Scenario 2: Beauty is a cosmetics company that has recently switched to an e-commerce model, leaving the traditional retail. The top management has decided to build their own custom platform in-house and outsource the payment process to an external provider operating online payments systems that support online money transfers. Due to this transformation of the business model, a number of security controls were implemented based on the identified threats and vulnerabilities associated to critical assets. To protect customers' information.
Beauty's employees had to sign a confidentiality agreement. In addition, the company reviewed all user access rights so that only authorized personnel can have access to sensitive files and drafted a new segregation of duties chart. However, the transition was difficult for the IT team, who had to deal with a security incident not long after transitioning to the e commerce model. After investigating the incident, the team concluded that due to the out-of-date anti-malware software, an attacker gamed access to their files and exposed customers' information, including their names and home addresses. The IT team decided to stop using the old anti-malware software and install a new one which would automatically remove malicious code in case of similar incidents. The new software was installed in every workstation within the company. After installing the new software, the team updated it with the latest malware definitions and enabled the automatic update feature to keep it up to date at all times.
Additionally, they established an authentication process that requires a user identification and password when accessing sensitive information. In addition, Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information in order to raise awareness on the importance of system and network security. Which statement below suggests that Beauty has implemented a managerial control that helps avoid the occurrence of incidents? Refer to scenario 2.
-
A
Beauty's employees signed a confidentiality agreement
-
B
Beauty conducted a number of information security awareness sessions for the IT team and other employees that have access to confidential information
-
C
Beauty updated the segregation of duties chart
Reveal answer details
Close answer details
Correct answerB
ExplanationExplanation: Managerial controls are administrative actions that are designed to prevent or reduce the likelihood of security incidents by influencing human behavior. They include policies, procedures, guidelines, standards, training, and awareness programs. In scenario 2, Beauty has implemented a managerial control by conducting information security awareness sessions for the IT team and other employees that have access to confidential information. These sessions aim to educate the staff on the importance of system and network security, the potential threats and vulnerabilities, and the best practices to follow to avoid the occurrence of incidents. By raising the level of awareness and knowledge of the employees, Beauty can reduce the human errors and negligence that might compromise the security of the information assets.
References:
ISO/IEC 27001:2022 Lead Implementer Course Content, Module 7:
Implementation of an ISMS based on ISO/IEC 27001:20221
ISO/IEC 27001:2022 Information Security,
Cybersecurity and Privacy Protection, Clause 7.2: Competence2
ISO/IEC 27002:2022 Code of practice
for information security controls, Clause 7.2.2:
Information security awareness, education and training3
Scenario 5: Operaze is a small software development company that develops applications for various companies around the world. Recently, the company conducted a risk assessment to assess the information security risks that could arise from operating in a digital landscape. Using different testing methods, including penetration Resting and code review, the company identified some issues in its ICT systems, including improper user permissions, misconfigured security settings, and insecure network configurations. To resolve these issues and enhance information security, Operaze decided to implement an information security management system (ISMS) based on ISO/IEC 27001. Considering that Operaze is a small company, the entire IT team was involved in the ISMS implementation project. Initially, the company analyzed the business requirements and the internal and external environment, identified its key processes and activities, and identified and analyzed the interested parties
In addition, the top management of Operaze decided to Include most of the company's departments within the ISMS scope. The defined scope included the organizational and physical boundaries. The IT team drafted an information security policy and communicated it to all relevant interested parties In addition, other specific policies were developed to elaborate on security issues and the roles and responsibilities were assigned to all interested parties. Following that, the HR manager claimed that the paperwork created by ISMS does not justify its value and the implementation of the ISMS should be canceled.
However, the top management determined that this claim was invalid and organized an awareness session to explain the benefits of the ISMS to all interested parties. Operaze decided to migrate Its physical servers to their virtual servers on third-party infrastructure. The new cloud computing solution brought additional changes to the company Operaze's top management, on the other hand, aimed to not only implement an effective ISMS but also ensure the smooth running of the ISMS operations. In this situation, Operaze's top management concluded that the services of external experts were required to implement their information security strategies. The IT team, on the other hand, decided to initiate a change in the ISMS scope and implemented the required modifications to the processes of the company. Based on scenario 5. after migrating to cloud.
