# ISMS Self-Test: [Organization name] > A self-test of 68 questions on information security management systems > (ISMS) under ISO/IEC 27001:2022 + Amd 1:2024: 64 multiple-choice > questions, many of them short scenarios, in nine topic sections, plus > four open scenario questions. A separate answer key explains every answer > and points to the clause and the learning module to revisit. It supports > the evaluation of competence and awareness (clauses 7.2 and 7.3) and is > the final check of `isms/isms-learning-path`. All questions are original; > no ISO text is reproduced. Replace every `[bracketed]` value and every > row marked *Example*. ## Document control | Field | Value | |---|---| | Document ID | LRN-ISMS-08 | | Version | [1.0] | | Status | [Draft / In review / Approved / Superseded] | | Owner | [@isms-manager] | | Approvers/reviewers | [@ciso], [@internal-audit-lead] | | Last updated | YYYY-MM-DD | | Classification | [Internal; answer key Restricted while the test is used for assessment] | | Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; certification context ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 | | Questions | 64 multiple choice (scored), 4 open scenario (mentor-marked) | | Linked learning path | LRN-ISMS-01 | | Next scheduled review | YYYY-MM-DD | ### Approvals | Role | Name | Decision | Date | |---|---|---|---| | ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD | | CISO or security lead | [@ciso] | [Approved / Approved with changes] | YYYY-MM-DD | ### Revision history | Version | Date | Author | Change | |---|---|---|---| | 1.0 *(Example)* | 2026-11-01 | [@isms-manager] | First version, 64 multiple-choice and 4 open questions | | 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Q22 reworded after item analysis showed it was ambiguous | ## Contents 1. Purpose and instructions 2. Scoring and pass marks 3. Section A: family and fundamentals 4. Section B: context and leadership (clauses 4 and 5) 5. Section C: planning and risk (clause 6) 6. Section D: support (clause 7) 7. Section E: operation (clause 8) 8. Section F: performance evaluation (clause 9) 9. Section G: improvement (clause 10) 10. Section H: Annex A controls 11. Section I: certification 12. Section J: open scenario questions 13. Answer key 14. Results log 15. Size tiers: running the test 16. Records and evidence 17. References ## 1. Purpose and instructions Instructions for learners: 1. Answer without notes, the standard or other help. The test checks what you can apply from memory, as you would in an audit interview. 2. For multiple-choice questions, choose **one** answer: the best one. Some wrong options are partly true; pick the most complete and accurate. 3. Allow about 90 minutes for sections A to I and 30 minutes for section J (*Example* times). 4. The fictional organisations in scenarios are: - **Quillmere Analytics Ltd**: B2B SaaS analytics platform, 46 staff (38 employees, 8 contractors), one office plus remote staff, production on one public cloud provider in two regions, processor of customer personal data, part-time ISMS manager (0.5 FTE). - **Quillmere Health Systems**: clinical scheduling software and managed service, 320 staff, two offices and one colocation suite, processor for hospitals and controller for its own staff and marketing data, a full-time ISMS manager plus a 3-person security team. - **Quillmere Group**: manufacturing and services, 2,400 staff, 6 sites in 4 countries, OT and IT, already certified to ISO 9001 and ISO 22301, CISO with a 14-person security office. 5. The risk scale used in this library: likelihood 1 to 5 times impact 1 to 5, score 1 to 25; bands Low 1-4, Medium 5-9, High 10-16, Critical 17 to 25 (in practice 20 and 25). Default acceptance: Low by the risk owner; Medium by the risk owner plus the department head; High by top management with a treatment decision; Critical not without treatment unless top management records a decision. ## 2. Scoring and pass marks Each multiple-choice question scores 1 point: 64 points in total. Open scenario questions in section J are marked by a mentor as "meets" or "does not meet" using the model answers. | Use | Pass mark *(Example)* | How it is computed | |---|---|---| | T3 ISMS manager and T4 internal auditor | 80% overall | 52 of 64 (80% of 64 is 51.2, rounded up) and at least 3 of 4 open questions "meets" | | T2 control owner | 70% on sections relevant to their controls | For example sections D, E and H: 6 + 5 + 8 = 19 questions, pass at 14 (70% of 19 is 13.3, rounded up) | | T5 risk owner | 70% on section C | 7 of 10 | | Team refresher before an audit | No pass mark | Review wrong answers as a group | | Section | Topic | Questions | Points | |---|---|---|---| | A | Family and fundamentals | Q01 to Q08 | 8 | | B | Context and leadership | Q09 to Q16 | 8 | | C | Planning and risk | Q17 to Q26 | 10 | | D | Support | Q27 to Q32 | 6 | | E | Operation | Q33 to Q37 | 5 | | F | Performance evaluation | Q38 to Q45 | 8 | | G | Improvement | Q46 to Q50 | 5 | | H | Annex A controls | Q51 to Q58 | 8 | | I | Certification | Q59 to Q64 | 6 | | | **Total** | | **64** | ## 3. Section A: family and fundamentals **Q01.** Which standard contains the requirements an organisation's ISMS is certified against? - A. ISO/IEC 27000:2026 - B. ISO/IEC 27002:2022 - C. ISO/IEC 27001:2022 + Amd 1:2024 - D. ISO/IEC 27005:2022 **Q02.** How is Annex A of ISO/IEC 27001:2022 organised? - A. 114 controls in 14 domains - B. 93 controls in 4 themes - C. 93 controls in 14 themes - D. 37 controls in 4 themes **Q03.** What did Amendment 1:2024 add to ISO/IEC 27001:2022? - A. New Annex A controls for environmental protection - B. A requirement to publish a carbon footprint report - C. A new clause 11 on sustainability - D. A requirement to determine whether climate change is a relevant issue, and a note that interested parties can have climate-related requirements **Q04.** An employee e-mails a full customer list to a personal e-mail address. Which information security property is mainly affected? - A. Confidentiality - B. Integrity - C. Availability - D. Accountability **Q05.** Which description best fits ISO/IEC 27002:2022? - A. Requirements an organisation is certified against - B. Requirements for certification bodies - C. Guidance on implementing information security controls, with attributes to group them - D. Requirements for privacy information management **Q06.** Who makes the decision to grant ISO/IEC 27001 certification? - A. The lead auditor, at the closing meeting - B. The accreditation body - C. The organisation's ISMS manager - D. The certification body, through people who did not conduct the audit **Q07.** What is the status of certificates issued against ISO/IEC 27001:2013? - A. They remain valid until 2027 - B. They expired at the end of the transition period, 2025-10-31 - C. They were converted automatically to the 2022 edition - D. They stay valid while surveillance audits continue **Q08.** Which edition of ISO/IEC 27701 is a stand-alone, certifiable privacy management system standard? - A. ISO/IEC 27701:2025 - B. ISO/IEC 27701:2019 - C. ISO/IEC 27701:2022 - D. None; ISO/IEC 27701 can only be used as an extension of ISO/IEC 27001 ## 4. Section B: context and leadership (clauses 4 and 5) **Q09.** Under clause 4, which item must be kept as documented information? - A. The list of internal and external issues - B. The list of interested parties - C. The scope of the ISMS - D. The process map **Q10.** *Scenario.* Quillmere Analytics Ltd runs its production platform on one public cloud provider in two regions. Its scope statement covers "the company and the analytics platform" and says nothing about the cloud provider. What is the auditor most likely to question? - A. Nothing: the cloud provider is outside the scope - B. Whether interfaces and dependencies with the cloud provider were considered when setting the scope - C. Why the cloud provider itself is not certified by Quillmere's certification body - D. Why A.5.23 has not been excluded from the Statement of Applicability **Q11.** Which requirement was added to clause 4.2 in the 2022 edition? - A. Survey every interested party once a year - B. Publish the list of interested parties - C. List every customer by name - D. Decide openly which stakeholder expectations the ISMS will take on **Q12.** Which two commitments must the information security policy contain? - A. To meet the obligations that apply, and to keep making the ISMS better - B. To prevent all incidents, and to achieve certification - C. To buy approved tools, and to train every manager - D. To report to the certification body, and to publish the risk register **Q13.** Clause 5.3 asks top management to assign responsibility and authority for which two things? - A. Purchasing security tools and approving budgets - B. Approving firewall changes and access requests - C. Keeping the ISMS in line with the standard, and telling leadership how the ISMS is doing - D. Hiring auditors and selecting the certification body **Q14.** *Scenario.* The chief executive of Quillmere Health Systems says: "Security is the IT team's job. I don't attend ISMS reviews." Which clause is most at risk? - A. 7.5 Documented information - B. 5.1 Leadership and commitment - C. 8.3 Information security risk treatment - D. 10.1 Continual improvement **Q15.** Which response best meets the climate change addition in clause 4.1? - A. Ignore it, because it is only a note - B. Add a new control to the Statement of Applicability - C. Buy carbon offsets for the data centre - D. Record a decision on whether climate change is a relevant issue for the ISMS, with the reasoning **Q16.** Which clause treats the ISMS as a set of connected processes, including how they hand work to each other? - A. 4.4 - B. 7.4 - C. 9.3 - D. 10.2 ## 5. Section C: planning and risk (clause 6) **Q17.** A risk is rated likelihood 4 and impact 4 on the library scale. What is its score and band? - A. 8, Medium - B. 16, Critical - C. 16, High - D. 20, Critical **Q18.** Under the library's default acceptance rules, who may accept a risk with a score of 6? - A. Only the board - B. The risk owner together with the department head - C. Any employee who identifies it - D. The certification body **Q19.