Free ISO 27001 Foundation Exam Flashcards

Confidentiality, Integrity, and Availability are the three foundational information security properties used throughout PECB's Foundation materials. The exam tests each property individually and in combined scenarios.

The property that information is not made available or disclosed to unauthorized individuals, entities, or processes. Enforced through access control, encryption, and need-to-know restrictions - distinct from integrity (accuracy) and availability (accessibility).

The property of accuracy and completeness - information has not been altered or destroyed in an unauthorized manner. Hashing, digital signatures, and change/version control protect integrity.

The property of being accessible and usable on demand by an authorized entity. A published PECB sample question uses this exact wording - don't confuse it with confidentiality (who can see it) or integrity (is it accurate).

Authenticity is the property that an entity is what it claims to be, verified through authentication (passwords, tokens, certificates). Non-repudiation proves a claimed event occurred and stops the originator from denying it later, typically via digital signatures and audit logs.

Accountability ensures actions can be uniquely traced to the responsible entity, supported by authentication plus audit logging. Reliability is the property of consistent, intended behavior and results across systems and processes - a broader operational property.

Anything that has value to the organization and therefore needs protection. Assets are not just hardware - information itself, software, people, and services all qualify.

A potential cause of an unwanted incident that may result in harm to a system or organization. Threats can be deliberate (attackers), accidental (human error), or environmental (natural disaster) - they are the 'potential cause,' not the weakness itself.

A weakness of an asset or control that can be exploited by one or more threats. Remember the chain: a threat exploits a vulnerability to affect an asset.

The effect of uncertainty on objectives, aligned with ISO 31000 - broader than the older 'threat x vulnerability x impact' shorthand some candidates expect. This effect is what an organization identifies, analyzes, and evaluates during risk assessment.

The adverse change to assets or to the organization caused by an information security incident. Impact is combined with likelihood during risk evaluation to determine the risk level.

A measure that is modifying risk - a safeguard applied to reduce the likelihood or impact of a threat exploiting a vulnerability. Annex A of ISO/IEC 27001:2022 lists 93 reference controls an organization selects from.

The current ISO/IEC 27000:2026 gives an overview of ISMS-family concepts, principles, and relationships. ISO/IEC 27001:2022 remains the requirements standard used for organizational certification.

27001 specifies the ISMS requirements an organization is certified against (Clauses 4-10 plus the Annex A control list). 27002 is a code of practice giving detailed implementation guidance for those controls and is NOT itself a certifiable standard.

Guidance on implementing an ISMS - practical, step-by-step advice for meeting the ISO/IEC 27001 requirements. It complements 27002 (control guidance) and 27005 (risk guidance).

Guidance on information security measurement - how to design and use metrics to evaluate ISMS and control effectiveness, directly supporting Clause 9.1 (monitoring, measurement, analysis, and evaluation).

Guidance on information security risk management aligned with ISO/IEC 27001 - elaborating on risk identification, analysis, evaluation, treatment, and communication in more depth than Clause 6.1 alone.

27006 sets requirements that CERTIFICATION BODIES must meet to audit and certify ISMS, supplementing ISO/IEC 17021-1. 27007 gives guidelines for actually AUDITING an ISMS, applying ISO 19011's general audit principles to information security.

27017 provides cloud-specific security control guidance for both cloud providers and customers generally. 27018 is narrower - a code of practice specifically for protecting personally identifiable information (PII) in public clouds acting as PII processors.

It extends both standards with additional requirements and controls for managing privacy, establishing a Privacy Information Management System (PIMS) that supports GDPR and similar privacy regulations.

Information Security Management System - a systematic, risk-based approach to managing sensitive information so it stays confidential, intact, and available. ISO/IEC 27001:2022 specifies the requirements an ISMS must meet.

Plan-Do-Check-Act - the iterative model for continual ISMS improvement. Plan sets objectives and processes, Do implements them, Check monitors and audits against the plan, and Act drives corrective and improvement action, closing the loop back to Plan.

A set of interrelated or interacting elements an organization uses to establish policies and objectives and the processes to achieve them. This shared high-level structure and terminology is why ISO/IEC 27001, ISO 9001, and ISO 14001 look so similar in outline.

Under IaaS, the customer secures the guest OS, applications, and data while the provider secures the underlying infrastructure. Moving toward SaaS, the provider takes on more of the stack (platform and application), reducing - but never eliminating - the customer's data and access-management responsibilities.

AI systems can be vulnerable to adversarial inputs and training-data poisoning that undermine integrity and availability. Standard ISO/IEC 27001 controls (access control, secure development, data integrity) still apply, but the threat surface differs from traditional IT systems.