Operaze's IT team changed the ISMS scope and implemented all the required modifications Is this acceptable?
-
A
Yes, because the ISMS scope should be changed when there are changes to the external environment
-
B
No, because the company has already defined the ISMS scope
-
C
No, because any change in ISMS scope should be accepted by the management
Reveal answer details
Close answer details
Correct answerC
ExplanationExplanation: According to ISO/IEC 27001:2022, clause 4.3, the organization shall determine the scope of the ISMS by considering the internal and external issues, the requirements of interested parties, and the interfaces and dependencies with other organizations. The scope shall be available as documented information and shall state what is included and what is excluded from the ISMS. The scope shall be reviewed and updated as necessary, and any changes shall be approved by the top management.
Therefore, it is not acceptable for the IT team to change the ISMS scope and implement the required modifications without the approval of the management.
References:
ISO/IEC 27001:2022, clause 4.3;
PECB ISO/IEC 27001 Lead Implementer Course, Module 4, slide 10.
What should an organization allocate to ensure the maintenance and improvement of the information security management system?
-
A
The appropriate transfer to operations
-
B
Sufficient resources, such as the budget, qualified personnel, and required tools
-
C
The documented information required by ISO/IEC 27001
Reveal answer details
Close answer details
Correct answerB
ExplanationExplanation: According to ISO/IEC 27001:2022, clause 10.2.2, the organization shall define and apply an information security incident management process that includes the following activities:
reporting information security events and weaknesses; assessing information security events and classifying them as information security incidents;
responding to information security incidents according to their classification; learning from information security incidents, including identifying causes, taking corrective actions and preventive actions, and
communicating the results and actions taken;
collecting evidence, where applicable.
The standard does not specify who should perform these activities, as long as they are done in a consistent and effective manner. Therefore, the organization may choose to conduct forensic investigation internally or by using external consultants, depending on its needs, resources, and capabilities. However, the organization should ensure that the external consultants are competent, trustworthy, and comply with the organization's policies and procedures.
References:
ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection -- Information
security management systems -- Requirements, clause 10.2.2
PECB ISO/IEC 27001 Lead Implementer
Course, Module 10: Incident Management.
Scenario 4: TradeB. a commercial bank that has just entered the market, accepts deposits from its clients and offers basic financial services and loans for investments. TradeB has decided to implement an information security management system (ISMS) based on ISO/IEC 27001 Having no experience of a management [^system implementation, TradeB's top management contracted two experts to direct and manage the ISMS implementation project. First, the project team analyzed the 93 controls of ISO/IEC 27001 Annex A and listed only the security controls deemed applicable to the company and their objectives Based on this analysis, they drafted the Statement of Applicability. Afterward, they conducted a risk assessment, during which they identified assets, such as hardware, software, and networks, as well as threats and vulnerabilities, assessed potential consequences and likelihood, and determined the level of risks based on three nonnumerical categories (low, medium, and high). They evaluated the risks based on the risk evaluation criteria and decided to treat only the high risk category.
They also decided to focus primarily on the unauthorized use of administrator rights and system interruptions due to several hardware failures by establishing a new version of the access control policy, implementing controls to manage and control user access, and implementing a control for ICT readiness for business continuity Lastly, they drafted a risk assessment report, in which they wrote that if after the implementation of these security controls the level of risk is below the acceptable level, the risks will be accepted Based on scenario 4, what type of assets were identified during risk assessment?
-
A
-
B
-
C
Reveal answer details
Close answer details
Correct answerA
ExplanationExplanation: According to ISO/IEC 27005:2021, there are three types of assets in information security risk management: primary assets, supporting assets, and business assets. Primary assets are the information and business processes that support the organization's objectives and operations. Supporting assets are the resources that enable the primary assets to function, such as hardware, software, networks, people, facilities, etc. Business assets are the outcomes or benefits that the organization expects from the primary assets, such as reputation, market share, customer satisfaction, etc. (Must be taken from ISO/IEC 27001 : 2022 Lead Implementer resources) In scenario 4, the assets that were identified during risk assessment are hardware, software, and networks, which are examples of supporting assets. These assets are necessary for the information and business processes of TradeB to operate, but they are not the main focus of the risk assessment. The risk assessment should also consider the primary assets and the business assets, as well as the threats and vulnerabilities that affect them, and the potential impacts and likelihood of information security incidents.
References:
ISO/IEC 27001 : 2022 Lead Implementer Study guide and documents, specifically:
ISO/IEC 27001:2022, clause 6.1.2 Information security risk assessment ISO/IEC 27005:2021, clause 5.2
Asset identification and valuation PECB ISO/IEC 27001 Lead Implementer Course, Module 6: Risk Management
Scenario 7: InfoSec is a multinational corporation headquartered in Boston, MA, which provides professional electronics, gaming, and entertainment services. After facing numerous information security incidents, InfoSec has decided to establish teams and implement measures to prevent potential incidents in the future Emma, Bob. and Anna were hired as the new members of InfoSec's information security team, which consists of a security architecture team, an incident response team (IRT) and a forensics team Emma's job is to create information security plans, policies, protocols, and training to prepare InfoSec to respond to incidents effectively Emma and Bob would be full-time employees of InfoSec, whereas Anna was contracted as an external consultant. Bob, a network expert, will deploy a screened subnet network architecture.
This architecture will isolate the demilitarized zone (OMZ) to which hosted public services are attached and InfoSec's publicly accessible resources from their private network Thus, InfoSec will be able to block potential attackers from causing unwanted events inside the company's network. Bob is also responsible for ensuring that a thorough evaluation of the nature of an unexpected event is conducted, including the details on how the event happened and what or whom it might affect. Anna will create records of the data, reviews, analysis, and reports in order to keep evidence for the purpose of disciplinary and legal action, and use them to prevent future incidents. To do the work accordingly, she should be aware of the company's information security incident management policy beforehand Among others, this policy specifies the type of records to be created, the place where they should be kept, and the format and content that specific record types should have. Based on this scenario, answer the following question: Based on his tasks, which team is Bob part of?
-
A
Security architecture team
-
B
-
C
Reveal answer details
Close answer details
Correct answerC
ExplanationExplanation: Based on his tasks, Bob is part of the incident response team (IRT) of InfoSec. According to ISO/IEC 27035-2:2023, the IRT is a team of appropriately skilled and trusted members of an organization that responds to and resolves incidents in a coordinated way 1. One of the tasks of the IRT is to conduct an evaluation of the nature of an unexpected event, including the details on how the event happened and what or whom it might affect 1. This is consistent with Bob's responsibility of ensuring that a thorough evaluation of the nature of an unexpected event is conducted. Therefore, Bob belongs to the incident response team.
References:
ISO/IEC 27035-2:2023 (en), Information technology -- Information security incident management -- Part 2:
Guidelines to plan and prepare for incident response1
Response to Information Security Incidents | ISMS.online2
Which statement is an example of risk retention?
-
A
An organization has decided to release the software even though some minor bugs have not been fixed yet
-
B
An organization has implemented a data loss protection software
-
C
An organization terminates work in the construction site during a severe storm
Reveal answer details
Close answer details
Correct answerA
ExplanationExplanation: According to ISO/IEC 27001 : 2022 Lead Implementer, risk retention is one of the four risk treatment options that an organization can choose to deal with unacceptable risks. Risk retention means that the organization accepts the risk without taking any action to reduce its likelihood or impact. It applies to risks that are either too costly or impractical to address, or that have a low probability or impact.
Therefore, an example of risk retention is when an organization decides to release the software even though some minor bugs have not been fixed yet. This implies that the organization has assessed the risk of releasing the software with bugs and has determined that it is acceptable, either because the bugs are not critical or because the cost of fixing them would outweigh the benefits.
References:
ISO/IEC 27001 : 2022 Lead Implementer Study guide and documents, section 8.3.2 Risk treatment
ISO/IEC 27001 : 2022 Lead Implementer Info Kit, page 14, Risk management process3, ISO 27001: Top
risk treatment options and controls explained
Scenario 1: HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software. The software is also used to schedule appointments, create customized medical reports, store patients' data and medical history, and communicate with all the [^involved parties, including parents, other physicians, and the medical laboratory staff. Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use. The top management of HealthGenic immediately informed the company that had developed the software
about the issue. The software company fixed the issue; however, in the process of doing so, it modified
some files that comprised sensitive information related to HealthGenic's patients. The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients' privacy. Based on scenario 1.
what is a potential impact of the loss of integrity of information in HealthGenic?
-
A
Disruption of operations and performance degradation
-
B
Incomplete and incorrect medical reports
-
C
Service interruptions and complicated user interface
Reveal answer details
Close answer details
Correct answerB
ExplanationExplanation: The loss of integrity of information in HealthGenic means that the information was modified or corrupted in an unauthorized or improper way, resulting in inaccurate, incomplete, or unreliable data. This can have a serious impact on the quality and safety of the medical services provided by HealthGenic, as well as the trust and satisfaction of the patients and their families. In particular, incomplete and incorrect medical reports can lead to: Misdiagnosis or delayed diagnosis of the patients' conditions, which can affect their treatment and recovery.
Prescription of wrong or inappropriate medications or dosages, which can cause adverse effects or interactions.
Violation of the patients' privacy and confidentiality, which can expose them to identity theft, fraud, or discrimination.
Legal liability and reputational damage for HealthGenic, which can result in lawsuits, fines, or loss of customers.
Therefore, it is essential for HealthGenic to ensure the integrity of its information by implementing appropriate security controls and measures, such as encryption, authentication, backup, audit, and incident response.
References:
ISO/IEC 27001:2022 Lead Implementer Course Guide1
ISO/IEC 27001:2022 Lead Implementer Info Kit2
ISO/IEC 27001:2022 Information Security Management Systems - Requirements3 ISO/IEC 27002:2022
Code of Practice for Information Security Controls4
Scenario 5: Operaze is a small software development company that develops applications for various companies around the world. Recently, the company conducted a risk assessment to assess the information security risks that could arise from operating in a digital landscape. Using different testing methods, including penetration Resting and code review, the company identified some issues in its ICT systems, including improper user permissions, misconfigured security settings, and insecure network configurations. To resolve these issues and enhance information security, Operaze decided to implement an information security management system (ISMS) based on ISO/IEC 27001. Considering that Operaze is a small company, the entire IT team was involved in the ISMS implementation project. Initially, the company analyzed the business requirements and the internal and external environment, identified its key processes and activities, and identified and analyzed the interested parties
In addition, the top management of Operaze decided to Include most of the company's departments within the ISMS scope. The defined scope included the organizational and physical boundaries. The IT team drafted an information security policy and communicated it to all relevant interested parties In addition, other specific policies were developed to elaborate on security issues and the roles and responsibilities were assigned to all interested parties. Following that, the HR manager claimed that the paperwork created by ISMS does not justify its value and the implementation of the ISMS should be canceled.
However, the top management determined that this claim was invalid and organized an awareness session to explain the benefits of the ISMS to all interested parties. Operaze decided to migrate Its physical servers to their virtual servers on third-party infrastructure. The new cloud computing solution brought additional changes to the company Operaze's top management, on the other hand, aimed to not only implement an effective ISMS but also ensure the smooth running of the ISMS operations. In this situation, Operaze's top management concluded that the services of external experts were required to implement their information security strategies. The IT team, on the other hand, decided to initiate a change in the ISMS scope and implemented the required modifications to the processes of the company. Based on scenario 5.
in which category of the interested parties does the MR manager of Operaze belong?
-
A
Positively influenced interested parties, because the ISMS will increase the effectiveness and efficiency of the HR Department
-
B
Negatively influenced interested parties, because the HR Department will deal with more documentation
-
C
Reveal answer details
Close answer details
Correct answerB
ExplanationExplanation: According to ISO/IEC 27001, interested parties are those who can affect, be affected by, or perceive themselves to be affected by the organization's information security activities, products, or services. Interested parties can be classified into four categories based on their influence and interest in the ISMS: Positively influenced interested parties: those who benefit from the ISMS and support its implementation and operation Negatively influenced interested parties: those who are adversely affected by the ISMS and oppose its implementation and operation High-interest interested parties: those who have a strong interest in the ISMS and its outcomes, regardless of their influence Low-interest interested parties: those who have a weak interest in the ISMS and its outcomes, regardless of their influence
In scenario 5, the HR manager of Operaze belongs to the category of negatively influenced interested parties, because he/she perceives that the ISMS will create more paperwork and documentation for the HR Department, and therefore opposes its implementation and operation. The HR manager does not benefit from the ISMS and does not support its objectives and requirements.
