ISO/IEC 27001 Foundation — Self-Study Unit
Section 1 of 9 · Reference: ISO/IEC 27001:2022 (incl. Amd 1:2024), Introduction and Clauses 1 to 3, supplemented by terms from ISO/IEC 27000
Information security fundamentals
The first section lays the foundation: why information security is a leadership issue for an organization in the first place, which assets are protected, which protection goals apply and how information security differs from data protection and pure IT security.
At a glance
The core relationships of this section as a diagramNote on this sectionLessons 2 and 3 (Carbanak, history of the standard) are not part of the standard. They are based on publicly reported facts and on the history of the standard; they serve to provide context, not exam preparation in the narrower sense.
The three protection goals of information security
Confidentiality, integrity and availability — what the ISMS preserves through the risk management process (Introduction 0.1, Clause 6.1.2 c) 1))
Confidentiality violated
Data exfiltration from the customer database. The system keeps running, the data are correct — they are just no longer secret.
A.5.15 A.8.24
Integrity violated
A faulty import mixes up application data. Everything is available and confidential — but wrong.
A.8.32 A.8.15
Availability violated
The citizen portal is down for four hours. Nothing has leaked, nothing has been falsified — it is just not reachable.
A.8.13 A.8.14
From BS 7799 to ISO/IEC 27001:2022 (incl. Amd 1:2024)
The sequence of editions of the standard and its adoption in Europe and Germany
The 9 lessons
Click to expand · a tick on the left marks a lesson as completedInformation security is a strategic decision of management
Strategic decision
Establishment, design and scope depend on the organization’s objectives, requirements and structure.
Introduction 0.1Part of governance
The ISMS is integrated into the overall management structure and processes, not operated alongside them.
Introduction 0.1Change anticipated
Objectives, requirements and structure change over time; the ISMS must be able to respond to this.
Introduction 0.1Market access
Certificates are increasingly required in tenders and supplier audits.
Practice
Remember: Exam trap: the standard explicitly describes the adoption of an ISMS as a strategic decision, not a technical one. For an organization, information is an asset comparable to personnel, buildings or capital. An ISMS protects this asset systematically through a risk management process, thereby building confidence among internal and external interested parties.
Clause 1- The requirements are generic and are intended to be applicable to all organizations, regardless of type or size.
Practice- Today, the main external drivers are legal requirements, requirements from tenders and supplier audits, and management liability.
Practical example
A state authority awards a contract for the operation of a specialized IT application. In the procurement procedure, it requires a valid ISO/IEC 27001 certificate for the contractor’s operations unit. For the bidder, the ISMS is therefore not an end in itself but a prerequisite for market access – and the scope of the certificate must cover exactly the service being offered.
Knowledge check for lesson 1
2 questionsQuestion Which statements about the adoption of an information security management system (ISMS) are correct according to the introduction of ISO/IEC 27001?
Multiple choice: one to three answers are correct.
ExplanationIntroduction 0.1 describes the adoption of the ISMS as a strategic decision that is to be integrated into the management structure; design and scope, by contrast, depend on needs, objectives, size and structure and are therefore not uniform.Question To which organizations do the requirements of ISO/IEC 27001 apply according to Clause 1?
Multiple choice: one to three answers are correct.
ExplanationClause 1 defines the scope as applying to all organizations regardless of type and size; an existing quality management system or a particular legal form is not a prerequisite.Carbanak shows an attack chain using legitimate privileges
- 1Phishing emailA crafted attachment gives the attackers a way in via employees.Background
- 2Undetected observationMonths of observing work processes with regular privileges.Background
- 3Misuse of privilegesTransfers and cash withdrawals are initiated using legitimate privileges.Background
- 4Reporting and responseA well-rehearsed incident process with assessment, response and lessons learned limits the damage.A.5.24 to A.5.27
Remember: The attack did not exploit a technical vulnerability but people and regular privileges – technology alone would not have stopped it. The Carbanak case is not part of the standard but a textbook example of how undetected attacks can run for a long time within legitimate privileges. It illustrates why countermeasures must address all three levels – people, processes and technology – at the same time.
