PECB ISO-IEC-27001-Lead-Implementer Exam With Confidence Using Practice Dumps

Annex A control A.8.26 Application security requirements mandates that security requirements must be identified, specified, and approved during the development or acquisition of applications.

“Information security requirements shall be identified, specified and approved when developing or acquiring applications.”

— ISO/IEC 27001:2022, Annex A, Control 8.26 Application security requirementsQuestion No. 22/80

What iS the purpose of ISO,'IEC 27002 clause 8ü8?

TO ensure all security requitements are addressed during application development

To ensure software is written securely to reduce information security vulnerabilities

To ensure secure system design principles are followed

According to ISO/IEC 27001:2022, clause 10.1, an action plan for nonconformities and corrective actions should include the following elements1:

What needs to be done

Who is responsible for doing it

When it will be completed

How the effectiveness of the actions will be evaluated

How the results of the actions will be documented

In scenario 9, the action plan only describes what needs to be done and who is responsible for doing it, but it does not specify when it will be completed, how the effectiveness of the actions will be evaluated, and how the results of the actions will be documented. Therefore, the action plan is not sufficient to eliminate the detected nonconformities.

1: ISO/IEC 27001:2022, Information technology — Security techniques — Information security management systems — Requirements, clause 10.1, Nonconformity and corrective action.

According to the ISO/IEC 27001:2022 Lead Implementer objectives and content, the maturity levels of information security controls are based on the ISO/IEC 15504 standard, which defines five levels of process capability: incomplete, performed, managed, established, and optimized1. Each level has a set of attributes that describe the characteristics of the process at that level. The level of defined corresponds to the attribute of process performance, which means that the process achieves its expected outcomes2. In this case, the control of two-factor authentication has been documented, standardized, and communicated, which implies that it has a clear purpose and expected outcomes. However, the control is not consistently implemented, monitored, or measured, which means that it does not meet the attributes of the higher levels of managed, established, or optimized. Therefore, the control is at the level of defined, which is the second level of maturity.

1: ISO/IEC 27001:2022 Lead Implementer Course Brochure, page 5

2: ISO/IEC 27001:2022 Lead Implementer Course Presentation, slide 25