IPA IP 2020 Question 69

Understanding the needs and expectations of interested parties — the ISMS starts from its context, before any risk work.

ISO/IEC 27001 (JIS Q 27001 in Japan) orders the work by its clauses:

1. Context of the organization (clause 4): the internal and external issues, the needs and expectations of interested parties such as customers, regulators and staff, and from these the scope of the ISMS
2. Planning (clause 6): information security risk assessment, then risk treatment
3. Operation (clause 8): carrying out the assessments and the treatment plan
4. Performance evaluation (clause 9): monitoring, internal audit, management review

Risks can only be assessed against requirements and a scope that are already known, so understanding interested parties comes first.

Answer (d)

Why not others:

• •(a) — risk assessment is planning work that needs the scope and requirements fixed first
• •(b) — risk treatment follows risk assessment, since it chooses controls for the risks found
• •(c) — an internal audit checks an ISMS that is already running, so it comes late in the cycle

Key rule: In ISO/IEC 27001 the order is context and interested parties, then risk assessment, then risk treatment, then operation, then audit and review.

Security · AI-written, may contain errors