** A risk scores 20 on the library scale. Which statement is correct? - A. It is Critical and cannot be accepted without treatment, except by a documented top management decision - B. It is High and the risk owner may accept it - C. It is Medium and may be retained - D. It must always be transferred to an insurer **Q20.** Clause 6.1.2 requires the risk assessment process to produce results that are: - A. Identical every year - B. Approved by the certification body - C. Expressed in money - D. Repeatable, so two assessments of the same risk reach a comparable answer **Q21.** Which item is **not** required content of the Statement of Applicability? - A. The necessary controls - B. The justification for including each control - C. Whether each control is implemented - D. The purchase cost of each control **Q22.** *Scenario.* Quillmere Analytics Ltd's Statement of Applicability marks A.8.30 (outsourced development) as "Not applicable: not needed", with no other reason. During the audit, the auditor learns that a contractor builds the mobile app. How is this most likely to be treated? - A. Acceptable, because Annex A is a reference list - B. An opportunity for improvement only - C. A nonconformity: the exclusion is not justified and contradicts what happens in practice - D. No issue, because contractors are outside the ISMS **Q23.** Under clause 6.1.3, who approves the risk treatment plan and accepts the residual information security risks? - A. The risk owners - B. The internal auditor - C. The certification body - D. Every member of staff **Q24.** Which of these is a measurable information security objective? - A. Improve our security culture - B. Reduce the time to remove leavers' access to under 24 hours by 2027-06-30 - C. Be secure at all times - D. Comply with ISO/IEC 27001 **Q25.** What does clause 6.3 (planning of changes) require? - A. A documented change plan for every IT change - B. Nothing new: it was already in the 2013 edition - C. Changes to the ISMS are carried out in a planned way; there is no explicit documented information requirement - D. Notification of the certification body before any change **Q26.** Which of these is **not** a risk treatment option? - A. Reduce the risk with controls - B. Avoid the risk by stopping the activity - C. Share the risk, for example through insurance or a contract - D. Ignore the risk without any record or decision ## 6. Section D: support (clause 7) **Q27.** What documented information does clause 7.2 explicitly require? - A. Evidence of competence - B. A CV for every employee - C. The annual training budget - D. Certificates issued by the certification body **Q28.** Which item is **not** something people must be aware of under clause 7.3? - A. The information security policy - B. How their own work helps the ISMS succeed - C. The source code of the security monitoring tools - D. The consequences of ignoring ISMS rules **Q29.** What must the organisation determine for communication under clause 7.4? - A. Only the content of press releases - B. The message, its timing, the audience and the channel - C. Only incident notifications to authorities - D. Only reports to the board **Q30.** *Scenario.* Engineers at Quillmere Health Systems work from a copy of the access control policy downloaded two years ago. The approved version has changed twice since. Which clause is most directly involved? - A. 7.5.3 Control of documented information - B. 9.3 Management review - C. 6.2 Objectives - D. 8.3 Risk treatment **Q31.** How should documents of external origin, such as the security schedule of a customer contract, be handled? - A. Ignored, because the organisation did not write them - B. Copied word for word into the information security policy - C. Published on the website - D. Tracked and kept under suitable control, like internal documents **Q32.** What is the main difference between a document and a record? - A. There is no difference - B. A document describes how things are done and is revised; a record proves what happened and should not be altered afterwards - C. A record is a draft document - D. Documents must be on paper ## 7. Section E: operation (clause 8) **Q33.** When does clause 8.2 require information security risk assessments to be performed? - A. Only before the certification audit - B. Every month - C. On a set schedule, and again whenever something big changes or is about to - D. Only after an incident **Q34.** *Scenario.* Quillmere Health Systems moved its scheduling service into a new colocation suite three months ago. The risk register was last updated 14 months ago; the planned interval is 12 months. How is this most likely to be treated? - A. Conforming, because the move was an IT project - B. A likely nonconformity: the planned interval was missed and a significant change was not assessed - C. An observation only, because the risk register exists - D. A matter for clause 10.1 only **Q35.