ITPEC IP April 2018 Question 39
In the description below concerning the ISMS conformity assessment scheme, which of the following is an appropriate combination of words to be inserted into blanks A and B?
It is a scheme for assessment and certification of a company or organization for its proper establishment and operation of the A management system and its conformity to the requirements of the ISMS certification standards. The assessment and certification are conducted by B.
Explanation
A: information security, B: a specific third party institution — ISMS certification is an independent assessment of an information security management system.
ISMS stands for Information Security Management System. In the ISMS conformity assessment scheme, a certification body (a specific third party institution, itself accredited) examines whether an organisation has established and operates its ISMS according to the certification standard, ISO/IEC 27001, and certifies it if it conforms.
Answer (d)
Why not others:
- •(a) — wrong on both blanks: personal information protection is the PrivacyMark scheme, and an internal audit department cannot certify its own organisation
- •(b) — blank A is wrong: the system assessed is for information security, not personal information protection
- •(c) — blank B is wrong: an internal audit checks the ISMS but is not independent, so it cannot grant certification
Key rule: Certification means an independent third party confirms conformity to a standard; an internal audit supports improvement but certifies nothing.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.