Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

GRC > Lead Auditor 27001 > Flashcards

Lead Auditor 27001 Flashcards

(236 cards)

Start Studying
1
Q

Information is what kind of asset?

A

Strategic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Property of accuracy and completeness. CIA triad

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

CIA Triad

A

Confidential
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A hacker compromising a message someone sends to another is what CIA?

A

Integrity, accuracy of message was corrupted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

When someone sends a message and they can no longer claim they didn’t is what?

A

Non repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Property is the entity it claims to be

A

Authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Example of authentic and non repudiation

A

Digital signature

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Use a framework of resources to achieve an organization’s objectives

A

Management systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Management system components

A

Quality management
Scope
Organization
Process
Policies
Records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

PDCA cycle

A

In the quality management:
Plan
Do
Check
Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Management system used to ensure the information security of its information assets

A

ISMS

In sec man sys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Item of value to an org is a primary asset

A

False, information asset

Primary is business process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Stand. That specifies requirements for estáb implementation and manage. And continual improving of ISMS

A

ISO 27001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Catalog of security and privacy controls for all U.S. federal information systems

A

Nist 800-53

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Framework for governance and manage of enterprise IT

A

Cobit 2019

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Only normative standards like 27001 can be audited

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Nist framework is what 5?

A

Identify
Protect
Detect
Respond
Recover

6th is governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Standard that contains guidelines for implementing security controls

A

27002

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Clause 7.5

A

Documented information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which clause requires org to include documented information in the ISMS as directly required by 27001 and org for effectiveness of the ISMS

A

7.5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Documentation life cycle

A

Créate
Store
Use
Archive
Dispose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

