Free ISO-IEC-27001-Lead-Implementer Exam Braindumps
ISO/IEC 27001 Lead Implementer Questions 91–95 (page: 20)

An organization has established a policy that provides the personnel with the information required to effectively deploy encryption solutions in order to protect organizational confidential data.
What type of policy is this?

Which of the following is NOT part of the steps required by ISO/IEC 27001 that an organization must take when a nonconformity is detected?

Scenario 17: InVid Electric is an American company that specializes in manufacturing, developing, and selling network hardware. The company has had an operational information security management system (ISMS) based on ISO/IEC 27001 requirements and a quality management system (QMS) based on ISO 9001 for approximately two years. Recently, it has applied for a combined certification audit in order to obtain certification against ISO/IEC 27001 and ISO 9001.
After selecting the certification body, InVid Electric prepared the employees for the audit. The company decided to not conduct a self-evaluation before the audit since, according to the top management, it was not necessary. In addition, it ensured the availability of documented information, including internal audit reports and management reviews, technologies in place, and the general operations of the ISMS and the QMS. However, the company requested from the certification body that the documentation could not be carried off-site.
Nonetheless, the audit was not performed within the scheduled time frame because InVid Electric rejected the assigned audit team leader and requested their replacement. According to the top management reasoning, the audit team leader represented a potential conflict of interest as the same audit team leader issued a recommendation for certification to InVid Electric’s main competitor.
According to scenario 17, InVid Electric did not conduct a self-evaluation prior to the audit. Is this compliant to ISO/IEC 27001?

An organization wants to enable the correlation and analysis of security-related events and other recorded data and to support investigations into information security incidents.
Which control should it implement?

Scenario 18: TroNicon SPEC provides IT and communications services. It helps data communication enterprises and network operators become multi-service providers. Due to the confidential nature of the information it handles, the company is obliged to ensure information security through globally recognized compliance frameworks; hence the decision to seek ISO/IEC 27001 certification.
TroNicon SPEC adopted a new approach to the privacy and security of information with a focus on preventing information security incidents, which before the ISMS implementation was based on informal information security practices.
The ISMS implementation helped TroNicon SPEC to reduce information security risks and formalize the company’s operations. Even though the company remained confident that its ISO/IEC 27001 certification will be granted, some minor nonconformities were reported after a third-party audit was conducted and TroNicon SPEC was required to submit an action plan for each minor nonconformity within a period of three months.
One of the nonconformities related to control 8.13 Information backup was analyzed and after using a cause-and-effect diagram, TroNicon SPEC concluded that the backup was not performed on a daily basis as required by their backup procedure, because of improper formatting of the information backup medium. To resolve this nonconformity, TroNicon SPEC submitted the following action plan: “The backup procedure will be updated to ensure that information backup is effectively managed by the Information and Communication Technology (ICT) Department (time frame: three weeks).”
On the other hand, after analyzing the implementation costs of corrective actions related to a nonconformity to control 5.17 Authentication information, the top management decided to accept the risk; hence drafting an action plan was unnecessary. They informed the internal auditor about this decision.
According to scenario 18, TroNicon SPEC aimed to eliminate the causes of adverse events by focusing on: