I27001F Exam Dumps : Certified ISO/IEC 27001:2022 Foundation

Annex A of ISO/IEC 27001:2022 contains the reference set of information security controls used to support risk treatment decisions. In the 2022 edition, these controls are organized into four themes: organizational, people, physical, and technological controls. Annex A is not a set of ISMS implementation steps and it is not a risk management guideline. Its role is to provide a structured set of control objectives and controls that may be selected as part of risk treatment. Therefore, option B is the correct answer.

=======

ISO/IEC 27001:2022 requires the information security policy to be available as documented information, communicated within the organization, and available to interested parties as appropriate. In practical terms, this means the policy must be communicated to relevant persons in the organization so they understand the direction and expectations related to information security. Among the options provided, the best and correct answer is D, because the policy is intended to be known broadly across the organization, not restricted to a single role or department.

ISO/IEC 27001:2022 requires documented information to be controlled so that it is available and suitable for use where and when needed, and adequately protected. The standard does not require purchasing software, hiring consultants, or assigning external validation as mandatory conditions for compliance. Those may be organizational choices, but they are not requirements of the standard. Therefore, option A is the correct answer.

=======