12 step method

A

Management support
Scope of ISMS
Gap Analysis
Information security policy
Competence assurance
Asset inventory
Risk management methodology
Risk assessment
Risk treatment
Performance evaluation
Improvement
Certification audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Determines whether a project is worth it
Business case
26
Raci matrix
Responsible Accountable Consulted Informed
27
Most important reason to obtain support by top management for an ISO 27001 implementation project
Guarantee sufficient resources and budget for the implementation
28
Responsibility specifically for top management in ISO 27001
Approving information security policy
29
True or false, multiple roles can be assigned accountability role within an activity
False
30
31
Name a standard that is normative and can be certified
27001
32
A procedures describing how to configure a server is an example of?
Document
33
34
3 purposes of context analysis
Scope of isms Risk and opportunities Adaptation
35
Pestel
Political Economical Social Technological Environmental Legal
36
37
4.4
Org estab implements and maintains continuous improvement of ISMS
38
Only 2 process required in ISO 27001
Risk assessment Risk treatment
39
This has to be available as documented information due to requirements of ISO 27001
Scope of ISMS
40
A customer requiring an org to have compliance with privacy regulations is defined as what?
Interested party
41
Who is accountable for approving scope of ISMS?
Top management
42
Org establishes information security objectives and plans to achieve them at relevant functions and levels
6.2
43
Info sec objectives
Strategic goals Is policy Confidential Integrity Availability
44
Smart goals
Specific Measure able Achieve able Relevant Timebound
45
46
47
Management systeme used to ensure the information security of its information assets
ISMS
48
49
Primary assets are an item of value to the org
False, information assets Primary is business processes and activities information Supporting assets- enable primary assets
50
4 tabs to track assets
Classification Type Category Owner
51
52
This consists of leadership, org structure and process that ensure enterprises IT sustains and extends the enterprise strategies and objectives
IT governance
53
3 benefits of IT governance
Benefits realization Risk optimization Resource optimization
54
Resource optimization treats risks to meet an org risk acceptance criteria
False, risk optimization -Resource optimization is the provision of necessary resources and training for efficient tech use Benefits realization is IT creates value aligned with org values and measure for success and eliminate low value initiatives
55
56
57
Name 5 mandatory documents
-Scope of isms -info sec policy -info sec risk assess process -info sec risk treat process -statement of applicable -evidence of competence -evidence for process carried out -results of info sec risk assess -results of info sec risk treat -result of monitor and measure -audit programme -audit results -results of manage review -nature of nonconformity and sub actions taken -results of corrective action
58
Why do iso 27001 projects mostly fail?
Lack of planning
59
Give me the 12 step method
-managed support -scope of isms -gap analysis -info sec policy -competence assurance -asset inventory -risk management method -risk assessment -risk treat -performance evaluation -improvement -certification audit
60
Setting foundation, top management fully on board
Step 1 management support
61
What is covered by scope and what isn’t
2 scope of ISMS
62
Step 3 gap analysis
Determine where you want to be and where you are now
63
Security objectives
Info sec policy
64
Everyone knowing what is expected from them and how they can contribute
5 competence assurance
65
Categorize assets, need clear inventory of what needs protected
6 asset inventory
66
Defining risk
7 risk management method
67
Utilizing a risk register
8 risk assessment
68
Based off risk assessment results, largest and time consuming of steps
9 risk treat
69
Reevaluate performance, kpi’s etc
10 performance evaluation
70
Corrections from results to improve isms
11 improvement
71
Seeking certification
12 certification audit
72
ISO 27001 implementation project categories
-welcome -Normative reference -citations -deliverables -project information -Gantt Chart
73
Highlights the benefits of implementing ISO 27001
Business case
74
5.1 leadership and commitment and 5.3 org roles, responsibilities and authorities are relevant to which step?
Step 1 Management support
75
Which Clause has top management demonstrate leadership and commitment with respect to ISMS?
5.1 leadership and commitment
76
Clause that has top management ensure responsibility and authorities for roles relevant to info sec are assigned and communicated throughout the org
5.3 org roles responsibility and authorities
77
First step of scope of ISMS,
Context analysis process
78
What are the relevant clauses for the scope of isms?
4.1 understanding the organization and it’s context 4.2 understanding the needs and expectations of interested parties 4.3 determine the scope of isms 5.31 legal,statutory, regulatory and contractual requirements
79
