ISOISO 27001Implementation and OperationEASYFree question
A company wants to keep operational documentation lean. It asks how to decide how much to keep under Clause 8.1 for a highly complex, high-risk cryptographic key ceremony versus a simple low-risk task. The most standard-aligned answer is:
- A.Keep more for the complex high-risk ceremony, scaling documented information to the degree necessary for confidence the process ran as planned
- B.Keep the same for both tasks, setting a fixed page count in the template so each procedure looks consistent
- C.Keep less for the ceremony, limiting the records to the key custodians so the audit trail stays confidential
- D.Keep what the certification body requests, scaling the documents to the audit duration as set in the Stage 2 plan
Why A is correct
Clause 8.1 ties documented information to the degree necessary to have confidence processes are carried out as planned. A complex, high-risk key ceremony warrants more detailed records than a trivial task, so documentation should scale with complexity and risk rather than be a fixed quantity.
Know someone studying for ISO 27001? Send them this one.