ISO 27001 (ISMS) Interview Questions & Answers

ISO/IEC 27001 is a well-known standard in the industry to secure and manage IT resources from malicious attacks. This blog lists some interview questions that may be asked while interviewing candidates where ISO 27001 is one of the requisite fields.

ISO 27001 (ISMS) Interview Questions & Answers

Q. What is ISO/IEC 27001?

Ans: ISO/IEC 27001 is an international standard widely adopted by different countries to secure IT assets by providing security controls based on industry best practices. 27001 is published by ISO and the International Electrotechnical Commission (IEC). This standard provides recommendations for implementing an Information Security Management System (ISMS) irrespective of the size of an organization.

Q. What is the full name of ISO 27001?

Ans: Full name is "ISO/IEC 27001:2013-Information technology — Security techniques — Information security management systems — Requirements".

Q. What is the content of ISO 27001?

Ans: ISO/IEC 27001 standard includes 13 objectives. It provides recommendations and guidance on structure, risk assessment, access control policy, security related to staff, and compliance.

Q. Which standard guides on Risk Management?

Ans: Two standards ISO 27005 (Information technology — Security techniques — Information security risk management) and ISO 31000 (Risk management — Principles and guidelines) available related to risk management.

Q. Is there any need for ISO 27001-certified employees? If so, in which industry?

Ans: Yes there is a lot of demand for ISO 27001 professionals in the market. As more and more companies are managing the confidential data of clients and users, It is of utmost necessity to manage and secure data with the highest level of security.

Industries such as Health, Manufacturing Units, Financial companies, Telecom companies, etc. require ISO 27001 certification.

Q. What is Information Control Management System (ISMS)?

Ans: An ISMS is a collection of the following items to secure information assets from any attack that fails the CIA principle.

• Policies
• Procedures
• Guidelines
• Associated Resources and Activities

Q. What are the objectives for implementation of ISO 27001?

Ans: Below is the list of objectives for the implementation of ISO 27001:

• assurance to secure assets against threats
• providing a framework for providing risks
• improve controls on the environment
• provide legal and regulatory compliance

Q. Please mention controls (checklist points) associated with ISO 27001.

Ans: You need to refer to ISO/IEC 27001 for the controls. Refer to ISOIEC 27001 (ISMS) Checklist for Auditors.

Q. What are the differences between ISO 27001 and GDPR?

Ans:

Subject Area	ISO 27001	GDPR
Area covered	Confidentiality, Integrity and Availability	Privacy (mainly personal data)
Objective	helps in securing information assets (but not limited to personal data)	secure personal data
Requirement Type	not legal	legal
Fine	hefty monetary fine imposed in European countries on non-compliance	hefty monetary fine imposed in Eurapean countries on non-compliance

Q. Explain the ISMS family of standards.

Ans:

Type of Standard	Standard (ISO)
Vocabulary Standard	27000-Information technology — Security techniques — Information security management systems — Overview and vocabulary
Requirement Standards	27001-Information security management 27006-Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems 27009-Information security, cybersecurity and privacy protection — Sector-specific application of ISO/IEC 27001 — Requirements
Guidelines Standards	Sector-Specific Guidelines Standards
Sector Specific Guidelines Satndards	27010-Information technology — Security techniques — Information security management for inter-sector and inter-organizational communications 27011-Information technology — Security techniques — Code of practice for Information security controls based on ISO/IEC 27002 for telecommunications organizations 27017-Information technology — Security techniques — Code of practice for information security controls based on ISO/IEC 27002 for cloud services 27018-Information technology — Security techniques — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors 17019-Information technology — Security techniques — Information security controls for the energy utility industry