When assessing an organization's security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities…

Question

Options

• AOnly when assets are clearly defined
• BOnly when standards are defined
• COnly when controls are put in place
• DOnly procedures are defined

• A
  73% (19)
• B
  15% (4)
• C
  4% (1)
• D
  8% (2)

Explanation

Under ISO 27001/27002, management responsibilities are tied to asset ownership - you cannot assign accountability for protecting something until you know what that something is. Assets must be identified and classified first, because the entire framework of ownership, controls, and procedures flows downstream from that inventory. Option B is wrong because standards are typically developed in parallel with or after responsibilities are defined, not as a prerequisite. Option C reverses the order - controls are implemented after responsibilities are established, not before. Option D is similarly backwards - procedures document how responsibilities are carried out, so they logically follow, not precede, responsibility assignment.

Memory tip: Think "Assets → Assignments → Actions" - first you inventory your assets, then you assign management responsibility, then you define controls and procedures. If you can't name what you're protecting, you can't name who's protecting it.

No community discussion yet for this question.