** What does clause 8.1 expect for externally provided processes, products or services relevant to the ISMS? - A. Nothing: they are the supplier's problem - B. They must be brought in-house - C. The supplier must hold its own ISO/IEC 27001 certificate - D. The organisation keeps them under its own control **Q36.** What does clause 8.3 require? - A. Implement the risk treatment plan and keep the results - B. Buy cyber insurance - C. Run an annual penetration test - D. Notify the certification body of each treatment action **Q37.** Which is the best evidence that a quarterly access review control operates? - A. A policy statement that access is reviewed quarterly - B. A manager's verbal assurance - C. Dated review records showing decisions taken and access removed - D. The access management tool's product brochure ## 8. Section F: performance evaluation (clause 9) **Q38.** Clause 9.1 asks the organisation to determine all of the following **except**: - A. Which things to track - B. How the tracking and the review of results will be done - C. Who reviews the results, and on what schedule - D. The salary band of the internal auditor **Q39.** What does objectivity and impartiality of internal auditors mean in practice? - A. Internal auditors must always be external consultants - B. Auditors do not audit their own work - C. The ISMS manager audits every process personally - D. No internal audits are held in the first year **Q40.** Which factors should the internal audit programme take into account? - A. How much each process matters, and what earlier audits found - B. Only the areas that are cheapest to audit - C. Only Annex A controls - D. Only IT systems **Q41.** Which of these is a required management review input? - A. The company's share price - B. The marketing plan - C. Changes in the needs and expectations of interested parties - D. The annual sales forecast **Q42.** Which outputs of the management review must be recorded? - A. A new corporate logo - B. The full internal audit report - C. The complete risk register - D. What leadership decided to improve or change in the ISMS **Q43.** *Scenario.* Quillmere Analytics Ltd has no one who can audit the ISMS without auditing their own work, so it engages an independent auditor for its internal audit. Is this acceptable? - A. No: internal audits must be done by employees - B. Yes, if the auditor is competent and objective, and Quillmere manages the programme and acts on the results - C. Only for organisations with more than 500 staff - D. Only with prior approval from the certification body **Q44.** What is the difference between monitoring and measurement? - A. Monitoring tracks how something is doing over time; measurement puts a number on it using a defined method - B. There is no difference - C. Measurement may only be done by the certification body - D. Monitoring is only done quarterly **Q45.** In common certification body practice (not a clause), what is usually expected before the Stage 2 audit? - A. Three full years of records - B. A risk register with no High or Critical risks - C. At least one full internal audit and one management review completed - D. A penetration test certificate ## 9. Section G: improvement (clause 10) **Q46.** What is the difference between a correction and a corrective action? - A. They are the same thing - B. A correction fixes the specific problem; a corrective action removes its cause so it does not recur - C. A corrective action is always quicker - D. A correction requires a root cause analysis **Q47.** *Scenario.* An internal audit at Quillmere Group finds three leaver accounts still active 20 days after the leavers' departure. The policy requires removal within 1 business day. The operations team disables the three accounts and closes the finding the same day. What is missing? - A. Nothing: the accounts are disabled - B. Notification of the certification body - C. A new information security policy - D. Cause analysis, a check for similar cases, a corrective action and a later effectiveness review **Q48.** What documented information does clause 10.2 require? - A. The nature of the nonconformities, the actions taken and the results of corrective actions - B. Only the names of the auditors - C. Nothing - D. Only records of major nonconformities **Q49.** In ISO/IEC 27001:2022, which sub-clause covers continual improvement? - A. 10.2 - B. 9.4 - C. 10.1 - D. 10.3 **Q50.** What is an opportunity for improvement? - A. Another name for a nonconformity - B. A point where requirements are met but the ISMS could work better - C. A major finding that blocks certification - D. A reason to suspend the certificate ## 10. Section H: Annex A controls **Q51.** Which control is new in the 2022 edition of Annex A? - A. A.5.15 access control rules - B. A.8.13 information backup - C. A.6.1 screening - D. A.5.7 threat intelligence **Q52.** How many controls are in the technological theme (A.8)? - A. 34 - B. 37 - C. 14 - D. 8 **Q53.** Which control covers data masking? - A. A.5.12 - B. A.7.7 - C. A.8.11 - D. A.8.24 **Q54.** Which of these is a people control? - A. A.8.20 network security - B. A.6.7 remote working - C. A.7.4 physical security monitoring - D. A.5.23 cloud services **Q55.