Question 4
(Topic 1)
You are an experienced audit team leader conducting a third-party surveillance audit of an organization that designs websites for its clients. You are currently reviewing the organization’s Statement of Applicability. Based on the requirements of ISO/IEC 27001, which two of the following observations about the Statement of Applicability are true? (Choose two.)
Select an option, then click Submit answer.
- ○ The Statement of Applicability must be reviewed at Management Review
- ○ The Statement of Applicability must be reviewed at least annualy
- ○ Justification is only required for any controls that the organization chooses to exclude
- ○ The Statement of Applicability is owned and amended by the organization’s top management
- ○ A Statement of Applicability must be produced by organizations seeking ISO/IEC 27001 conformity
- ○ Justification for both the inclusion and exclusion of Annex A controls in the Statement of Applicability is required
