Which two of the following statements are true?

Which two of the following statements are true?
A . The benefit of certifying an ISMS is to show the accreditation certificate on the website.
B . The purpose of an ISMS is to demonstrate awareness of information security issues by management.
C . The benefit of certifying an ISMS is to increase the number of customers.
D . The benefits of implementing an ISMS primarily result from a reduction in information security risks.
E . The purpose of an ISMS is to apply a risk management process for preserving information security.
F . The purpose of an ISMS is to demonstrate compliance with regulatory requirements.

View Answer

Answer: DE

Explanation:

The benefits of implementing an ISMS primarily result from a reduction in information security risks.

E. The purpose of an ISMS is to apply a risk management process for preserving information security. Comprehensive and Detailed Explanation

According to the ISO 27001 standard, the benefits of implementing an ISMS include the following1:

Assuring customers and other stakeholders of the confidentiality, integrity and availability of information

Enhancing the ability to respond to information security incidents and minimize their impacts Improving the governance and management of information security

Reducing the costs and losses associated with information security breaches Increasing the competitiveness and reputation of the organization

Complying with legal, regulatory and contractual obligations The purpose of an ISMS is to provide a systematic approach to managing information security risks, based on the Plan-Do-Check-Act (PDCA)

cycle1. The ISMS enables the organization to establish, implement, maintain and continually improve its information security performance, in alignment with its business objectives and the needs and expectations of interested parties1. The ISMS consists of the following elements1: The information security policy and objectives

The scope and boundaries of the ISMS

The processes and procedures for information security risk assessment and treatment

The resources and competencies for information security

The roles and responsibilities for information security

The performance evaluation and improvement of the ISMS

The internal and external communication and awareness of the ISMS

Reference: ISO/IEC 27001:2013, Information technology ― Security techniques ― Information security management systems ― Requirements, clauses 1, 4, 5, 6, 7, 8, 9 and 10

PECB Candidate Handbook ISO 27001 Lead Auditor, pages 9-11 ISO/IEC 27001:2013 Information Security Management Standards 4 Key Benefits of ISO 27001 Implementation | ISMS.online ISO/IEC 27001:2022

An Introduction to the ISO 27001 ISMS | Secureframe