** What is the status of Annex A controls? - A. A reference list used to check that no necessary control is missed; every exclusion needs a justification in the Statement of Applicability - B. All 93 are mandatory for every organisation - C. Optional, with no need to record a decision - D. Only for organisations above 500 staff **Q56.** *Scenario.* Quillmere Analytics Ltd hosts all production in the cloud and has no server room. Its office has network switches and Wi-Fi access points. How should it decide on A.7.11 (supporting utilities)? - A. Exclude it automatically with the reason "cloud" - B. Implement backup generators at the office - C. Leave it out of the Statement of Applicability - D. Decide from the risk assessment: the provider covers its data centres (assured under A.5.23), office utilities may still matter for office network equipment, and the decision is justified either way **Q57.** Which values belong to the "cybersecurity concepts" attribute in ISO/IEC 27002:2022? - A. Plan, do, check, act - B. Confidentiality, integrity, availability - C. Identify, Protect, Detect, Respond, Recover - D. Preventive, detective, corrective **Q58.** Which control covers configuration management? - A. A.8.32 - B. A.8.9 - C. A.5.37 - D. A.8.19 ## 11. Section I: certification **Q59.** What is the main purpose of the Stage 1 audit? - A. Review documentation, readiness and scope, and plan Stage 2 - B. Sample control operation across all sites for effectiveness - C. Issue the certificate - D. Carry out the first surveillance **Q60.** When is the first surveillance audit after initial certification due? - A. Exactly 6 months after Stage 2 - B. Any time within the three-year cycle - C. 36 months after the certification decision - D. No later than 12 months from the certification decision date **Q61.** How long is a certification cycle? - A. One year - B. Three years - C. Five years - D. Unlimited while fees are paid **Q62.** Who sets the audit time, and on what basis? - A. The organisation, based on its budget - B. The accreditation body, separately for each client - C. The certification body, applying ISO/IEC 27006-1 (persons doing work under the organisation's control, complexity factors) - D. A fixed five days for every organisation **Q63.** *Scenario.* Quillmere Group asks whether the certification body must audit every one of its six sites. Which answer is best? - A. Yes, every site must be audited in every audit - B. Sampling of sites may be possible under ISO/IEC 27006-1 and IAF MD 1 (now Global ACI-TECH-3-001) when the conditions are met; the certification body decides - C. Only one site is ever audited - D. Sampling is only allowed when all sites are in one country **Q64.** What should an organisation check first when choosing a certification body? - A. That it is accredited for ISO/IEC 27001 by an accreditation body that is a signatory of the Global ACI MRA (formerly the IAF MLA), checked in the IAF CertSearch database - B. That it is the cheapest offer - C. That it will also implement the ISMS for you as a consultant - D. That it guarantees a pass ## 12. Section J: open scenario questions **Q65.** *Scenario.* At Quillmere Analytics Ltd, the risk "customer data exposed through a misconfigured storage bucket" is rated likelihood 3 and impact 4 before treatment. After configuration scanning and an approval step for public access are added, likelihood falls to 2 and impact stays at 4. State the score and band before and after treatment, and say who may accept the residual risk. **Q66.** *Scenario.* The draft management review agenda at Quillmere Health Systems has three items: status of actions from the previous review, internal audit results, and status of the risk treatment plan. List the required inputs that are missing. **Q67.** *Scenario.* Quillmere Group plans to certify its ISMS in phases, starting with headquarters and the data centre. Explain two things the scope statement must address for the first phase, given that the plants and the service centre are outside it. **Q68.** Write one audit finding, in the format requirement, evidence and gap, for this observation: in a sample of 10 leavers from the last quarter, 3 still had active accounts 20 days after their departure, while the access control policy requires removal within 1 business day. ## 13. Answer key ### 13.1 Section A | Q | Answer | Explanation | Revisit | |---|---|---|---| | Q01 | C | ISO/IEC 27001 is the requirements standard; 27000 is the overview, 27002 and 27005 are guidance | M0, `isms/iso-27000-family-map` | | Q02 | B | 93 controls: A.5 organizational 37, A.6 people 8, A.7 physical 14, A.8 technological 34. The 114 and 14 figures belong to the 2013 edition | M1 | | Q03 | D | Amd 1:2024 added the climate change decision in 4.1 and a note in 4.2; Annex A did not change | M0, clause 4.1 | | Q04 | A | Sending data to an unauthorised destination is a loss of confidentiality | M1, `isms/isms-glossary` | | Q05 | C | ISO/IEC 27002:2022 gives control guidance and five attributes; it is not certifiable | M0 | | Q06 | D | The certification body decides, through people independent of the audit team (ISO/IEC 17021-1:2015) | M10 | | Q07 | B | The transition ended on 2025-10-31; every valid certificate now refers to the 2022 edition | M0 | | Q08 | A | ISO/IEC 27701:2025 replaced the 2019 extension and is stand-alone and certifiable | M0 | ### 13.2 Section B | Q | Answer | Explanation | Revisit | |---|---|---|---| | Q09 | C | Clause 4.3 requires the scope as documented information; issues and interested parties are expected in practice but not explicitly required to be documented | M3 | | Q10 | B | Under clause 4.3 the scope has to make sense of what you rely on outside it, such as a cloud provider | M3, `compliance/ms-scope` | | Q11 | D | The 2022 edition added the decision on which requirements the ISMS addresses | M3 | | Q12 | A | Clause 5.2 needs the policy to promise both: meeting your obligations and improving the ISMS over time | M3 | | Q13 | C | Clause 5.3 names those two responsibilities; tool purchase and firewall approvals are operational | M3, `isms/isms-roles-raci` | | Q14 | B | Clause 5.1 makes top management accountable and expects active involvement | M3 | | Q15 | D | A recorded decision with reasons meets the intent; the amendment does not require a control or offsets | M3 | | Q16 | A | Clause 4.4 covers the ISMS, its processes and their interactions | M3, `isms/isms-process-map` | ### 13.3 Section C | Q | Answer | Explanation | Revisit | |---|---|---|---| | Q17 | C | 4 times 4 is 16, which falls in the High band (10-16) | M4 | | Q18 | B | A score of 6 is Medium (5-9); under the default rules the risk owner accepts it together with the department head (`compliance/risk-methodology` ยง2.4) | M4, `compliance/risk-methodology` | | Q19 | A | 20 is Critical (17 to 25, in practice 20 and 25); it needs treatment unless top management records a decision | M4 | | Q20 | D | Clause 6.1.2 is about repeatability: different assessors, same rules, comparable answers | M4 | | Q21 | D | The SoA lists necessary controls, justification for inclusion, implementation status and justification for exclusions; cost is not required | M4, `compliance/statement-of-applicability` | | Q22 | C | An exclusion must be justified and match reality; outsourced development happens, so A.8.30 applies. The certification body grades the finding | M4, M5 | | Q23 | A | Under clause 6.1.3 the people who own the risks sign off the plan and what is left after it | M4, `isms/isms-risk-acceptance-record` | | Q24 | B | It has a measure, a target and a date; the others cannot be measured | M4, `compliance/objectives-register` | | Q25 | C | Clause 6.3 is new in 2022 and asks for planned changes, with no explicit documented information requirement | M4, `isms/isms-change-plan` | | Q26 | D | Retaining a risk is an option only as a recorded decision; ignoring it without a record is not treatment | M4 | ### 13.4 Section D | Q | Answer | Explanation | Revisit | |---|---|---|---| | Q27 | A | Clause 7.2 requires documented evidence of competence | M6, `isms/isms-competence-training-matrix` | | Q28 | C | Awareness is about knowing the policy, your own part in it and what happens if you ignore it | M6 | | Q29 | B | Clause 7.4 needs a planned message, timing, audience and channel | M6, `isms/isms-communication-plan` | | Q30 | A | Clause 7.5.3 covers availability of the right version and control of changes | M6, `compliance/controlled-document` | | Q31 | D | Under clause 7.5.3 outside documents you rely on need tracking and control too | M6 | | Q32 | B | Documents state intent and method; records are evidence and must be protected from change | M6, `isms/isms-glossary` | ### 13.5 Section E | Q | Answer | Explanation | Revisit | |---|---|---|---| | Q33 | C | Clause 8.2 means a fixed schedule plus a fresh look whenever something big changes | M7 | | Q34 | B | The interval was missed and a significant change was not assessed; the certification body grades the finding | M7, `isms/isms-risk-assessment-report` | | Q35 | D | Under clause 8.1 outsourcing something does not outsource responsibility for it; supplier certification can help but is not required | M7, `isms/supplier-register` | | Q36 | A | Clause 8.3 is about doing what the plan promised and keeping proof of the outcome | M7 | | Q37 | C | Dated records of decisions and removals show the control operated; a policy only shows intent | M7, `isms/control-evidence-matrix` | ### 13.6 Section F | Q | Answer | Explanation | Revisit | |---|---|---|---| | Q38 | D | Clause 9.1 is about deciding what to track, how, when and by whom; salaries have nothing to do with it | M8, `isms/isms-measurement-programme` | | Q39 | B | Internal auditors need to be free of any stake in what they review; in practice they must not audit their own work | M9 | | Q40 | A | Under clause 9.2.2 audit effort follows what matters most and what went wrong before | M9, `compliance/internal-audit-program` | | Q41 | C | This input was added in 2022; others include previous actions, issues, performance feedback, risk results and improvement opportunities | M8, `compliance/management-review` | | Q42 | D | Under clause 9.3.3 the review must end in recorded decisions about improving or changing the ISMS | M8 | | Q43 | B | Internal audit may be outsourced; the organisation still owns the programme and the follow-up | M9 | | Q44 | A | Monitoring checks status; measurement produces a value by a defined method | M8 | | Q45 | C | Certification bodies usually expect one full internal audit and one management review before Stage 2; this is practice, not a clause | M10, `isms/stage-1-readiness-pack` | ### 13.7 Section G | Q | Answer | Explanation | Revisit | |---|---|---|---| | Q46 | B | Correction fixes the instance; corrective action removes the cause (clause 10.2) | M9, `compliance/capa-nonconformity` | | Q47 | D | Under clause 10.2 a fix is not finished until the root cause is found, similar cases are checked, action is taken and someone confirms it worked | M9, `isms/audit-findings-register` | | Q48 | A | Under clause 10.2 you keep a trail of what went wrong, what you did and whether it worked | M9 | | Q49 | C | The 2022 edition swapped the order: 10.1 continual improvement, 10.2 nonconformity and corrective action | M1 | | Q50 | B | An opportunity for improvement is not a nonconformity; record it and decide whether to act | M9, `isms/continual-improvement-register` | ### 13.8 Section H | Q | Answer | Explanation | Revisit | |---|---|---|---| | Q51 | D | A.5.7 is one of the 11 new controls; the others listed existed in 2013 in another form | M5, `isms/annex-a-organizational-controls-guide` | | Q52 | A | A.8 has 34 controls, A.8.1 to A.8.34 | M5 | | Q53 | C | A.8.11 data masking is new in 2022 | M5, `isms/data-masking-dlp-standard` | | Q54 | B | A.6 is the people theme; A.6.7 covers remote working | M5, `isms/annex-a-people-physical-controls-guide` | | Q55 | A | Clause 6.1.3 uses Annex A as a check list; the SoA records each decision | M5 | | Q56 | D | Applicability follows risk and scope; cloud hosting does not remove office equipment, and either decision needs a reason | M5 | | Q57 | C | The cybersecurity concepts attribute uses Identify, Protect, Detect, Respond and Recover; preventive, detective and corrective are control type values | M5 | | Q58 | B | A.8.9 configuration management is new in 2022; A.8.32 is change management | M5, `isms/secure-configuration-baseline` | ### 13.9 Section I | Q | Answer | Explanation | Revisit | |---|---|---|---| | Q59 | A | Stage 1 reviews documents, readiness and scope and plans Stage 2; Stage 2 checks implementation and effectiveness | M10, `isms/certification-audit-explained` | | Q60 | D | The first surveillance is due no later than 12 months from the certification decision date | M10, `isms/certification-cycle-plan` | | Q61 | B | The cycle is three years: initial certification, surveillance each calendar year, recertification before expiry | M10 | | Q62 | C | The certification body sets audit time using ISO/IEC 27006-1:2024; any day count you see in a template is an example | M10, `isms/certification-body-selection` | | Q63 | B | ISO/IEC 27006-1 and IAF MD 1:2023 (re-issued by Global ACI as Global ACI-TECH-3-001) allow sampling of sites under conditions; the certification body decides | M10, `isms/scope-extension-multisite-plan` | | Q64 | A | Accreditation by a Global ACI MRA (formerly IAF MLA) signatory gives wide recognition; a body that also consults on your ISMS has an impartiality conflict | M10 | ### 13.10 Section J model answers | Q | Model answer | Meets if | |---|---|---| | Q65 | Before treatment: 3 times 4 = 12, High. After treatment: 2 times 4 = 8, Medium. Under the default rules the Medium residual risk is accepted by the risk owner together with the department head; record the acceptance with date and review date in DOC-ISMS-019. | Both scores and bands are correct and the right acceptors (risk owner plus department head) are named | | Q66 | Missing: changes in external and internal issues; changes in the needs and expectations of interested parties; feedback on performance, including nonconformities and corrective actions, monitoring and measurement results and fulfilment of objectives; feedback from interested parties; results of risk assessment (the agenda has treatment status only); opportunities for continual improvement. | At least five of the six missing inputs are named | | Q67 | (1) Interfaces and dependencies: the out-of-scope plants and service centre exchange information with HQ and the data centre, so the scope must describe those interfaces and how in-scope information is protected when it crosses them. (2) Shared services: group functions (identity, network, HR) that serve all sites must be either in scope or treated as externally provided processes controlled under 8.1. A good answer also mentions the phased plan in DOC-ISMS-095. | Both interfaces and shared services are addressed | | Q68 | Requirement: the access control policy (DOC-ISMS-041) requires leavers' accounts to be removed within 1 business day; clause 8.1 and control A.5.18. Evidence: 3 of 10 leavers sampled for the last quarter