Org determines external and internal issues relevant to its purpose and affecting its ability to achieve the intended outcomes of the isms
4.1 understanding the org and it’s context
80
3 purposes of context analysis
Scope of isms Risk and opportunities Adaptation,adapt to org changes
81
Political, economic, social, tech, environmental and legal are what issues to an isms?
External
82
Culture, objectives, org structure, supply chain, processes, infrastructure, it, reports are what issues to an isms?
Internal
83
Org determines interested parties relevant to ISMS and their requirements relevant to information security
4.2 understanding the needs and expectations of interested parties
84
Person or org affected by or perceived itself to be affected by a decision or activity
Interested party (stakeholder)
85
What type of stakeholders are legislators, customers, suppliers, competitors, investors, police, public, adversaries
External
86
3 requirements of interested parties
Government-compliance with privacy regulations Key customers- ISO 27001 Workers council- protection of employee data
87
This clause identifies, considers and documents control, purpose and implementation of the scope of an isms
5.31 legal, stat, regulatory and contractual requirements
88
Types of compliance requirements
Legal, regulatory, statutory and contractual
89
What clause has the org determine the boundaries and applicability of the ISMS to establish its scope?
4.3 determining scope of isms
90
This defines where and what the isms is applicable and where for what it is not
Scope
91
Org establishes, maintains and improves isms continuously
4.4 information security management system
92
Where you are at and where you wasn’t your isms to be
Gap analysis
93
Step 4, highlights importance of isms,
Information security policy
94
Clauses 5.2 policy 6.2 info sec obj 7.4 communication A.5.1 info sec policies Are associated with which step?
Step 4 info sec policy
95
Org establishes info sec obj and plans to achieve them at relevant functions and levels
Clause 6.2 info sec objective
96
What are the objectives for info sec?
Confidential Integrity Availability
97
This acronym is for goals in your isms
Specific Measurable Achievable Relevant Timely
98
This clause has top management establish an information security policy
Clause 5.2 Policy
99
Which clause has the org determine the needs for internal and external communications related to isms?
7.4 communications
100
Step for for setting up an ISMS
Competence assurance
101
What clauses are in step 5?
7.2 competence 7.3 awareness A.6.3 info sec aware Edu and training
102
Part of support clause, org determines the competence of persons needed for info sec performance and ensures that the persons are competent
7.2 competence
103
Clause that states the persons doing work under the org control are made aware of the info Dec policy, their contribution to the effectiveness of the ISMS, benefits of the improved info sec performance and implications of not conforming to the requirements of the isms
7.3 awareness
104
This clause has Org and relevant parties should provide appropriate info sec aware, edu, and training to their personnel, and update them regularly on the info sec policies relevant to their job function
A.6.3 info sec aware, edu and training
105
Step 6 for isms
Inventory asset
106
Relevant clauses for step 6?
A.5.9 inventory of information and other associated assets A.5.12 classification of information A.5.13 labeling of information
107
This clause is an inventory of info and other associated assets, including owners, should be developed and maintained
A.5.9 inventory of information and other associated assets
108
A crm, system admin and a sales team are what kind of assets?
Primary
109
A router is what type of asset?
Supporting
110
This control has info should be classified according to info sec needs of the org based on confidentiality, integrity, availability and relevant interested party requirements
A.5.12 classification of information control
111
Control is an appropriate procedures for info labeling should be developed and implemented in accordance with the information classification scheme adopted by an organization
A.5.13 labeling of information
112
Step 7
Risk management methodology
113
Which clauses are relevant to step 7
6.1 actions to address risk opportunities Annex A info sec controls
114
Establish context, risk identification, risk analysis, risk evaluation, risk treatment, risk monitoring and review is what?
Risk management process
115
This clause is relevant to outcomes of ISMS and info security risks
6.1 actions to address risks and opportunities
116
This clause has the org define and apply an info security risk assessment process
6.1.2 info security risk assessment
117
AV
Asset value
118
EF
Exposure factor
119
This clause the org defines and applies an info security risk treatment process
6.1.3 info security risk treatment
120
Give me 4 security controls
Deter Reduce Detect Reduce
121
Step 8
Risk Assessment
122
Relevant clauses for step 8
8.2 info sec risk assessment
123
This clause has the org perform info security risk assessments and retains documented info on results
8.2 info sec risk assessment
124
Step 9
