PECB Updated ISO-IEC-27001-Lead-Implementer Exam Questions and Answers by safwan

According to ISO/IEC 27001:2022, clause 9.3.3, the organization must retain documented information as evidence of the results of management reviews. The results of management reviews must include decisions and actions related to the ISMS policy, objectives, risks, opportunities, resources, and communication. Documenting the results of management reviews is important to ensure the accountability, traceability, and effectiveness of the ISMS. It also helps the organization to monitor and measure the performance and improvement of the ISMS, and to demonstrate compliance with the requirements of ISO/IEC 27001:2022. Therefore, an organization that has an ISMS in place and conducts management reviews at planned intervals, but does not retain documented information on the results, is not in accordance with the requirements of ISO/IEC 27001. (From the PECB ISO/IEC 27001 Lead Implementer Course Manual, page 107)

ISO/IEC 27001:2022 allows organizations flexibility in how they manage and implement their ISMS, so long as the standard’s requirements are met. The methodology and sequence of steps can be adapted to best suit the organization’s size, context, and complexity.

“Organizations may adapt the methodology for ISMS implementation to their own context, and the sequence of steps may be modified as needed.”

— ISO/IEC 27003:2017, Clause 6.1; ISO/IEC 27001:2022, Introduction

The power/interest matrix is a tool that can be used to identify, analyze, and manage interested parties according to ISO/IEC 27001:2022. The power/interest matrix is a two-dimensional diagram that plots the level of power and interest of each interested party in relation to the organization’s information security objectives. The power/interest matrix can help the organization to prioritize the interested parties, understand their expectations and needs, and develop appropriate communication and engagement strategies. The power/interest matrix can also help the organization to identify potential risks and opportunities related to the interested parties.