ISO-27001-LI practice examsIn development

1. A gap analysis finds that the organization classifies information but has no handling and labeling procedures. This represents a gap against which controls?

1. A.5.12 (Classification) only
2. Only A.8.12 (Data leakage prevention)
3. A.5.12 (Classification of information) and A.5.13 (Labelling of information) and A.5.10 (Acceptable use) — correct
4. Only A.7.x physical controls

Why: Information classification alone is insufficient. A.5.12 covers classification, A.5.13 covers labeling (applying classification markings), and A.5.10 addresses acceptable use rules for different classification levels. Without labeling and handling procedures, classified information cannot be consistently protected according to its classification.

2. When maintaining the Statement of Applicability, how often should it be reviewed and updated according to ISO 27001 best practices?

1. The SoA is a static document created once during implementation and only updated during the three-year recertification audit
2. The SoA should be reviewed whenever risk assessments are updated, organizational changes occur, or new controls are needed — correct
3. The SoA should be reviewed and updated on a fixed monthly schedule regardless of whether any changes have occurred
4. SoA maintenance is the exclusive responsibility of the certification body and must not be modified between audits

Why: The Statement of Applicability is a live document tied to the risk assessment: it is reviewed whenever the risk assessment is updated, whenever the organization changes in a way that affects controls, and whenever control selection changes. Treating it as a one-off implementation artefact is how it drifts out of step with what is actually running.