References:
2: Introduction to Information Security Management System (ISMS) concepts as required by ISO/IEC 27001 ISO/IEC 27001 Lead Implementer Course, Module
4: Planning the ISMS based on ISO/IEC 27001 ISO/IEC 27001 Lead Implementer Course, Module
6: Implementing the ISMS based on ISO/IEC 27001 ISO/IEC 27001 Lead Implementer Course, Module
7: Performance evaluation, monitoring and measurement of the ISMS based on ISO/IEC 27001 ISO/IEC 27001 Lead Implementer Course, Module
8: Continual improvement of the ISMS based on ISO/IEC 27001 ISO/IEC 27001 Lead Implementer Course, Module
9: Preparing for the ISMS certification audit
Diana works as a customer service representative for a large e-commerce company. One day, she accidently modified the order details of a customer without their permission Due to this error, the customer received an incorrect product. Which information security principle was breached in this case7
-
A
-
B
-
C
Reveal answer details
Close answer details
Correct answerC
ExplanationExplanation: According to ISO/IEC 27001:2022, information security controls are measures that are implemented to protect the confidentiality, integrity, and availability of information assets 1. Controls can be preventive, detective, or corrective, depending on their purpose and nature 2. Preventive controls aim to prevent or deter the occurrence of a security incident or reduce its likelihood. Detective controls aim to detect or discover the occurrence of a security incident or its symptoms. Corrective controls aim to correct or restore the normal state of an asset or a process after a security incident or mitigate its impact 2.
In this scenario, Socket Inc. implemented several security controls to prevent information security incidents from recurring, such as: Segregation of networks: This is a preventive and technical control that involves separating different parts of a network into smaller segments, using devices such as routers, firewalls, or VPNs, to limit the access and communication between them 3. This can enhance the security and performance of the network, as well as reduce the administrative efforts and costs 3. Privileged access rights: This is a preventive and administrative control that involves granting access to information assets or systems only to authorized personnel who have a legitimate need to access them, based on their roles and responsibilities 4. This can reduce the risk of unauthorized access, misuse, or modification of information assets or systems 4.
Cryptographic controls: This is a preventive and technical control that involves the use of cryptography, which is the science of protecting information by transforming it into an unreadable format, to protect the confidentiality, integrity, and authenticity of information assets or systems. This can prevent unauthorized access, modification, or disclosure of information assets or systems. Information security threat management: This is a preventive and administrative control that involves the identification, analysis, and response to information security threats, which are any incidents that could negatively affect the confidentiality, integrity, or availability of information assets or systems. This can help the organization to anticipate, prevent, or mitigate the impact of information security threats.
Information security integration into project management: This is a preventive and administrative control that involves the incorporation of information security requirements and controls into the planning, execution, and closure of projects, which are temporary endeavors undertaken to create a unique product, service, or result. This can ensure that information security risks and opportunities are identified and addressed throughout the project life cycle. However, information backup is not a preventive control, but a corrective control. Information backup is a corrective and technical control that involves the creation and maintenance of copies of information assets or systems, using dedicated software and utilities, to ensure that they can be recovered in case of data loss, corruption, accidental deletion, or cyber incidents. This can help the organization to restore the normal state of information assets or systems after a security incident or mitigate its impact. Therefore, information backup does not prevent information security incidents from recurring, but rather helps the organization to recover from them.
Question 10
Single choice
An organization documented each security control that it Implemented by describing their functions in detail.
Is this compliant with ISO/IEC 27001?
-
A
No, the standard requires to document only the operation of processes and controls, so no description of each security control is needed
-
B
No, because the documented information should have a strict format, including the date, version number and author identification
-
C
Yes, but documenting each security control and not the process in general will make it difficult to review the documented information
Reveal answer details
Close answer details
Correct answerC
ExplanationExplanation: According to ISO/IEC 27001:2022, clause 7.5, an organization is required to maintain documented information to support the operation of its processes and to have confidence that the processes are being carried out as planned. This includes documenting the information security policy, the scope of the ISMS, the risk assessment and treatment methodology, the statement of applicability, the risk treatment plan, the information security objectives, and the results of monitoring, measurement, analysis, evaluation, internal audit, and management review. However, the standard does not specify the level of detail or the format of the documented information, as long as it is suitable for the organization's needs and context. Therefore, documenting each security control that is implemented by describing their functions in detail is not a violation of the standard, but it may not be the most efficient or effective way to document the ISMS. Documenting each security control separately may make it harder to review, update, and communicate the documented information, and may also create unnecessary duplication or inconsistency.
A better approach would be to document the processes and activities that involve the use of security controls, and to reference the relevant controls from Annex A or other sources. This way, the documented information would be more aligned with the process approach and the Plan-Do-Check-Act cycle that the standard promotes.
References:
ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection -- Information security management systems -- Requirements, clauses 4.3, 5.2, 6.1, 6.2, 7.5, 8.2, 8.3, 9.1, 9.2, 9.3, and Annex A ISO/IEC 27001:2022 Lead Implementer objectives and content, 4 and 5
Question 11
Single choice
Scenario 10: NetworkFuse develops, manufactures, and sells network hardware. The company has had an operational information security management system (ISMS) based on ISO/IEC 27001 requirements and a quality management system (QMS) based on ISO 9001 for approximately two years. Recently, it has applied for a j^ombined certification audit in order to obtain certification against ISO/IEC 27001 and ISO
9001. After selecting the certification body, NetworkFuse prepared the employees for the audit The company decided to not conduct a self-evaluation before the audit since, according to the top management, it was not necessary. In addition, it ensured the availability of documented information, including internal audit reports and management reviews, technologies in place, and the general operations of the ISMS and the QMS. However, the company requested from the certification body that the documentation could not be carried off-site However, the audit was not performed within the scheduled days because NetworkFuse rejected the audit team leader assigned and requested their replacement.
The company asserted that the same audit team leader issued a recommendation for certification to its main competitor, which, for the company's top management, was a potential conflict of interest. The request was not accepted by the certification body Based on scenario 10. NetworkFuse did not conduct a self-evaluation of the ISMS before the audit.
Is this compliant to ISO/IEC 27001?
-
A
No, the auditee must review the requirements of clauses 4 to 10 before the conduct of a certification audit
-
B
Yes, the standard indicates that the auditee shall rely only on internal audit and management review reports to prepare for the certification audit
-
C
Yes, the standard does not require to conduct a self-evaluation before the audit but it is a good practice to follow
Reveal answer details
Close answer details
Correct answerC
ExplanationExplanation: According to the ISO/IEC 27001:2022 standard, the organization is responsible for establishing, implementing, maintaining and continually improving the information security management system (ISMS) in accordance with the requirements of the standard (section 4.1). The standard does not explicitly require the organization to conduct a self-evaluation of the ISMS before the certification audit, which is an external audit performed by an independent certification body to verify the conformity of the ISMS with the standard and to grant the certification (section 9.3.2). However, the standard does require the organization to conduct internal audits (section 9.2) and management reviews (section 9.3) of the ISMS at planned intervals to ensure its effectiveness, suitability and adequacy, and to identify opportunities for improvement and corrective actions. Therefore, conducting a self-evaluation of the ISMS before the certification audit is a good practice to follow, as it can help the organization to prepare for the audit, to identify any gaps or nonconformities, and to demonstrate its commitment and readiness for the certification.
References:
ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection -- Information security
management systems -- Requirements1 ISO/IEC 27001 Lead Implementer Info Kit
SELF EVALUATION CHECKLIST ISO/IEC 27001:20222
Question 12
Single choice
Which tool is used to identify, analyze, and manage interested parties?
-
A
The probability/impact matrix
-
B
The power/interest matrix
-
C
The likelihood/severity matrix
Reveal answer details
Close answer details
Correct answerB
ExplanationExplanation: The power/interest matrix is a tool that can be used to identify, analyze, and manage interested parties according to ISO/IEC 27001:2022. The power/interest matrix is a two-dimensional diagram that plots the level of power and interest of each interested party in relation to the organization's information security objectives. The power/interest matrix can help the organization to prioritize the interested parties, understand their expectations and needs, and develop appropriate communication and engagement strategies. The power/interest matrix can also help the organization to identify potential risks
and opportunities related to the interested parties.
References:
ISO/IEC 27001:2022, clause 4.2
PECB ISO/IEC 27001 Lead Implementer Course, Module 4, slide 12.
|