Clauses 4 through 10. Clauses 1-3 (Scope, Normative references, Terms and definitions) are introductory only and are not themselves audited requirements.

Requires identifying internal and external issues and interested parties' requirements, then using that analysis to determine the ISMS scope (4.3) - the foundation all later planning builds on.

Requires top management to demonstrate leadership and commitment, establish the information security policy, and assign ISMS roles, responsibilities, and authorities.

Covers addressing risks and opportunities plus risk assessment and treatment (6.1), setting measurable information security objectives (6.2), and planning changes to the ISMS (6.3).

Covers the enabling resources an ISMS needs to function: resources, competence, awareness, communication, and documented information.

Covers operational planning and control - where the organization actually carries out the risk assessment and executes the risk treatment plan that Clause 6 required it to design.

Covers monitoring, measurement, analysis, and evaluation (9.1), internal audit (9.2), and management review (9.3) - the 'Check' activities that test whether the ISMS is actually working.

Risk identification (finding risks to assets), risk analysis (understanding likelihood and consequences), and risk evaluation (comparing analyzed risk against acceptance criteria to prioritize treatment).

To select and apply options that bring risk within an acceptable level of residual risk - not to eliminate all risk, which is rarely possible or cost-effective.

Modify applies controls to reduce a risk's likelihood or impact (e.g., adding MFA). Share transfers all or part of the risk to a third party - commonly through insurance, outsourcing, or contracts - though accountability typically cannot be fully transferred.

Retain (accept) means taking no further action because residual risk is already below acceptance criteria. Avoid means a deliberate decision not to start, or to discontinue, the activity that creates the risk.

The person or entity with the accountability and authority to manage a specific risk, per Clause 6.1.2. Risk owners must approve both the risk treatment plan and acceptance of any residual risk.

Residual risk is what remains after treatment has been applied and must be approved by the risk owner. The risk treatment plan documents the chosen options, the controls used to implement them (cross-referenced in the SoA), responsible owners, and timelines.

ISO/IEC 27001:2022 Annex A has 93 controls across 4 themes. The prior 2013 version had 114 controls across 14 categories - the 2022 revision consolidated duplicates and added 11 new controls.

Organizational = 37 controls (A.5.x, the largest theme), People = 8 controls (A.6.x, the smallest), Physical = 14 controls (A.7.x), Technological = 34 controls (A.8.x). Numbering directly reflects the theme.

A mandatory document (Clause 6.1.3 d) that identifies the controls an organization has determined necessary, justifies including or excluding each one compared to Annex A, and states each control's implementation status.

Because it is the bridge between risk treatment and Annex A - it directly evidences which controls were chosen and why. Auditors verify the SoA reconciles with both the risk treatment plan and the actual controls in place.

At minimum: ISMS scope, information security policy, risk assessment/treatment process and results, the SoA, security objectives, evidence of competence, and records of internal audits, management reviews, nonconformities, and corrective actions.

Yes - Annex A is a reference set, not a mandatory checklist. Controls may be excluded if justified in the SoA and if the exclusion does not undermine the organization's ability to meet its security requirements.

Under 5.1, demonstrate leadership and commitment (integrate ISMS into business processes, provide resources, communicate importance). Under 5.2, top management must personally establish and approve the information security policy - drafting can be delegated, approval cannot.

A high-level SPECIFIC policy - more focused than a general organization-wide business policy, but broader and more strategic than a topic-specific policy (like an access-control policy). This exact distinction appears in PECB's own published sample questions.

Competence requires that people whose work affects the ISMS are qualified via education, training, or experience - with retained evidence. Awareness is broader: everyone under the organization's control must know the security policy, their contribution to the ISMS, and the consequences of not conforming.

Internal audit is an independent, objective check of whether the ISMS conforms to requirements and is effectively implemented. Management review is top management's own periodic assessment - using audit results as one input - of the ISMS's continuing suitability, adequacy, and effectiveness.

A nonconformity is the non-fulfillment of a requirement; Clause 10.2 requires reacting to it, eliminating its cause, and verifying the fix. Continual improvement (10.1) is the broader, ongoing enhancement of ISMS suitability, adequacy, and effectiveness - the 'Act' phase that closes PDCA.

Preventive controls act before an event to stop it (e.g., access control, MFA). Detective controls discover an event after it begins (e.g., a SIEM alert on failed logins). Corrective controls restore or limit damage after an incident (e.g., restoring from backup).