Tap to reveal what to do
- Do this first
- Why
- Control reference
- Common mistake
Keys: F or Space flip · → or G got it · ← or R review again · S shuffle. On a phone, swipe right or left.
You are all caught up
Cards you marked “Got it” come back after a few days so they stick. Cards to review again return sooner.
Topic mastery
Key concepts
- Clauses 4 to 10
- The mandatory ISMS requirements: context, leadership, planning, support, operation, performance evaluation and improvement.
- Annex A (2022)
- 93 reference controls in four themes: organisational, people, physical and technological.
- Statement of Applicability
- Lists the necessary controls, why they are included or excluded and whether they are implemented.
- Internal audit and management review
- The ISMS checks itself (9.2) and top management decides on improvements (9.3).
- Nonconformity
- A requirement not met. Fix it, find the root cause and verify the fix worked (10.2).
How an auditor tests it
- Confirm the scope (4.3) and that the SoA matches the risk treatment plan.
- Check the internal audit programme covers the ISMS and auditors are impartial.
- Compare management review minutes against the required inputs and outputs.
- Sample Annex A controls and obtain dated evidence across the audit period.
- Follow up previous nonconformities and test the effectiveness of corrective actions.
Evidence examples
- Scope statement and SoA
- Risk assessment and treatment plan
- Internal audit reports and programme
- Management review minutes
- Corrective action log with root causes
Interview angles
- What is the difference between a major and a minor nonconformity?
- How do you justify an Annex A exclusion?
- How would you choose a sample for change management testing?
- What changed between ISO 27001:2013 and 2022?