PECB ISO-IEC-27001-Lead-Auditor Questions Answers

This approach aligns with ISO/IEC 27001:2022 because the standard explicitly allows top management to assign responsibilities and authorities for the effective operation of the ISMS, including reporting on its performance. Clause 5.3 of ISO/IEC 27001 requires top management to ensure that roles, responsibilities, and authorities related to information security are assigned and communicated within the organization.

While top management remains ultimately accountable for the ISMS, the standard does not require them to personally gather data, prepare reports, or perform operational monitoring activities. In practice, these tasks are often delegated to ISMS managers, security teams, or other designated personnel who are better positioned to collect and analyze performance data. What matters is that the information reaches top management in a timely and accurate manner so they can fulfill their governance responsibilities.

Option B is incorrect because it misunderstands accountability versus responsibility. Top management is accountable for ISMS performance, but they are not required to perform all related tasks themselves. Option C is incorrect because ISO/IEC 27001 does not mandate that a Chief Information Security Officer must be the reporting authority. The organization is free to define roles based on its structure, size, and context.

Therefore, assigning specific personnel to report on ISMS performance is fully consistent with ISO/IEC 27001 requirements.

The immediate consequence is suspension of certification, making option A correct. ISO/IEC 17021-1 clearly states that certified organizations must allow scheduled surveillance audits to verify continued conformity with the standard. Surveillance audits are mandatory and form part of the three-year certification cycle.

Refusing or failing to undergo a surveillance audit prevents the certification body from confirming that the ISMS remains effective and compliant. This creates a loss of confidence in the validity of the certification. As a result, certification bodies are required to suspend certification until the audit can be conducted and conformity re-established.

Option B is incorrect because certification validity is conditional upon ongoing surveillance. Certification does not remain valid if mandatory audits are refused. Option C is incorrect because transferring certification does not remove the obligation to undergo surveillance audits; a transfer would still require evidence of conformity and audit continuity.

Suspension is a protective mechanism to ensure that ISO/IEC 27001 certificates remain credible and trustworthy. If the organization later agrees to the audit and resolves issues, the certification may be reinstated. Therefore, refusal to undergo a surveillance audit leads to immediate suspension.

A certification body cannot certify an organization if it has provided consultancy services to that organization. This situation presents a conflict of interest, as the certification body is required to maintain impartiality and objectivity. The ISO/IEC 17021-1 standard, which sets out requirements for bodies providing audit and certification of management systems, specifies that providing both services to the same client is incompatible.

Comprehensive and Detailed In-Depth Explanation:

Specific controls are tailored security controls chosen based on risk assessments, industry best practices, and regulatory requirements. These align with ISO/IEC 27001:2022 Annex A controls, which organizations select based on their risk landscape.

General controls refer to broad security measures that apply to all organizations.

Strategic controls focus on high-level governance and long-term security goals, not detailed security implementations.