ISOISO 27001DocumentationEASYFree question
What mandatory documented information does ISO 27001 require?
- A.ISMS scope, information security policy, risk register, asset inventory, incident response plan, business continuity plan, and supplier contracts
- B.Information security policy, a documented procedure for each Annex A control, and the annual penetration test report
- C.ISMS scope, policy, risk assessment process, risk treatment plan, SoA, objectives, competence evidence, and operational documents
- D.ISMS scope, policy, risk methodology, asset register, access control matrix, and the internal audit schedule
Why C is correct
Mandatory documents include ISMS scope, policy, risk assessment/treatment processes, SoA, objectives, competence evidence, operational controls, and monitoring results.
Know someone studying for ISO 27001? Send them this one.