C. Published on the website
D. Tracked and kept under suitable control, like internal documents

Q32. What is the main difference between a document and a record?

A. There is no difference
B. A document describes how things are done and is revised; a record proves what happened and should not be altered afterwards
C. A record is a draft document
D. Documents must be on paper

7. Section E: operation (clause 8)

Q33. When does clause 8.2 require information security risk assessments to be performed?

A. Only before the certification audit
B. Every month
C. On a set schedule, and again whenever something big changes or is about to
D. Only after an incident

Q34. Scenario. Quillmere Health Systems moved its scheduling service into a new colocation suite three months ago. The risk register was last updated 14 months ago; the planned interval is 12 months. How is this most likely to be treated?

A. Conforming, because the move was an IT project
B. A likely nonconformity: the planned interval was missed and a significant change was not assessed
C. An observation only, because the risk register exists
D. A matter for clause 10.1 only

Q35. What does clause 8.1 expect for externally provided processes, products or services relevant to the ISMS?

A. Nothing: they are the supplier's problem
B. They must be brought in-house
C. The supplier must hold its own ISO/IEC 27001 certificate
D. The organisation keeps them under its own control

Q36. What does clause 8.3 require?

A. Implement the risk treatment plan and keep the results
B. Buy cyber insurance
C. Run an annual penetration test
D. Notify the certification body of each treatment action

Q37. Which is the best evidence that a quarterly access review control operates?

A. A policy statement that access is reviewed quarterly
B. A manager's verbal assurance
C. Dated review records showing decisions taken and access removed
D. The access management tool's product brochure

8. Section F: performance evaluation (clause 9)

Q38. Clause 9.1 asks the organisation to determine all of the following except:

A. Which things to track
B. How the tracking and the review of results will be done
C. Who reviews the results, and on what schedule
D. The salary band of the internal auditor

Q39. What does objectivity and impartiality of internal auditors mean in practice?

A. Internal auditors must always be external consultants
B. Auditors do not audit their own work
C. The ISMS manager audits every process personally
D. No internal audits are held in the first year

Q40. Which factors should the internal audit programme take into account?

A. How much each process matters, and what earlier audits found
B. Only the areas that are cheapest to audit
C. Only Annex A controls
D. Only IT systems

Q41. Which of these is a required management review input?

A. The company's share price
B. The marketing plan
C. Changes in the needs and expectations of interested parties
D. The annual sales forecast

Q42. Which outputs of the management review must be recorded?

A. A new corporate logo
B. The full internal audit report
C. The complete risk register
D. What leadership decided to improve or change in the ISMS

Q43. Scenario. Quillmere Analytics Ltd has no one who can audit the ISMS without auditing their own work, so it engages an independent auditor for its internal audit. Is this acceptable?

A. No: internal audits must be done by employees
B. Yes, if the auditor is competent and objective, and Quillmere manages the programme and acts on the results
C. Only for organisations with more than 500 staff
D. Only with prior approval from the certification body

Q44. What is the difference between monitoring and measurement?

A. Monitoring tracks how something is doing over time; measurement puts a number on it using a defined method
B. There is no difference
C. Measurement may only be done by the certification body
D. Monitoring is only done quarterly

Q45. In common certification body practice (not a clause), what is usually expected before the Stage 2 audit?

A. Three full years of records
B. A risk register with no High or Critical risks
C. At least one full internal audit and one management review completed
D. A penetration test certificate

9. Section G: improvement (clause 10)

Q46. What is the difference between a correction and a corrective action?

A. They are the same thing
B. A correction fixes the specific problem; a corrective action removes its cause so it does not recur
C. A corrective action is always quicker
D. A correction requires a root cause analysis

Q47. Scenario. An internal audit at Quillmere Group finds three leaver accounts still active 20 days after the leavers' departure. The policy requires removal within 1 business day. The operations team disables the three accounts and closes the finding the same day. What is missing?

