ISO/IEC 27001 & 27002 interview questions

ISO/IEC 27001 is the international standard that specifies requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). The current version is ISO/IEC 27001:2022.

• It is risk-based: the organisation identifies its information security risks and selects controls to treat them.
• Organisations can be certified by an accredited certification body.
• Clauses 4–10 contain the mandatory management system requirements; Annex A lists reference controls.

The SoA is a mandatory ISO 27001 document that lists all Annex A controls and, for each one:

• Whether it is applicable (included) or excluded.
• The justification for inclusion (e.g. linked to risks, legal or contractual requirements).
• The justification for exclusion.
• Its implementation status.

It also includes any additional controls the organisation uses beyond Annex A. The SoA links the risk treatment plan to the controls actually in place.

An Information Security Management System (ISMS) is the set of policies, processes, roles, risk assessments and controls an organisation uses to manage information security systematically and keep improving it.

• It is a management system, not a technical product.
• It follows the Plan-Do-Check-Act idea: plan based on risk, implement controls, monitor and audit, then improve.
• ISO/IEC 27001 defines the requirements for an ISMS. Organisations can be certified against it.

ISO/IEC 27001:2022 Annex A has 93 controls in four themes:

• Organizational controls (clause 5): 37 controls, such as policies, roles, threat intelligence, supplier security and cloud services.
• People controls (clause 6): 8 controls, such as screening, awareness and remote working.
• Physical controls (clause 7): 14 controls, such as secure areas, physical security monitoring and equipment.
• Technological controls (clause 8): 34 controls, such as access, logging, secure coding and data masking.

The 2013 version had 114 controls in 14 domains. Many were merged, and 11 new controls were added.

• 5.7 Threat intelligence.
• 5.23 Information security for use of cloud services.
• 5.30 ICT readiness for business continuity.
• 7.4 Physical security monitoring.
• 8.9 Configuration management.
• 8.10 Information deletion.
• 8.11 Data masking.
• 8.12 Data leakage prevention.
• 8.16 Monitoring activities.
• 8.23 Web filtering.
• 8.28 Secure coding.

• ISO 27001 is voluntary unless a customer, contract or regulator requires it. Ask what is driving the question.
• Look at the market: enterprise and healthcare customers, and many buyers in Europe, Asia and India, often ask for it. US customers often prefer SOC 2.
• Consider the effort: scope, policies, risk assessment, controls, internal audit and certification fees, plus ongoing surveillance audits.
• Suggest a phased path: start with a gap assessment and basic controls, keep the scope focused on the product customers buy, then certify when sales need it.
• Explain the benefits beyond the certificate: fewer questionnaires and better-organised security.

• Clause 4 – Context of the organisation: internal/external issues, interested parties, ISMS scope.
• Clause 5 – Leadership: top management commitment, information security policy, roles and responsibilities.
• Clause 6 – Planning: risk assessment, risk treatment, Statement of Applicability, security objectives, planning of changes.
• Clause 7 – Support: resources, competence, awareness, communication, documented information.
• Clause 8 – Operation: operational planning and control, performing risk assessments and treatment.
• Clause 9 – Performance evaluation: monitoring and measurement, internal audit, management review.
• Clause 10 – Improvement: continual improvement, nonconformity and corrective action.

Clauses 1–3 cover scope, normative references and terms and definitions.

Annex A of the 2022 version contains 93 controls grouped into four themes:

• Organisational controls (37)
• People controls (8)
• Physical controls (14)
• Technological controls (34)

The 2013 version had 114 controls in 14 domains. The 2022 update merged many controls and added 11 new ones, including threat intelligence, information security for use of cloud services, ICT readiness for business continuity, data masking, data leakage prevention, web filtering and secure coding.

ISO/IEC 27002:2022 gives implementation guidance for each control and introduces attributes (e.g. control type, security properties, cybersecurity concepts) for filtering and mapping.

• ISO/IEC 27001 contains the requirements for an ISMS. Organisations are certified against it ('shall' statements).
• ISO/IEC 27002 is a code of practice giving guidance on implementing security controls. Organisations are not certified against it.

Annex A of 27001 lists the controls by name and short description; 27002 explains the purpose and implementation guidance for each.

1. Define scope and implement the ISMS (risk assessment, SoA, policies, controls, internal audit, management review).
2. Stage 1 audit: the certification body reviews documentation and readiness.
3. Stage 2 audit: assesses whether the ISMS is implemented and operating effectively.
4. Address any nonconformities (major nonconformities must be resolved before certification).
5. Certificate issued, typically valid for three years.
6. Surveillance audits during the cycle (usually annually), then a recertification audit before expiry.

• Internal audit (Clause 9.2): planned audits, at defined intervals, to check the ISMS conforms to the organisation's own requirements and the standard and is effectively implemented. Auditors must be objective and impartial (they should not audit their own work).
• Management review (Clause 9.3): top management reviews the ISMS at planned intervals. Inputs include status of previous actions, changes in context, performance and audit results, feedback from interested parties, risk assessment results and improvement opportunities. Outputs are decisions on improvement and changes.

Both must be documented and are always checked during certification audits.

Clause changes in 2022 were modest but important:

• 4.2: requirements of interested parties that will be addressed through the ISMS must be determined.
• 4.4: processes needed and their interactions must be determined.
• 6.2: information security objectives must be monitored.
• 6.3 (new): planning of changes to the ISMS.
• 8.1: criteria for processes and control of externally provided processes, products or services.

Amendment 1:2024 added climate action changes: in clause 4.1, the organisation must determine whether climate change is a relevant issue, and in 4.2 that interested parties can have climate-related requirements.

