PECB
LEAD-AUDITOR · Question #112
You are an experienced audit team leader conducting a third-party surveillance audit of an organisation that designs websites for its clients. You are currently reviewing the organisation's Statement
The correct answer is A. Justification for both the inclusion and exclusion of Annex A controls in the Statement of D. A Statement of Applicability must be produced by organisations seeking ISO/IEC 27001 conformity. You've hit your limit · resets 4am (America/New_York)
Risk Assessment and Treatment
Question
You are an experienced audit team leader conducting a third-party surveillance audit of an organisation that designs websites for its clients. You are currently reviewing the organisation's Statement of Applicability. Based on the requirements of ISO/IEC 27001, which two of the following observations about the Statement of Applicability are true?
Options
- AJustification for both the inclusion and exclusion of Annex A controls in the Statement of
- BThe Statement of Applicability is owned and amended by the organisation's top management
- CThe Statement of Applicability must be reviewed at least annually
- DA Statement of Applicability must be produced by organisations seeking ISO/IEC 27001 conformity
- EJustification is only required for any controls that the organisations choses to exclude
- FThe Statement of Applicability must be reviewed at Management Review
How the community answered
(35 responses)- A74% (26)
- B11% (4)
- C9% (3)
- E3% (1)
- F3% (1)
Explanation
You've hit your limit · resets 4am (America/New_York)
Topics
#Statement of Applicability#Annex A controls#ISO 27001 requirements#SoA ownership
Community Discussion
No community discussion yet for this question.