Background- After gaining access, the attackers operated undetected for a long time with regular privileges – attacks then look like normal operations.
A.6.3- Countermeasure on the people side: awareness, education and training of personnel.
A.8.16- Countermeasure on the technical side: monitoring networks, systems and applications for anomalous behaviour.
A.5.24 to A.5.27- Countermeasure on the process side: planned incident management, assessment of events, documented response and evaluation of lessons learned.
Practical example
A local government authority analyses the case in an awareness training session and derives two specific rules from it: first, every person reports a suspicious attachment via a defined channel, even when in doubt and without fear of consequences (A.6.8). Second, payment approvals above a certain amount are granted according to the four-eyes principle (A.5.3 Segregation of duties).
Knowledge check for lesson 2
2 questionsQuestion What lesson for an ISMS can be drawn from an attack in which the attackers act exclusively with fraudulently obtained but legitimate privileges?
Multiple choice: one to three answers are correct.
ExplanationA.8.16 requires monitoring for anomalous behaviour as a complement to prevention; an attacker acting with legitimate privileges is not detected by purely preventive controls.Question Which Annex A controls address the weaknesses exploited in an attack such as Carbanak?
Multiple choice: one to three answers are correct.
ExplanationThe initial access was gained via phishing, which training (A.6.3) counteracts, and remained undetected for a long time because events were not reported (A.6.8); encryption of data at rest alone does not prevent the misuse of legitimate access.From 114 controls in 14 clauses to 93 controls in four themes
- 2005First international editionderived from BS 7799-2
- 2013 / 2022Subsequent editions2022 is the basis of the current edition
- 93Controls in Annex Apreviously 114 in 14 clauses (2013 edition)
- 2024-01Current editionISO/IEC 27001:2022 (incl. Amd 1:2024)
Remember: Exam trap: what matters is not the number of controls but the alignment with the Harmonized Structure for management system standards. The version history is purely background knowledge and is not itself examined as part of the requirements of the standard, but it helps you to correctly interpret different edition references in the literature and on certificates. Anyone checking a certificate should recognize which edition it refers to, as Annex A and the clause structure differ between the editions.
National foreword- DIN EN ISO/IEC 27001:2024-01 (the German edition) supersedes DIN EN ISO/IEC 27001:2017-06.
Foreword- The third edition cancels and replaces the second edition (ISO/IEC 27001:2013), including the Technical Corrigenda Cor 1:2014 and Cor 2:2015.
Previous editions- Sequence of German editions: DIN ISO/IEC 27001:2008-09, 2015-03, Corrigendum 1:2017-03, DIN EN ISO/IEC 27001:2017-06.
Practical example
A company with a certificate based on the 2013 edition must completely revise its Statement of Applicability when transitioning to the 2022 edition: controls have been merged, eleven controls are new and the numbering changes throughout. Mapping the old controls to the new ones is therefore the first step.
Knowledge check for lesson 3
2 questionsQuestion Which statements about the current edition of ISO/IEC 27001 compared with its predecessor are correct?
Multiple choice: one to three answers are correct.
ExplanationThe foreword names the alignment with Annex SL and ISO/IEC 27002:2022 as the main change; Annex A was restructured from 114 to 93 controls. The standard does not establish any legal obligation to certify.Question What does the transition to the current edition mean for an organization whose certificate is still based on the 2013 edition?
Multiple choice: one to three answers are correct.
ExplanationThe fundamental reorganization of Annex A makes it necessary to map the old controls to the new ones and to revise the Statement of Applicability; neither a change of certification body nor continued use without changes follows from this.The 93 controls are unevenly distributed across four themes
Figures in Controls
Remember: Organizational and technological controls together make up more than three quarters of Annex A. Information security covers people, processes and technology equally and protects information regardless of its form – digital, on paper or in conversation. The standard anchors this holistic approach through requirements for context, leadership, planning, support, operation, evaluation and improvement.
Clauses 4 to 10- The structure of requirements covers the complete management cycle; none of the clauses may be excluded.
Introduction 0.1- Information security must be considered when processes and information systems are designed, not added on afterwards.