Risk treatment
125
Clauses for step 9
8.3 info sec risk treat
126
This clause has the org implement the info sec risk treat plan and retains documented info on the results of the info sec treat
8.3 info sec risk treat
127
These are measures to reduce risk
Controls
128
Info sec controls reference
Annex A
129
This clause has the org determine and provide resources for establishing, implementing, maintaining and continually improve the isms
7.1 resources
130
Which Annex A clause is policies for information security?
A.5.1
131
Which Annex A clause is info sec roles and responsibilities?
A.5.2
132
Which Annex A clause is segregation of duties?
A.5.3
133
Which Annex A clause is management responsibility
A.5.4
134
Which Annex A clause is contact with authorities?
A.5.5
135
Which Annex A clause is contact with special interest groups?
A.5.6
136
Which Annex A clause is threat intelligence?
A.5.7
137
Which Annex A clause is info sec in project management?
A.5.8
138
Which Annex A clause is inventory of info and other associated assets?
A.5.9
139
A.5.10
Acceptable use of information and other associated assets
140
A.5.11
Return of assets
141
A.5.12
Classification of information
142
A.5.13
Labeling of information
143
A.5.14
Information transfer
144
A.5.9
Inventory of info and other associated assets
145
A.5.10
Acceptable use of info and other associated assets
146
A.5.11
Return of assets
147
A.5.12
Classification of info
148
A.5.13
Label of info
149
A.5.14
Info transfer
150
A.5.15
Access control
151
A.5.16
Identity management
152
A.5.17
Auth info
153
A.5.18
Access rights
154
A.5.19
Info sec in supplier agreement
155
A.5.20
Addressing info sec within supplier agreement
156
A.5.21
Manage info sec in the info and comm tech
157
A.5.22
Monitoring, review and change management of supplier services
158
A.5.23
Info sec for use of cloud services
159
A.5.24
Info sec incident management planning and preparation
160
assessment and decision on info sec events
A.5.25
161
Which Annex A is response to info security incidents
A.5.26
162
Which Annex A is learning from info sec
A.5.27
163
Which Annex A is collection of evidence
A.5.28
164
Which Annex A is info sec during disruption
A.5.29
165
Which Annex A is ICT readiness for business continuity
A.5.30
166
A.5.31
Legal statutory regulations and contracts require
167
A.5.32
Intellectual property of rights
168
A.5.33 protection of records T or F
True
169
A.5.34
Privacy and protection of PII
170
A.5.35
Independent review of info sec
171
A.5.36 compliance with policies rules and standards. For information sec T or F
True
172
A.5.37
Document operating procedures
173
A.6.1
Screening
174
A.6.2
Terms and condition of employment
175
A.6.3
Info sec aware edu and training
176
A.6.4
Disciplinary process
177
A.6.5
Responsibilities after term or change of employment
178
A.6.6
Confidential or non disclosure agreements
179
A.6.7
Remote working
180
A.6.8
Info sec event reporting
181
A.7.1
Physical security perimeters
182
A.7.2
Physical entry
183
A.7.3
Securing offices rooms and facilities
184
A.7.4
Physical security monitoring
185
A.7.5
Protecting against physical and environmental trends
186
A.7.6
Working in secure areas
187
A.7.7
Clear desk and clear screen
188
A.7.8
Equipment sitting and protection
189
A.7.9
Security of assets off premise
190
A.7.10
Storage media
191
A.7.11
Supporting utilities
192
A.7.12
Cabling security
193
A.7.13
Equipment maintenance
194
A.7.14
Secure disposal or reuse of equipment
195
A.8. 1
User end point devices
196
A.8.2
Privileged access rights
197
A.8.3
Info access restrictions
198
A.8.4
Access to source code
199
A.8..5
Secure authentication
200
A.8.6
Capacity management
201
A.8.7
Protection against malware
202
A.8.8
Management of tech vulnerabilities
203
A.8.9
Config management
204
A.8.10
Info deletion
205
A.8.11
Data masking
206
A.8.13
Info back up
207
A.8.14
Redundancy of info processing facilities
208
A.8.15
Logging
209
A.8.16
Monitoring activities
210
A.8.17 clock synchronization true or false
True
211
A.8.18
Use of privilege utility programs
212
A.8.19
Installation of software on operating systems
213
A.8.20
Network security
214
A.8.21
Security of network services
215
A.8.22
Segregation of networks
216
A.8.23
Web filtering
217
A.8.24
Use of cryptography
218
A.8.25
Secure develop life cycle
219
A.8.26
Application security requirements
220
A.8.27
Secure system architecture and engineering principles
221
A.8.28
Secure coding
222
A.8.29
Security testing in dev and acceptance
223
A.8.30
Outsourced dev
224
A.8.31
Separation of dev test and production environments
225
A.8.32
Change management
226
A.8.33
Test information
227
A.8.34
Protection of info systems during audit testing
228
Step 10
Performance evaluation
229
Clauses associated with step 10
-9.1 monitor measure analysis evaluation -9.2 internal audit -9.3 management review
230
Step 11
Improvement
231
Clauses for step 11?
10.1 continual improvement 10.2 nonconformity and corrective action
232
10.1
Continual improvement
233
10.2
nonconformity and corrective action
234
Step 12
Certification audit
235
Nonconformity
Non fufilment of a requirement
236
Step 12
Certification audit

GRC (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions