Exam (elaborations)
ISO 2700x EXAM QUESTIONS AND ANSWERS
- Course
- Institution
ISO 2700x EXAM QUESTIONS AND ANSWERS
[Show more]
Content preview
ISO 2700x EXAM QUESTIONS ANDANSWERS
Why should a company implement ISO27001? - ANSWER - Benchmark
information security
- International operations
- Competitive advantage
- Contractual obligations
Can you be ISO 27002 certified? - ANSWER No, because ISO 27002 is
not a management standard. What does a management standard
mean? It means that such a standard defines how to run a system.
Certification is only available for ISO 27001.
It means that management has its distinct responsibilities, that
objectives must be set, measured and reviewed, that internal audits
must be carried out and so on. All those elements are defined in ISO
27001, but not in ISO 27002
What's the difference between ISO 27001 and ISO 27002? - ANSWER
Every standard from the ISO 27000 series is designed with a certain
focus - if you want to build the foundations of information security in your
organization, and devise its framework, you should use ISO 27001; if
you want to implement controls, you should use ISO 27002; If you want
to carry out risk assessment and risk treatment, you should use ISO
27005 etc.
The difference is also in the level of detail - on average, ISO 27002
explains one control on one whole page, while ISO 27001 dedicates only
one sentence to each control.
How is ISO 27001 implemented? - ANSWER ISO 27001 prescribes a
risk assessment to be performed in order to identify for each control
whether it is required to decrease the risks, and if it is, to which extent it
should be applied.
, What are the metrics of security clauses, control objectives and controls
on ISO 27001? - ANSWER - 11 Security clauses, which comprise
a. 39 main control objectives
b. 142 controls
c. 1 introductory clause which deals with risk assessment and treatment
(* 1,033 'shoulds')
What is ISO 27001 - ANSWER ISO/IEC 27001:2013 (ISO 27001) is the
internationally recognized standard that outlines the requirements for
constructing a risk-based framework to initiate, implement, maintain, and
manage information security within an organization.
The standard defines what an information security management system
(ISMS) is, what is required to be included within the ISMS, and how
management should form, monitor, and maintain the ISMS.
What is the ISO 27001 certification? - ANSWER The certification is an
independent validation that the ISMS conforms to the requirements of
the ISO 27001 standard.
How long does ISO 27001 valid, and what (if anything) is required during
that term? - ANSWER
What is a SOC2 report? - ANSWER The SOC 2 examination is an
independent examination of the service organization's controls that are
designed and operating effectively (in the case of a Type 2 report) to
meet the applicable criteria in ONE OR MORE (not necessarily all) of the
five Trust Services Principles and Criteria:
a. Security
b. Availability
c. Processing Integrity
d. Confidentiality
e. Privacy
When were SOC reports originated? - ANSWER In early 2011, the
AICPA issued its Service Organization Control (SOC) reporting
framework.
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller luzlinkuz. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $10.99. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
83100 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now