A.5.35- The organization’s approach to managing information security and its implementation, including people, processes and technologies, is reviewed independently.
Practice- Security is only as strong as its weakest link – and that is rarely the encryption.
Practical example
A department introduces a well-secured business application: encryption, multi-factor authentication, hardened servers. But the printouts of the work lists lie openly in the corridor printer. The technical control is ineffective because the physical level (A.7.7 Clear desk and clear screen) and the organizational level (A.5.13 Labelling of information) are missing.
Knowledge check for lesson 4
2 questionsQuestion Which statements about the structure of the controls in Annex A of ISO/IEC 27001 are correct?
Multiple choice: one to three answers are correct.
ExplanationAnnex A groups the controls in A.5 to A.8 according to the four themes mentioned; this grouping is independent of the PDCA phases, which are instead reflected in Clauses 4 to 10.Question Which statements reflect the understanding of information security as the interplay of people, processes and technology?
Multiple choice: one to three answers are correct.
ExplanationIntroduction 0.1 and A.5.35 call for the early consideration of security requirements and independent review; the example of printouts left lying around shows that technical controls remain ineffective without the physical (A.7.7) and organizational level (A.5.13).An asset passes through four controlled steps
- 1InventoryAssets and their owners are recorded and kept up to date.A.5.9
- 2ClassifyClassification according to confidentiality, integrity, availability and requirements.A.5.12
- 3Regulate useRules and procedures for acceptable use are defined.A.5.10
- 4ReturnAssets are returned upon termination of employment or contract.A.5.11
Remember: Without a maintained inventory, there is no basis for classification, access control and risk assessment. An asset is anything that has value to the organization – from information and IT systems to knowledge and reputation. Without a maintained inventory of these assets, including their owners, no robust risk assessment is possible.
Practice- The asset owner is not IT, but the business function that decides on use and protection requirements.
A.5.9- The inventory is not a one-off exercise; it must be updated continually whenever the assets change.
Practical example
A business unit maintains a customer database. The inventory lists: the information asset “client contract data”, the application, the database server, the backup copies and the server room. The owner is the head of the business unit, not the administrator – the administrator is the custodian. Only this assignment makes clear who decides on access rights and on the acceptance of residual risks.
Knowledge check for lesson 5
2 questionsQuestion What role does the asset owner typically assume in accordance with A.5.9?
Multiple choice: one to three answers are correct.
ExplanationA.5.9 requires an inventory including the owners; the owner is the business function that decides on protection needs and access, while IT administration merely manages the asset.Question What requirements does Annex A set for the handling of information assets?
Multiple choice: one to three answers are correct.
ExplanationA.5.9 requires the inventory, A.5.11 the return of assets. A.5.12, on the other hand, requires classification according to protection needs – precisely not uniform labelling regardless of them.Each protection goal has its own forms of violation and countermeasures
Protection goal Violation (example) Countermeasure (example) Confidentiality Unauthorized access or data exfiltration Access control (A.5.15), cryptography (A.8.24) Integrity Data is altered or swapped unnoticed Change management (A.8.32), logging (A.8.15) Availability System or process failure Redundancy (A.8.14), backup (A.8.13) Remember: An incident can violate several protection goals at once, e.g. ransomware affects availability, confidentiality and integrity. Separating the protection goals is necessary because an incident can affect them to different degrees and the protection requirements may differ for each goal. Only by considering them separately can suitable countermeasures be selected specifically for each goal in the risk process.
Introduction 0.1- The ISMS preserves the confidentiality, integrity and availability of information by applying a risk management process.
Clause 6.1.2 c) 1)- Risks associated with the loss of confidentiality, integrity and availability within the scope are identified.
Availability- Availability also includes supporting utilities such as power and air conditioning (A.7.11), in addition to redundancy and backup.
Practical example
A citizen portal is down for four hours. Only availability is affected; confidentiality and integrity are preserved. If, on the other hand, application data are mixed up during a faulty import, integrity is violated while the system remains available. Separating the protection goals makes it possible to rate the protection requirements differently for each goal and to select controls in a targeted way.
Knowledge check for lesson 6
2 questionsQuestion At which point in the risk process do the three protection goals become operationally effective according to ISO/IEC 27001?
