Free ISO-IEC-27001-Lead-Implementer Exam Braindumps
ISO/IEC 27001 Lead Implementer Questions 51–55 (page: 12)

Who should be involved, among others, in the draft, review, and validation of information security procedures?

Scenario 30: AegisCure is a Barcelona-based healthcare data analytics company specializing in AI-powered solutions that transform how medical institutions utilize data. Serving hospitals, research centers, and pharmaceutical firms, AegisCure focuses on enhancing patient care and operational efficiency. Its advanced analytics platform supports a variety of critical use cases, including early disease prediction, risk-based patient segmentation, personalized treatment strategies, streamlined clinical workflows, and accelerated drug discovery processes. Due to the sensitive nature of health data and the evolving regulatory landscape, AegisCure implemented an information security management system (ISMS) in alignment with ISO/IEC 27001.
To ensure consistency and company-wide integration, AegisCure implemented the ISMS comprehensively, embedding security processes across all departments and functions rather than isolating certain processes. The initiative was guided by a structured methodology grounded in ISO standards and aligned with ISO/IEC 27001 requirements, which provided a clear implementation roadmap. This methodology segmented the project into four phases (define and establish, implement and operate, monitor and review, and maintain and improve), each comprising defined steps, activities, and context-specific tasks.
A key component of the implementation was a thorough risk assessment process. AegisCure began by identifying its critical information system components on which one or several business assets are based, particularly the most tangible ones. The company assessed the potential consequences and likelihood of various risks using predefined risk criteria and clearly characterized terminology. The risks were rated using a tiered scale with descriptive levels, such as "very low" to "very high," each linked to defined values to support consistency and clarity in risk evaluation.
Following the completion of the risk assessment, AegisCure conducted a targeted review of specific but not all security controls listed in Annex A of ISO/IEC 27001 to determine their relevance within the company's operational context. The controls were selected and implemented directly based on the identified risks. This process finished with the development of the Statement of Applicability (SoA). Priority was given to addressing high-risk areas, particularly the misuse of administrator privileges and disruptions caused by recurring hardware failures. In response, the company revised its access control policy, enforced stricter user access management controls, and introduced ICT readiness measures to enhance business continuity.
Based on the scenario above, answer the following question.
Did AegisCure draft the SoA in accordance with ISO/IEC 27001? Refer to scenario 30.

Scenario 18: TroNicon SPEC provides IT and communications services. It helps data communication enterprises and network operators become multi-service providers. Due to the confidential nature of the information it handles, the company is obliged to ensure information security through globally recognized compliance frameworks; hence the decision to seek ISO/IEC 27001 certification.
TroNicon SPEC adopted a new approach to the privacy and security of information with a focus on preventing information security incidents, which before the ISMS implementation was based on informal information security practices.
The ISMS implementation helped TroNicon SPEC to reduce information security risks and formalize the company’s operations. Even though the company remained confident that its ISO/IEC 27001 certification will be granted, some minor nonconformities were reported after a third-party audit was conducted and TroNicon SPEC was required to submit an action plan for each minor nonconformity within a period of three months.
One of the nonconformities related to control 8.13 Information backup was analyzed and after using a cause-and-effect diagram, TroNicon SPEC concluded that the backup was not performed on a daily basis as required by their backup procedure, because of improper formatting of the information backup medium. To resolve this nonconformity, TroNicon SPEC submitted the following action plan: “The backup procedure will be updated to ensure that information backup is effectively managed by the Information and Communication Technology (ICT) Department (time frame: three weeks).”
On the other hand, after analyzing the implementation costs of corrective actions related to a nonconformity to control 5.17 Authentication information, the top management decided to accept the risk; hence drafting an action plan was unnecessary. They informed the internal auditor about this decision.
Based on scenario 18, the top management decided to accept the risk related to a nonconformity to control 5.17 Authentication information. Is this acceptable?

Scenario 22: OpenTech, with its headquarters in San Francisco, specializes in information and communication technology (ICT) solutions. Its clientele primarily includes data communication enterprises and network operators. The company’s core objective is to enable its clients a smooth transition into multi-service providers, aligning their operations with the complex demands of the digital landscape.
Recently, Tim, the internal auditor of OpenTech, conducted an internal audit which uncovered nonconformities related to their monitoring procedures and system vulnerabilities. In response to the identified nonconformities, OpenTech decided to employ a comprehensive problem-solving approach to solve these issues systematically. The method encompasses a team-oriented approach, aiming to identify, correct, and eliminate the root causes of issues. This approach involves several steps. First, establish a group of experts with deep knowledge of processes and controls. Next, break down the nonconformity into measurable components and implement interim containment measures. Then, identify potential root causes and select and verify permanent corrective actions. Finally, put those actions into practice, validate them, take steps to prevent recurrence, and recognize and acknowledge the team’s efforts.
Following the analysis of the root cause of the nonconformities, OpenTech’s ISMS project manager, Julia, developed a list of potential actions to address the identified nonconformities. Julia carefully evaluated the list to ensure that each action would effectively eliminate the root cause of the respective nonconformity.
While assessing potential corrective action for addressing a nonconformity, Julia identified the issue as significant and assessed a high likelihood of its reoccurrence. Consequently, she chose to implement temporary corrective actions. Afterward, Julia combined all the nonconformities into a single action plan and sought approval from the top management. The submitted action plan was written as follows:
A new version of the access control policy will be established and new restrictions will be created to ensure that network access is effectively managed and monitored by the Information and Communication Technology (ICT) Department.
However, Julia’s submitted action plan was not approved by top management. The reason cited was that a general action plan meant to address all nonconformities was deemed unacceptable. Consequently, Julia revised the action plan and submitted separate ones for approval. Unfortunately, Julia did not adhere to the organization’s specified deadline for submission, resulting in a delay in the corrective action process, and notably, the revised action plans lacked a defined schedule for execution.
Did Julia make an appropriate decision regarding the nonconformities with a high likelihood of reoccurrence? Refer to scenario 22.

Which tool is used to identify and manage interested parties?