MENU
Which of the following options should be included in the ISMS policy?
Suggested Answer: C
Get Premium I27001F Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Under ISO/IEC 27001:2022, the information security policy must be appropriate to the purpose of the organization, include information security objectives or provide the framework for setting them, and include a commitment to satisfy applicable requirements and to continual improvement of the ISMS. The standard does not require technical product names, company history, or prior audit results to appear in the policy. Therefore, option C is the best and correct answer.
=======
12 comments · newest first
LE
Lezlie
3 months ago
B is important too. Understanding motivation helps in implementation.
JO
Josefa
3 months ago
Agreed! Without clear objectives, what's the point?
MA
Marti
3 months ago
I think C is crucial. Security objectives guide the whole ISMS.
SA
Salina
4 months ago
B) seems irrelevant to the policy itself.
DE
Deeanna
4 months ago
I think D) is crucial for improvement.
SA
Sabine
4 months ago
Surprised that company history is even an option!
DO
Dorcas
6 months ago
A) is not really necessary, right?
CR
Crista
6 months ago
Definitely need the info security objectives!
KA
Kasandra
6 months ago
I practiced a similar question, and I remember that the ISMS policy should focus on objectives and frameworks, so C seems like the best choice to me.
KA
Kathryn
7 months ago
I feel like option D could be relevant too, especially if it helps show how the ISMS has evolved, but I can't recall if it's a must-have.
FA
Fannie
7 months ago
I'm not sure about option B; I remember something about including motivation, but does it really belong in the policy itself?
NI
Nicolette
7 months ago
I think option C is definitely important because the information security objectives guide the whole ISMS policy, right?