PECB ISO-IEC-27001-Lead-Implementer Exam With Confidence Using Practice Dumps

Annex A Control A.6.1 of ISO/IEC 27001:2022 (and ISO/IEC 27002:2022 Clause 6.1) covers Screening:

“Background verification checks on all candidates for employment should be carried out in accordance with relevant laws, regulations and ethics, and proportional to the business requirements, the classification of the information to be accessed, and the perceived risks.”

If collective agreements (e.g., labor union agreements) or local labor laws prohibit such checks, this is a valid justification for exclusion in the Statement of Applicability (SoA), per ISO/IEC 27001:2022 Clause 6.1.3 (d), which allows exclusions when properly justified.

According to ISO/IEC 27001, an incident management process must include processes for using knowledge gained from information security incidents to reduce the likelihood or impact of future incidents, and to improve the overall level of information security. This means that the organization should conduct a root cause analysis of the incidents, identify the lessons learned, and implement corrective actions to prevent recurrence or mitigate consequences. The organization should also document and communicate the results of the incident management process to relevant stakeholders, and update the risk assessment and treatment plan accordingly. (Must be taken from ISO/IEC 27001 : 2022 Lead Implementer resources)

ISO/IEC 27001 : 2022 Lead Implementer Study guide and documents, specifically:

ISO/IEC 27001:2022, clause 10.2 Nonconformity and corrective action

ISO/IEC 27001:2022, Annex A.16 Information security incident management

ISO/IEC TS 27022:2021, clause 7.5.3.16 Information security incident management process

PECB ISO/IEC 27001 Lead Implementer Course, Module 9: Incident Management

According to ISO/IEC 27006:2015, the prerequisites for a certification audit are:

The ISMS must be operational for a period of time that is sufficient to demonstrate its effectiveness and performance.

The organization must have conducted at least one internal audit and one management review of the ISMS prior to the certification audit.

The organization must provide the certification body with access to all the relevant documented information, records, personnel, and facilities related to the ISMS.

In the scenario, NetworkFuse has fulfilled these prerequisites, as it has had an operational ISMS for approximately two years, and it has performed internal audits and management reviews. Therefore, the correct answer is B.

ISO/IEC 27006:2015, clauses 9.1.1, 9.1.2, and 9.2.1.