PECB Certified ISO/IEC 27001 Transition (Transition-27001)

✅ Option C (Correct)
Reasoning: According to ISO/IEC 27001, access control rules must align with both business requirements (e.g., operational necessity, regulatory compliance) and information security requirements (e.g., confidentiality, integrity, availability of information). This ensures access controls effectively support the organization's objectives and protect its information assets comprehensively.

❌ Why the other choices are incorrect:
* Option A is incorrect: ICT continuity requirements are a specific aspect of business operations and information security. While access controls support continuity, they are not the sole or primary basis for establishing all access rules. Access controls address a broader spectrum of security concerns.
* Option B is incorrect: Business continuity objectives are important, but like ICT continuity, they represent a subset of the overall drivers for access control. Comprehensive access control policies are established to meet all business and information security needs, not just those related to continuity.

ISO/IEC 27001:2022 primarily updates its Annex A controls to align with ISO/IEC 27002:2022. Crucially, both 27001 versions maintain the High-Level Structure (HLS) for clauses 4-10, meaning their core structure is largely consistent. Both standards serve as normative documents, providing requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).

✅ Option B: Annex A 5.29 Information security during disruption (Correct)

Reasoning: Annex A 5.29 in ISO/IEC 27001:2022 directly covers the requirement to maintain information security continuity during disruptions. This control explicitly focuses on establishing processes to ensure the required level of information security is sustained even when organizational operations are disrupted, which aligns perfectly with the intent of the previous ISO/IEC 27001:2013 clause concerning continuity for information security during disruptions (A.17.1.1).

❌ Why the other choices are incorrect:

• Option A is incorrect: Annex A 5.26, "Response to information security incidents," focuses on the procedures and responsibilities for managing and learning from actual security incidents, rather than the broader planning for continuous information security during any disruption.
• Option C is incorrect: Annex A 5.30, "ICT readiness for business continuity," pertains to ensuring the availability and resilience of Information and Communication Technology (ICT) systems to support business continuity. While related, it specifically addresses the technical readiness of ICT, not the overarching information security processes for continuity during any form of disruption.

• Option A is incorrect: Controls deemed necessary through an organization's risk assessment remain mandatory. Annex A controls were never all mandatory; their selection has always been risk-based. The wording change clarifies Annex A as a *source* of controls, not a declaration that controls are no longer mandatory.
• Option B is incorrect: Annex A lists controls, not requirements in the normative sense. The main clauses (e.g., 6.1.3) contain the requirements that dictate how controls, including those from Annex A, are to be selected and applied based on a risk assessment. The change clarifies Annex A's role in supporting these main clause requirements.

According to ISO/IEC 27001:2022, Annex A 5.36 (Information security policies, rules and standards), organizations are required to review policies, rules, and standards for information security regularly and if significant changes occur. Option B, "On a regular basis," directly reflects this requirement.

Option A is incorrect because reviews are not limited to only when the ISMS is modified; regular reviews are also mandated. Option C is incorrect as the standard specifies "regularly" but does not enforce a strict "yearly" interval, allowing organizations flexibility to define their regular review periods based on their specific context and risk profile.

✅ Option A (Correct)

Reasoning: In ISO/IEC 27001:2022, Annex A has been updated to provide a reference list of 93 information security controls. Unlike the 2013 version, it no longer includes explicit 'control objectives'. The detailed purpose and implementation guidance for these controls are now found in ISO/IEC 27002:2022.

❌ Why the other choices are incorrect:

• Option B is incorrect: Annex A of ISO/IEC 27001:2022 itself primarily lists the controls. Their purpose and additional information (like attributes and implementation guidance) are provided in the companion standard, ISO/IEC 27002:2022, to which Annex A refers.
• Option C is incorrect: Annex A provides a set of information security controls. It does not provide guidelines for implementing the management system requirements found in clauses 4 to 10 of ISO/IEC 27001. Those clauses define the ISMS requirements, while Annex A lists controls for addressing information security risks identified by the ISMS.

✅ Option A (Correct)

Reasoning: ISO/IEC 27001:2013 Annex A includes control A.16.1.2, explicitly named "Reporting information security events." Option A correctly identifies this specific topic. Although the control number "6.8" is inaccurate (the correct control is A.16.1.2), the textual description provided in option A is the most relevant and accurate among the choices for information security event reporting.

❌ Why the other choices are incorrect:

• Option B is incorrect: Annex A 6.3 (or A.7.2.2 in 27001:2013) refers to "Information security awareness, education and training," which is not related to information security event reporting.
• Option C is incorrect: Annex A 5.24 is an invalid control number for ISO/IEC 27001:2013. While related to incident management (which is Annex A.16), "planning and preparation" is a broader concept, and "reporting events" is a specific sub-process.

✅ Option A (Correct)

Reasoning: In ISO/IEC 27001:2022, "business" refers to the organization's fundamental activities and objectives that define its existence and strategic direction. The ISMS must be aligned with and support these core purposes to protect the information critical to achieving them, irrespective of whether the organization is commercial, governmental, or non-profit.

❌ Why the other choices are incorrect:

• Option B is incorrect: This definition is circular. "Business" is not defined by activities needed for ISMS implementation. Instead, the ISMS supports the overarching business activities.
• Option C is incorrect: While business involves structured activities and goals, limiting it to "a specific organizational goal" is too narrow. Business encompasses the entire scope and multiple integrated objectives that contribute to the organization's overall existence and mission.