Discuss CertiProf I27001F Exam Topic 3 Question 4

The information security policy must be known by:

AThe quality management representative

BThe IT Manager

CThe IT Security Manager

DEveryone in the organization

Suggested Answer: D

ISO/IEC 27001:2022 requires the information security policy to be available as documented information, communicated within the organization, and available to interested parties as appropriate. In practical terms, this means the policy must be communicated to relevant persons in the organization so they understand the direction and expectations related to information security. Among the options provided, the best and correct answer is D, because the policy is intended to be known broadly across the organization, not restricted to a single role or department.

Get Premium I27001F Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Isadora 3 months ago

I agree, but the IT Security Manager should lead the training.

Chuck 3 months ago

Definitely D! If only a few know, it’s not effective.

Toshia 3 months ago

I think everyone should know it. Security is a team effort.

Harley 4 months ago

The IT Manager should definitely be in the loop too!

Tatum 4 months ago

Wait, everyone? That seems a bit much, doesn’t it?

Sharika 4 months ago

Agreed, it’s crucial for all employees to be aware.

Jenifer 6 months ago

I think just the IT Security Manager should know.

Daniela 6 months ago

Definitely everyone in the organization!

Rashida 6 months ago

I recall discussing this in class, and I think it was mentioned that the IT Manager has to be aware, but I’m not confident about the others.

Alex 7 months ago

I feel like the quality management representative should know it too, but I lean towards option D. Everyone needs to be aware of security policies!

Rosalind 7 months ago

I’m not entirely sure, but I remember a practice question that emphasized the role of the IT Security Manager. Maybe they are the key person?

Eliseo 7 months ago

I think the policy should be known by everyone in the organization, right? It’s important for all employees to understand security protocols.

CertiProf I27001F Exam - Topic 3 Question 4 Discussion