ISOISO 27001Implementation and OperationEASYFree question
What does 'awareness' mean in the context of Clause 7.3?
- A.Personnel must have passed a certified exam on Annex A, completed risk training for their role, and signed the acceptable use policy
- B.Personnel must be aware of the information security policy, their contribution to the ISMS, and implications of nonconformance
- C.Personnel must know the Statement of Applicability controls by number, the names of auditors, and the dates of the next certification audit
- D.Staff must be informed of the risk register contents, their asset ownership duties, and the incident reporting hotline
Why B is correct
Clause 7.3 requires that persons working under the organization's control are aware of the IS policy, their role, and consequences of not conforming.
Know someone studying for ISO 27001? Send them this one.