Multiple choice: one to three answers are correct.
ExplanationClause 6.1.2 c) 1) requires the identification of risks related to the loss of the three protection goals; the legal form of the organization has nothing to do with risk assessment.Question What follows from the fact that confidentiality, integrity and availability are mutually independent properties?
Multiple choice: one to three answers are correct.
ExplanationA system failure can affect availability alone, while confidentiality and integrity are preserved; all three properties must be considered in the risk process in accordance with 6.1.2 c) 1).Information security and data protection protect different interests
Information security
Protected interest: all of the organization’s information- Protects the confidentiality, integrity and availability of all information
- The organization’s interest takes priority
- Controls from Annex A, irrespective of whether personal data is involved
Data protection
Protected interest: informational self-determination- Protects the personal data of natural persons
- The data subject’s interest takes priority
- Own obligations such as purpose limitation and erasure (A.8.10)
Remember: A secure system can be operated in breach of data protection law – security is no substitute for purpose limitation or the obligation to erase. Information security protects the organization’s interest in all its information; data protection protects the data subject’s interest in their personal data. Because the protected assets differ, the controls in Annex A do not automatically replace data protection obligations such as purpose limitation or erasure.
A.5.34- The standard requires that requirements regarding privacy and the protection of PII under applicable laws and contracts be identified and met.
A.5.31- Legal, statutory, regulatory and contractual requirements shall be identified, documented and kept up to date.
Clause 4.2- Data subjects and supervisory authorities are typical interested parties whose requirements must be determined in the ISMS.
Practice- Technical and organizational measures under data protection law can largely be derived from the controls in Annex A – but the obligations to provide evidence remain separate.
Practical example
A procedure stores job application documents encrypted, with strict access control and complete logging – exemplary in terms of information security. However, it stores the documents indefinitely. That is a data protection violation, not a security deficiency. The control that applies here is A.8.10 Information deletion: data must be deleted when they are no longer required.
Knowledge check for lesson 7
2 questionsQuestion How do information security and data protection differ?
Multiple choice: one to three answers are correct.
ExplanationThe protected interests differ (organization versus data subject); despite exemplary encryption and access control, a process can violate the erasure obligations of data protection law.Question Which Annex A control links the ISMS directly to data protection requirements?
Multiple choice: one to three answers are correct.
ExplanationA.5.34 requires the identification and fulfilment of requirements for the protection of personal data under applicable law; the other two controls concern monitoring and physical infrastructure respectively.Only the assessment turns an event into an incident
Definition Example Next step Event Observed occurrence of possible significance Computer responds unusually slowly after opening an attachment Report via defined channel (A.6.8) Incident Series of events with likely adverse impact Malware finding with network access confirmed Respond (A.5.26) and secure evidence (A.5.28) Remember: The classification in accordance with A.5.25 decides, not the gut feeling of the person reporting. An information security event is an observed occurrence of potential relevance to information security; only the assessment decides whether it becomes an incident with a likely adverse impact. For this chain from reporting to learning, the standard requires a planned, documented process.
A.6.8- There shall be a mechanism through which personnel can report observed events in a timely manner through appropriate channels.
A.5.25- The organization shall assess events and decide whether they are to be categorized as information security incidents.
A.5.24- Incident management shall be planned and prepared: define, establish and communicate processes, roles and responsibilities.
A.5.26- Incidents shall be responded to in accordance with the documented procedures.
A.5.27 / A.5.28- Knowledge gained from incidents shall be used for improvement; separate procedures apply to the identification, collection, acquisition and preservation of evidence.
Practical example
A case worker reports that her computer has become unusually slow after she opened an attachment. That is an event. The assessment according to A.5.25 reveals a malware finding with network access – and thus an incident. The response process (A.5.26), the collection of evidence (A.5.28) and then the learning from the incident (A.5.27) come into play, resulting in an adjustment of the filter rules.
Knowledge check for lesson 8
2 questionsQuestion Which statements about the difference between an information security event and an information security incident are correct?
Multiple choice: one to three answers are correct.
ExplanationA.5.25 requires events to be assessed in order to classify them as incidents; not every reported event automatically meets the criteria of an incident.Question Which steps does the management of information security incidents in accordance with Annex A comprise?
Multiple choice: one to three answers are correct.
ExplanationA.6.8, A.5.26 and A.5.27, together with A.5.24 (planning) and A.5.28 (evidence), form the chain of incident management.Monitoring has an evidence function and a detection function
Evidence function
What is monitored and evaluated, how, when and by whom must be determined in advance.
Cl. 9.1Detection function
Logs and network monitoring detect anomalous behaviour during ongoing operations.
A.8.15 / A.8.16Common time base
Without synchronized clocks, events from different systems cannot be correlated.
A.8.17
Remember: Clause 9.1 requires six determinations: what is measured, how, when and by whom, and when and by whom it is evaluated. Monitoring serves two functions: it provides evidence of the performance of the ISMS (clause 9.1 of the standard), and it detects security-relevant behaviour in operations (controls A.8.15 and A.8.16). The two are connected – only what has previously been defined in terms of subject of monitoring, method, timing and responsibility is measured.
Cl. 9.1- The methods should produce comparable and reproducible results; documented information shall be available as evidence.
A.8.15- Logs that record activities, exceptions, faults and other relevant events shall be produced, stored, protected and analysed.
A.8.17- The clocks of the information processing systems used shall be synchronized to approved time sources – without a uniform time, no correlation is possible.
Practical example
An operations team defines four metrics: percentage of systems patched after 30 days, number of events reported per month, mean time to handle an incident and percentage of successful restore tests. These metrics are fed into the management review as inputs according to 9.3.2 d) 2) and measured there against the information security objectives according to 6.2.
Knowledge check for lesson 9
2 questionsQuestion What does Clause 9.1 require with regard to determining monitoring and measurement?
Multiple choice: one to three answers are correct.
ExplanationClause 9.1 explicitly requires determining the subject, method and timing as well as the responsibility for performing and evaluating the monitoring, not just a subset of these.Question Which controls contribute to effective information security monitoring?
Multiple choice: one to three answers are correct.
ExplanationA.8.15 and A.8.16 provide the basis for monitoring; A.8.17, by contrast, requires the clocks to be synchronized with approved time sources, because without a uniform time the logs cannot be correlated.
Further reading
Overviews, tables and tools for referenceThe attack chain and the controls that break it
The course of the Carbanak campaign — and where Annex A comes in
From event to incident — and what happens next
The assessment according to A.5.25 is the switch point: only the assessment turns an event into an incident
Information security and data protection — related, not identical
Two protected assets, two interests, one shared toolbox
Final test
12 questions across the section · pass mark 60 percentFinal test section 1
12 questionsQuestion Which statements about the term “effectiveness” are correct?
Multiple choice: one to three answers are correct.
Question Which other properties can be included in addition to confidentiality, integrity and availability according to ISO/IEC 27000?
Multiple choice: one to three answers are correct.
Question What is availability according to ISO/IEC 27000?
Multiple choice: one to three answers are correct.
Question How do an information security event and an information security incident differ?
Multiple choice: one to three answers are correct.
Question An administrator is asked to explain what ISO/IEC 27000 means by a vulnerability. Which statement is correct?
Multiple choice: one to three answers are correct.
Question What is a nonconformity according to ISO/IEC 27000?
Multiple choice: one to three answers are correct.
Question What does the term “availability” describe according to ISO/IEC 27000?
Multiple choice: one to three answers are correct.
Question A service provider asks what the term performance denotes in the ISO/IEC 27000 family. Which statement is correct?
Multiple choice: one to three answers are correct.
Question Does risk identification under the current ISO/IEC 27001 have to be carried out on the basis of assets, threats and vulnerabilities?
Multiple choice: one to three answers are correct.
Question Which statements about the term “risk” according to ISO/IEC 27000 are correct?
Multiple choice: one to three answers are correct.
Question What distinguishes a correction from a corrective action?
Multiple choice: one to three answers are correct.
Question Which statements about the term “interested party” are correct?
Multiple choice: one to three answers are correct.