ISO/IEC 27002:2022 tags each control with five attributes so you can filter and view controls in different ways:

• Control type: preventive, detective, corrective.
• Information security properties: confidentiality, integrity, availability.
• Cybersecurity concepts: identify, protect, detect, respond, recover (aligned to the NIST CSF functions).
• Operational capabilities: such as governance, asset management, identity and access management.
• Security domains: governance and ecosystem, protection, defence, resilience.

Organisations can also create their own attributes.

Clause 4.3 requires a documented scope that considers internal and external issues (4.1), interested parties' requirements (4.2) and interfaces and dependencies with other organisations.

• Define it in business terms: services, locations, teams, systems and data.
• Be clear about interfaces: what is outside scope and how it connects (for example, an outsourced data centre or a group IT function).
• Exclusions must not undermine the ISMS. You cannot exclude a team that has full access to in-scope data.
• Make it match what customers think they are buying. A scope that is too narrow can mislead them and will be challenged.

Clause 6.1.3 requires the organisation to select risk treatment options, determine the necessary controls, compare them with Annex A, produce a Statement of Applicability and formulate a risk treatment plan.

• The risk treatment plan lists the actions to treat each risk, with owners, resources and timelines.
• Risk owners must approve the plan and accept the residual risks.
• The SoA lists all necessary controls, the justification for including them, whether they are implemented, and justification for excluding any Annex A controls.

So the chain is: risk assessment → treatment decision → controls → SoA and treatment plan → implementation (clause 8.3).

• Accept the observation and understand what the auditor expects (risk identification for cloud services, clause 6.1.2, and control 5.23).
• Update the risk assessment to include each cloud service in scope: data stored, shared responsibility, provider assurance and exit risks.
• Decide treatments and update the SoA and risk treatment plan.
• Implement or evidence the cloud controls: provider due diligence, configuration baselines, monitoring.
• Get risk owner approval and keep the records ready for Stage 2.

Stage 1 findings are meant to be fixed before Stage 2, so this is normal and manageable.

1. Correction: fix the immediate problem (get the document approved and published).
2. Root cause: why was it missed? For example, the document management process has no approval step or reminder.
3. Corrective action: change the process so it does not recur, such as a mandatory approval workflow.
4. Check other documents for the same problem (extent of condition).
5. Submit the corrective action plan within the certification body's timeframe and keep evidence.
6. Verify effectiveness later. The auditor will check at the next audit.

• Clause 6.3 (planning of changes): plan the changes to the ISMS in a controlled way.
• Update the risk assessment for the new site and the new provider, and update the SoA if controls change.
• Apply physical security controls to the new office (clause 7 controls) and supplier/cloud controls (5.19–5.23) to the new provider.
• Update the scope statement if locations or services change, and inform the certification body, which may need to audit the new site.
• Update business continuity plans and asset inventory.

• The SoA with a justification for each exclusion, linked to the scope and the risk assessment.
• The risk assessment results showing no risk that the control would treat, or that the risk is treated in another way.
• Context evidence, such as 'no physical office' or 'no in-house software development', backed by facts (lease documents, organisation chart).
• Records that the risk owners and top management approved the SoA.

Note that a control can still apply partly through a supplier (for example the cloud provider's data centre). Then you manage it through supplier controls rather than excluding it.

• Major nonconformity: a requirement is not met in a way that raises significant doubt about the ISMS achieving its intended outcomes — e.g. no internal audit performed, no management review, or a systemic failure of a control area.
• Minor nonconformity: a single or occasional lapse that does not undermine the system as a whole — e.g. one missed access review.
• Opportunity for improvement / observation: not a nonconformity, but a suggestion.

Corrective action should address root cause, and its effectiveness is checked in a later audit.

All of these use the ISO harmonised structure (clauses 4–10 with common text), so they can share one integrated management system:

• Common processes: context, leadership, document control, internal audit, management review and corrective action.
• ISO 22301 (business continuity) links to 27001 controls 5.29 and 5.30.
• ISO/IEC 27701 adds privacy information management (PII controller and processor requirements) on top of information security.
• ISO/IEC 42001 (AI management system) uses the same structure for governing AI.
• Integrated audits by the certification body can reduce audit days and duplicate work.

Clause 9.1 requires you to decide what to monitor and measure, the methods, when, who analyses it and how results are evaluated.

• Measure both the ISMS processes and the controls: objectives achieved, risk treatment progress, audit results, incidents, control KPIs.
• Link metrics to information security objectives (clause 6.2), which must be measurable where practicable.
• Keep documented evidence of results and analysis, and use them in management review.
• Avoid measuring only activity (number of trainings). Include outcomes (phishing report rate, time to revoke access).

• Clause 5.1 (leadership and commitment) and clause 9.3 (management review) require top management to direct and review the ISMS. Without them, it is likely to be a major nonconformity.
• Find out why: meetings too long, too technical or badly timed.
• Redesign the review: a short pack covering the 9.3 inputs (status of actions, changes, performance, feedback, risk results, improvement opportunities), with clear decisions needed.
• Combine it with an existing leadership meeting if possible.
• Record minutes with decisions and actions, which is the evidence auditors want.

• A single isolated failure where the process exists and generally works is usually a minor nonconformity. It becomes major if the control is missing entirely, failing systematically, or has led to a serious incident.
• Provide context with evidence: the leaver process, the other samples that passed, and whether the account was actually used after the leave date (check logs).
• Do not argue the facts if they are correct. Explain the root cause and corrective action.
• Look for the extent of the problem: run a full reconciliation of all leavers against active accounts.