A. Nothing: the accounts are disabled
B. Notification of the certification body
C. A new information security policy
D. Cause analysis, a check for similar cases, a corrective action and a later effectiveness review

Q48. What documented information does clause 10.2 require?

A. The nature of the nonconformities, the actions taken and the results of corrective actions
B. Only the names of the auditors
C. Nothing
D. Only records of major nonconformities

Q49. In ISO/IEC 27001:2022, which sub-clause covers continual improvement?

A. 10.2
B. 9.4
C. 10.1
D. 10.3

Q50. What is an opportunity for improvement?

A. Another name for a nonconformity
B. A point where requirements are met but the ISMS could work better
C. A major finding that blocks certification
D. A reason to suspend the certificate

10. Section H: Annex A controls

Q51. Which control is new in the 2022 edition of Annex A?

A. A.5.15 access control rules
B. A.8.13 information backup
C. A.6.1 screening
D. A.5.7 threat intelligence

Q52. How many controls are in the technological theme (A.8)?

A. 34
B. 37
C. 14
D. 8

Q53. Which control covers data masking?

A. A.5.12
B. A.7.7
C. A.8.11
D. A.8.24

Q54. Which of these is a people control?

A. A.8.20 network security
B. A.6.7 remote working
C. A.7.4 physical security monitoring
D. A.5.23 cloud services

Q55. What is the status of Annex A controls?

A. A reference list used to check that no necessary control is missed; every exclusion needs a justification in the Statement of Applicability
B. All 93 are mandatory for every organisation
C. Optional, with no need to record a decision
D. Only for organisations above 500 staff

Q56. Scenario. Quillmere Analytics Ltd hosts all production in the cloud and has no server room. Its office has network switches and Wi-Fi access points. How should it decide on A.7.11 (supporting utilities)?

A. Exclude it automatically with the reason "cloud"
B. Implement backup generators at the office
C. Leave it out of the Statement of Applicability
D. Decide from the risk assessment: the provider covers its data centres (assured under A.5.23), office utilities may still matter for office network equipment, and the decision is justified either way

Q57. Which values belong to the "cybersecurity concepts" attribute in ISO/IEC 27002:2022?

A. Plan, do, check, act
B. Confidentiality, integrity, availability
C. Identify, Protect, Detect, Respond, Recover
D. Preventive, detective, corrective

Q58. Which control covers configuration management?

A. A.8.32
B. A.8.9
C. A.5.37
D. A.8.19

11. Section I: certification

Q59. What is the main purpose of the Stage 1 audit?

A. Review documentation, readiness and scope, and plan Stage 2
B. Sample control operation across all sites for effectiveness
C. Issue the certificate
D. Carry out the first surveillance

Q60. When is the first surveillance audit after initial certification due?

A. Exactly 6 months after Stage 2
B. Any time within the three-year cycle
C. 36 months after the certification decision
D. No later than 12 months from the certification decision date

Q61. How long is a certification cycle?

A. One year
B. Three years
C. Five years
D. Unlimited while fees are paid

Q62. Who sets the audit time, and on what basis?

A. The organisation, based on its budget
B. The accreditation body, separately for each client
C. The certification body, applying ISO/IEC 27006-1 (persons doing work under the organisation's control, complexity factors)
D. A fixed five days for every organisation

Q63. Scenario. Quillmere Group asks whether the certification body must audit every one of its six sites. Which answer is best?

A. Yes, every site must be audited in every audit
B. Sampling of sites may be possible under ISO/IEC 27006-1 and IAF MD 1 (now Global ACI-TECH-3-001) when the conditions are met; the certification body decides
C. Only one site is ever audited
D. Sampling is only allowed when all sites are in one country

Q64. What should an organisation check first when choosing a certification body?

A. That it is accredited for ISO/IEC 27001 by an accreditation body that is a signatory of the Global ACI MRA (formerly the IAF MLA), checked in the IAF CertSearch database
B. That it is the cheapest offer
C. That it will also implement the ISMS for you as a consultant
D. That it guarantees a pass

12. Section J: open scenario questions

Q65. Scenario. At Quillmere Analytics Ltd, the risk "customer data exposed through a misconfigured storage bucket" is rated likelihood 3 and impact 4 before treatment. After configuration scanning and an approval step for public access are added, likelihood falls to 2 and impact stays at 4. State the score and band before and after treatment, and say who may accept the residual risk.

Q66. Scenario. The draft management review agenda at Quillmere Health Systems has three items: status of actions from the previous review, internal audit results, and status of the risk treatment plan. List the required inputs that are missing.

Q67. Scenario. Quillmere Group plans to certify its ISMS in phases, starting with headquarters and the data centre. Explain two things the scope statement must address for the first phase, given that the plants and the service centre are outside it.

Q68. Write one audit finding, in the format requirement, evidence and gap, for this observation: in a sample of 10 leavers from the last quarter, 3 still had active accounts 20 days after their departure, while the access control policy requires removal within 1 business day.

13. Answer key

13.1 Section A

Q	Answer	Explanation	Revisit
Q01	C	ISO/IEC 27001 is the requirements standard; 27000 is the overview, 27002 and 27005 are guidance	M0, `isms/iso-27000-family-map`
Q02	B	93 controls: A.5 organizational 37, A.6 people 8, A.7 physical 14, A.8 technological 34. The 114 and 14 figures belong to the 2013 edition	M1
Q03	D	Amd 1:2024 added the climate change decision in 4.1 and a note in 4.2; Annex A did not change	M0, clause 4.1
Q04	A	Sending data to an unauthorised destination is a loss of confidentiality	M1, `isms/isms-glossary`
Q05	C	ISO/IEC 27002:2022 gives control guidance and five attributes; it is not certifiable	M0
Q06	D	The certification body decides, through people independent of the audit team (ISO/IEC 17021-1:2015)	M10
Q07	B	The transition ended on 2025-10-31; every valid certificate now refers to the 2022 edition	M0
Q08	A	ISO/IEC 27701:2025 replaced the 2019 extension and is stand-alone and certifiable	M0

13.2 Section B

Q	Answer	Explanation	Revisit
Q09	C	Clause 4.3 requires the scope as documented information; issues and interested parties are expected in practice but not explicitly required to be documented	M3
Q10	B	Under clause 4.3 the scope has to make sense of what you rely on outside it, such as a cloud provider	M3, `compliance/ms-scope`
Q11	D	The 2022 edition added the decision on which requirements the ISMS addresses	M3
Q12	A	Clause 5.2 needs the policy to promise both: meeting your obligations and improving the ISMS over time	M3
Q13	C	Clause 5.3 names those two responsibilities; tool purchase and firewall approvals are operational	M3, `isms/isms-roles-raci`
Q14	B	Clause 5.1 makes top management accountable and expects active involvement	M3
Q15	D	A recorded decision with reasons meets the intent; the amendment does not require a control or offsets	M3
Q16	A	Clause 4.4 covers the ISMS, its processes and their interactions	M3, `isms/isms-process-map`

13.3 Section C

Q	Answer	Explanation	Revisit
Q17	C	4 times 4 is 16, which falls in the High band (10-16)	M4
Q18	B	A score of 6 is Medium (5-9); under the default rules the risk owner accepts it together with the department head (`compliance/risk-methodology` §2.4)	M4, `compliance/risk-methodology`
Q19	A	20 is Critical (17 to 25, in practice 20 and 25); it needs treatment unless top management records a decision	M4
Q20	D	Clause 6.1.2 is about repeatability: different assessors, same rules, comparable answers	M4
Q21	D	The SoA lists necessary controls, justification for inclusion, implementation status and justification for exclusions; cost is not required	M4, `compliance/statement-of-applicability`
Q22	C	An exclusion must be justified and match reality; outsourced development happens, so A.8.30 applies. The certification body grades the finding	M4, M5
Q23	A	Under clause 6.1.3 the people who own the risks sign off the plan and what is left after it	M4, `isms/isms-risk-acceptance-record`
Q24	B	It has a measure, a target and a date; the others cannot be measured	M4, `compliance/objectives-register`
Q25	C	Clause 6.3 is new in 2022 and asks for planned changes, with no explicit documented information requirement	M4, `isms/isms-change-plan`
Q26	D	Retaining a risk is an option only as a recorded decision; ignoring it without a record is not treatment	M4

13.4 Section D

Q	Answer	Explanation	Revisit
Q27	A	Clause 7.2 requires documented evidence of competence	M6, `isms/isms-competence-training-matrix`
Q28	C	Awareness is about knowing the policy, your own part in it and what happens if you ignore it	M6
Q29	B	Clause 7.4 needs a planned message, timing, audience and channel	M6, `isms/isms-communication-plan`
Q30	A	Clause 7.5.3 covers availability of the right version and control of changes	M6, `compliance/controlled-document`
Q31	D	Under clause 7.5.3 outside documents you rely on need tracking and control too	M6
Q32	B	Documents state intent and method; records are evidence and must be protected from change	M6, `isms/isms-glossary`

13.5 Section E

Q	Answer	Explanation	Revisit
Q33	C	Clause 8.2 means a fixed schedule plus a fresh look whenever something big changes	M7
Q34	B	The interval was missed and a significant change was not assessed; the certification body grades the finding	M7, `isms/isms-risk-assessment-report`
Q35	D	Under clause 8.1 outsourcing something does not outsource responsibility for it; supplier certification can help but is not required	M7, `isms/supplier-register`
Q36	A	Clause 8.3 is about doing what the plan promised and keeping proof of the outcome	M7
Q37	C	Dated records of decisions and removals show the control operated; a policy only shows intent	M7, `isms/control-evidence-matrix`

13.6 Section F

Q	Answer	Explanation	Revisit
Q38	D	Clause 9.1 is about deciding what to track, how, when and by whom; salaries have nothing to do with it	M8, `isms/isms-measurement-programme`
Q39	B	Internal auditors need to be free of any stake in what they review; in practice they must not audit their own work	M9
Q40	A	Under clause 9.2.2 audit effort follows what matters most and what went wrong before	M9, `compliance/internal-audit-program`
Q41	C	This input was added in 2022; others include previous actions, issues, performance feedback, risk results and improvement opportunities	M8, `compliance/management-review`
Q42	D	Under clause 9.3.3 the review must end in recorded decisions about improving or changing the ISMS	M8
Q43	B	Internal audit may be outsourced; the organisation still owns the programme and the follow-up	M9
Q44	A	Monitoring checks status; measurement produces a value by a defined method	M8
Q45	C	Certification bodies usually expect one full internal audit and one management review before Stage 2; this is practice, not a clause	M10, `isms/stage-1-readiness-pack`

13.7 Section G

Q	Answer	Explanation	Revisit
Q46	B	Correction fixes the instance; corrective action removes the cause (clause 10.2)	M9, `compliance/capa-nonconformity`
Q47	D	Under clause 10.2 a fix is not finished until the root cause is found, similar cases are checked, action is taken and someone confirms it worked	M9, `isms/audit-findings-register`
Q48	A	Under clause 10.2 you keep a trail of what went wrong, what you did and whether it worked	M9
Q49	C	The 2022 edition swapped the order: 10.1 continual improvement, 10.2 nonconformity and corrective action	M1
Q50	B	An opportunity for improvement is not a nonconformity; record it and decide whether to act	M9, `isms/continual-improvement-register`

13.8 Section H

Q	Answer	Explanation	Revisit
Q51	D	A.5.7 is one of the 11 new controls; the others listed existed in 2013 in another form	M5, `isms/annex-a-organizational-controls-guide`
Q52	A	A.8 has 34 controls, A.8.1 to A.8.34	M5
Q53	C	A.8.11 data masking is new in 2022	M5, `isms/data-masking-dlp-standard`
Q54	B	A.6 is the people theme; A.6.7 covers remote working	M5, `isms/annex-a-people-physical-controls-guide`
Q55	A	Clause 6.1.3 uses Annex A as a check list; the SoA records each decision	M5
Q56	D	Applicability follows risk and scope; cloud hosting does not remove office equipment, and either decision needs a reason	M5
Q57	C	The cybersecurity concepts attribute uses Identify, Protect, Detect, Respond and Recover; preventive, detective and corrective are control type values	M5
Q58	B	A.8.9 configuration management is new in 2022; A.8.32 is change management	M5, `isms/secure-configuration-baseline`

13.9 Section I

Q	Answer	Explanation	Revisit
Q59	A	Stage 1 reviews documents, readiness and scope and plans Stage 2; Stage 2 checks implementation and effectiveness	M10, `isms/certification-audit-explained`
Q60	D	The first surveillance is due no later than 12 months from the certification decision date	M10, `isms/certification-cycle-plan`
Q61	B	The cycle is three years: initial certification, surveillance each calendar year, recertification before expiry	M10
Q62	C	The certification body sets audit time using ISO/IEC 27006-1:2024; any day count you see in a template is an example	M10, `isms/certification-body-selection`
Q63	B	ISO/IEC 27006-1 and IAF MD 1:2023 (re-issued by Global ACI as Global ACI-TECH-3-001) allow sampling of sites under conditions; the certification body decides	M10, `isms/scope-extension-multisite-plan`
Q64	A	Accreditation by a Global ACI MRA (formerly IAF MLA) signatory gives wide recognition; a body that also consults on your ISMS has an impartiality conflict	M10

13.10 Section J model answers

Q	Model answer	Meets if
Q65	Before treatment: 3 times 4 = 12, High. After treatment: 2 times 4 = 8, Medium. Under the default rules the Medium residual risk is accepted by the risk owner together with the department head; record the acceptance with date and review date in DOC-ISMS-019.	Both scores and bands are correct and the right acceptors (risk owner plus department head) are named
Q66	Missing: changes in external and internal issues; changes in the needs and expectations of interested parties; feedback on performance, including nonconformities and corrective actions, monitoring and measurement results and fulfilment of objectives; feedback from interested parties; results of risk assessment (the agenda has treatment status only); opportunities for continual improvement.	At least five of the six missing inputs are named
Q67	(1) Interfaces and dependencies: the out-of-scope plants and service centre exchange information with HQ and the data centre, so the scope must describe those interfaces and how in-scope information is protected when it crosses them. (2) Shared services: group functions (identity, network, HR) that serve all sites must be either in scope or treated as externally provided processes controlled under 8.1. A good answer also mentions the phased plan in DOC-ISMS-095.	Both interfaces and shared services are addressed
Q68	Requirement: the access control policy (DOC-ISMS-041) requires leavers' accounts to be removed within 1 business day; clause 8.1 and control A.5.18. Evidence: 3 of 10 leavers sampled for the last quarter had active accounts 20 days after leaving. Gap: the removal step is not performed as required, so former staff could still access information.	All three parts present, evidence is specific and verifiable

14. Results log

Result ID	Learner	Track	Version	Date	Score (of 64)	Open questions met (of 4)	Result	Sections to revisit	Marked by
TEST-001 (Example)	[@isms-manager]	T3	1.0	2027-03-10	55	4	Pass (55 is at least 52)	H	[@ciso]
TEST-002 (Example)	[@quality-auditor]	T4	1.0	2027-03-12	49	3	Not yet (49 is below 52)	C, G	[@audit-programme-manager]
TEST-003 (Example)	[@quality-auditor]	T4	1.0	2027-03-26	54	4	Pass on second attempt	None	[@audit-programme-manager]
[TEST-NNN]	[@learner]	[T1 to T5]	[version]	YYYY-MM-DD	[n]	[n]	[Pass / Not yet]	[sections]	[@marker]

15. Size tiers: running the test

The library's working tiers are small (under 50 people), medium (50 to 500) and large or multi-site (over 500 or several sites).

Aspect	Small: Quillmere Analytics Ltd	Medium: Quillmere Health Systems	Large: Quillmere Group
Who takes it (Example)	The part-time ISMS manager (full test) and 4 control owners (sections D, E, H)	ISMS manager and 3-person security team (full test), 2 internal auditors (full test), control owners (relevant sections)	Security office leads (full test), 6 site coordinators (relevant sections), audit pool of 8 (full test)
Format	Self-marked, with an external mentor checking section J	Marked by the ISMS manager; results reviewed at the steering committee	Run in cohorts per site wave on the learning platform; item analysis after each cohort
Adaptation	Add two questions on the cloud provider's shared responsibility model	Add questions on processor and controller duties and on the colocation suite	Translate for sites in 4 countries; add OT questions; keep the same answer key per language version
Use of results	Shows the 0.5 FTE manager is ready before Stage 1	Feeds the competence matrix for audit roles	Gate for joining the internal audit pool and for site coordinator roles

When you add organisation-specific questions, number them after Q68 so that results for Q01 to Q68 stay comparable across versions.

16. Records and evidence

Record	Proves	Kept by	Where	Retention (Example)
Results log (section 14)	Knowledge was evaluated with a defined pass mark (7.2)	ISMS manager	[Learning system or ISMS workspace]	Employment plus 2 years
Marked answer sheets for section J	Application of knowledge was checked by a mentor	Mentor, filed by ISMS manager	[Training folder]	Until next competence review
Test version history	Scores are compared only within a version	ISMS manager	[Document system]	Current plus previous 3 versions
Competence and training matrix (DOC-ISMS-026)	Role competence is met and evidenced	ISMS manager with HR	[HR system or ISMS workspace]	Current plus previous 3 years

Map these records in isms/control-evidence-matrix (DOC-ISMS-033) under clause 7.2, clause 7.3 and control A.6.3.

17. References

Standard	Edition	Link
ISO/IEC 27001	2022 + Amd 1:2024	https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html
ISO/IEC 27000	2026	https://www.iso.org/standard/84257.html
ISO/IEC 27002	2022	https://www.iso.org/standard/75652.html
ISO/IEC 27005	2022	https://www.iso.org/standard/80585.html
ISO/IEC 27006-1	2024	https://www.iso.org/standard/82908.html
ISO/IEC 17021-1	2015	https://www.iso.org/standard/61651.html
ISO/IEC 27701	2025	https://www.iso.org/standard/85819.html
ISO 19011	2026	https://www.iso.org/standard/88984.html

IAF MD 1:2023 (multi-site certification) has been re-issued by Global Accreditation Cooperation Incorporated (Global ACI), which replaced IAF and ILAC on 2026-01-01, as Global ACI-TECH-3-001; check the current issue on the Global ACI website.

Related templates: isms/isms-learning-path, isms/isms-glossary, isms/iso-27001-clauses-explained, isms/certification-audit-explained, isms/isms-worked-walkthrough, isms/isms-competence-training-matrix, compliance/risk-methodology.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10 and Annex A, with certification questions based on ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. All questions, options, scenarios, explanations and model answers are original text. No ISO or IEC text, requirement wording, control titles in full or definitions are reproduced; you need the official standards to implement or audit an ISMS. Editions change: check the current edition on iso.org before you rely on this test, and update the questions when an edition changes. Pass marks and times are Example values. Passing this test does not certify a person or an organisation; certification decisions belong to accredited certification bodies. Template licence: MIT.