had active accounts 20 days after leaving. Gap: the removal step is not performed as required, so former staff could still access information. | All three parts present, evidence is specific and verifiable | ## 14. Results log | Result ID | Learner | Track | Version | Date | Score (of 64) | Open questions met (of 4) | Result | Sections to revisit | Marked by | |---|---|---|---|---|---|---|---|---|---| | TEST-001 *(Example)* | [@isms-manager] | T3 | 1.0 | 2027-03-10 | 55 | 4 | Pass (55 is at least 52) | H | [@ciso] | | TEST-002 *(Example)* | [@quality-auditor] | T4 | 1.0 | 2027-03-12 | 49 | 3 | Not yet (49 is below 52) | C, G | [@audit-programme-manager] | | TEST-003 *(Example)* | [@quality-auditor] | T4 | 1.0 | 2027-03-26 | 54 | 4 | Pass on second attempt | None | [@audit-programme-manager] | | [TEST-NNN] | [@learner] | [T1 to T5] | [version] | YYYY-MM-DD | [n] | [n] | [Pass / Not yet] | [sections] | [@marker] | ## 15. Size tiers: running the test The library's working tiers are small (under 50 people), medium (50 to 500) and large or multi-site (over 500 or several sites). | Aspect | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group | |---|---|---|---| | Who takes it *(Example)* | The part-time ISMS manager (full test) and 4 control owners (sections D, E, H) | ISMS manager and 3-person security team (full test), 2 internal auditors (full test), control owners (relevant sections) | Security office leads (full test), 6 site coordinators (relevant sections), audit pool of 8 (full test) | | Format | Self-marked, with an external mentor checking section J | Marked by the ISMS manager; results reviewed at the steering committee | Run in cohorts per site wave on the learning platform; item analysis after each cohort | | Adaptation | Add two questions on the cloud provider's shared responsibility model | Add questions on processor and controller duties and on the colocation suite | Translate for sites in 4 countries; add OT questions; keep the same answer key per language version | | Use of results | Shows the 0.5 FTE manager is ready before Stage 1 | Feeds the competence matrix for audit roles | Gate for joining the internal audit pool and for site coordinator roles | When you add organisation-specific questions, number them after Q68 so that results for Q01 to Q68 stay comparable across versions. ## 16. Records and evidence | Record | Proves | Kept by | Where | Retention *(Example)* | |---|---|---|---|---| | Results log (section 14) | Knowledge was evaluated with a defined pass mark (7.2) | ISMS manager | [Learning system or ISMS workspace] | Employment plus 2 years | | Marked answer sheets for section J | Application of knowledge was checked by a mentor | Mentor, filed by ISMS manager | [Training folder] | Until next competence review | | Test version history | Scores are compared only within a version | ISMS manager | [Document system] | Current plus previous 3 versions | | Competence and training matrix (DOC-ISMS-026) | Role competence is met and evidenced | ISMS manager with HR | [HR system or ISMS workspace] | Current plus previous 3 years | Map these records in `isms/control-evidence-matrix` (DOC-ISMS-033) under clause 7.2, clause 7.3 and control A.6.3. ## 17. References | Standard | Edition | Link | |---|---|---| | ISO/IEC 27001 | 2022 + Amd 1:2024 | https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html | | ISO/IEC 27000 | 2026 | https://www.iso.org/standard/84257.html | | ISO/IEC 27002 | 2022 | https://www.iso.org/standard/75652.html | | ISO/IEC 27005 | 2022 | https://www.iso.org/standard/80585.html | | ISO/IEC 27006-1 | 2024 | https://www.iso.org/standard/82908.html | | ISO/IEC 17021-1 | 2015 | https://www.iso.org/standard/61651.html | | ISO/IEC 27701 | 2025 | https://www.iso.org/standard/85819.html | | ISO 19011 | 2026 | https://www.iso.org/standard/88984.html | IAF MD 1:2023 (multi-site certification) has been re-issued by Global Accreditation Cooperation Incorporated (Global ACI), which replaced IAF and ILAC on 2026-01-01, as Global ACI-TECH-3-001; check the current issue on the Global ACI website. Related templates: `isms/isms-learning-path`, `isms/isms-glossary`, `isms/iso-27001-clauses-explained`, `isms/certification-audit-explained`, `isms/isms-worked-walkthrough`, `isms/isms-competence-training-matrix`, `compliance/risk-methodology`. ## Standard and licence note Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10 and Annex A, with certification questions based on ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. All questions, options, scenarios, explanations and model answers are original text. No ISO or IEC text, requirement wording, control titles in full or definitions are reproduced; you need the official standards to implement or audit an ISMS. Editions change: check the current edition on iso.org before you rely on this test, and update the questions when an edition changes. Pass marks and times are *Example* values. Passing this test does not certify a person or an organisation; certification decisions belong to accredited certification bodies. Template licence: MIT.