Free APMG-International ISO-IEC-27001-Foundation Exam Dumps August 2026

Clause 7.3 (Awareness) requires:

''Persons doing work under the organization's control shall be aware of: (a) the information security policy; (b) their contribution to the effectiveness of the ISMS, including the benefits of improved information security performance; (c) the implications of not conforming with the ISMS requirements.''

This applies not only to employees but also contractors and external parties under the organization's control. Competence (B) requires having skills, training, and experience, while Communication (C) covers defining communication processes (Clause 7.4). Nonconformity and corrective action (A) is part of Clause 10 (Improvement).

Therefore, the specific requirement that ensures contractors are made aware of the information security policies is found in Clause 7.3 Awareness. Correct answer: D.

Clause 5.1 (Leadership and Commitment) requires top management to demonstrate leadership by:

''ensuring the information security policy and the information security objectives are established and are compatible with the strategic direction of the organization;''

''ensuring the integration of the ISMS requirements into the organization's processes;''

''ensuring that the resources needed for the ISMS are available;''

Among the options, the one explicitly mandated is ensuring that information security objectives are established. Risk assessments (C) and implementing audit actions (D) are responsibilities of management but not the direct leadership evidence required in Clause 5.1. Communicating interested party feedback (A) is relevant but not specifically cited as leadership evidence. Thus, the verified answer is B.

Clause 4.4 of ISO/IEC 27001:2022 states:

''The organization shall establish, implement, maintain and continually improve an information security management system, including the processes needed and their interactions, in accordance with the requirements of this document.''

This requirement highlights that an ISMS is not static; it must evolve continuously to adapt to new risks, technologies, and business changes. Options A, C, and D are not mentioned in the clause. The continual improvement cycle is central to ISO standards, aligning with the Plan-Do-Check-Act (PDCA) model.

Thus, the missing words are ''continually improve.''

The requirements for internal audit are explicitly placed in Clause 9.2 (Performance Evaluation) of ISO/IEC 27001:2022. The standard requires:

''The organization shall conduct internal audits at planned intervals to provide information on whether the information security management system... conforms to the organization's own requirements... and to the requirements of this document.'' (9.2.1)

''The organization shall plan, establish, implement and maintain an audit programme(s)...'' (9.2.2)

This clause clearly falls under Performance Evaluation (Clause 9), not Planning (Clause 6), Operation (Clause 8), or Improvement (Clause 10). Therefore, the correct answer is C.

Clause 6.1.2 (Information security risk assessment) requires organizations to ''define and apply an information security risk assessment process that... establishes and maintains information security risk criteria, including criteria for accepting risk.''

This means that acceptable levels of risk (risk acceptance criteria) must be explicitly defined. These criteria ensure consistent decision-making when evaluating whether identified risks need further treatment or can be tolerated.

Option A is incorrect because exclusions relate to the ISMS scope (Clause 4.3), not risk assessment planning. Option B is not a requirement; effectiveness of risk assessment methods is not required to be measured, though methods must be applied consistently. Option D is false---the standard clearly specifies required elements for risk assessment.

Thus, the correct answer is C: The criteria for acceptable levels of risk.

Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27000 standards:

According to ISO/IEC 27000:2018, Clause 3.35:

''Integrity is the property of accuracy and completeness.''

This is one of the three core principles of information security (CIA triad):

Confidentiality: ensuring information is not made available to unauthorized persons (related to option B).

Integrity: ensuring data is accurate, complete, and unaltered except by authorized means.

Availability: ensuring information is accessible and usable when required (related to option A).

Option D incorrectly mixes availability and confidentiality. The precise ISO definition is accuracy and completeness, which matches option C.

Thus, the correct verified answer is C.