PECB ISO-IEC-27001-Lead-Implementer Exam With Confidence Using Practice Dumps

ISO/IEC 27701 is the international standard that extends ISO/IEC 27001 and ISO/IEC 27002 for privacy information management. It specifies the requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS).

"ISO/IEC 27701:2019 — Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines."

— ISO/IEC 27701:2019, Foreword

According to the ISO/IEC 27001:2022 standard, an information security policy is a high-level document that defines the management approach and objectives for information security within the organization. It should include, among other things, the legal and regulatory obligations imposed upon the organization, such as compliance with laws, contracts, agreements, and standards that are relevant to information security. The information security policy should also provide the basis for establishing, implementing, maintaining, and continually improving the information security management system (ISMS).

ISO/IEC 27001:2022, Clause 5.2 Policy

ISO/IEC 27002:2022, Clause 5.1 Policies for information security

PECB ISO/IEC 27001 Lead Implementer Course, Module 3: Information Security Management System (ISMS)

Based on his tasks, Bob is part of the incident response team (IRT) of InfoSec. According to the ISO/IEC 27001:2022 standard, an IRT is a group of individuals who are responsible for responding to information security incidents in a timely and effective manner. The IRT should have the authority, skills, and resources to perform the following activities:

Identify and analyze information security incidents and their impact

Contain, eradicate, and recover from information security incidents

Communicate with relevant stakeholders and authorities

Document and report on information security incidents and their outcomes

Review and improve the information security incident management process and controls

Bob’s job is to deploy a network architecture that can prevent potential attackers from accessing InfoSec’s private network, and to conduct a thorough evaluation of the nature and impact of any unexpected events that might occur. These tasks are aligned with the objectives and responsibilities of an IRT, as defined by the ISO/IEC 27001:2022 standard.

ISO/IEC 27001:2022, Information technology — Security techniques — Information security management systems — Requirements, Clause 10.2, Information security incident management

ISO/IEC 27035-1:2023, Information technology — Information security incident management — Part 1: Principles of incident management

ISO/IEC 27035-2:2023, Information technology — Information security incident management — Part 2: Guidelines to plan and prepare for incident response

PECB, ISO/IEC 27001 Lead Implementer Course, Module 10, Information security incident management