From Exact Extract:
Explanation for B (True):
This statement is true because ISO 27001 requires an organization to establish processes for identifying, reviewing, and complying with applicable legal, statutory, regulatory, and contractual obligations. A key part of this is being aware of changes to these requirements to maintain ongoing compliance. An auditor's role is to verify that the organization has such a process in place and that it is effective.
Reference:
ISO/IEC 27001:2022, Clause 6.1.3 "Information security risk treatment": While not directly stating "legal requirements," this clause implies that the organization must determine controls to treat information security risks, and compliance with legal requirements is a significant risk factor.
ISO/IEC 27001:2022, Annex A.5.31 "Legal, statutory, regulatory and contractual requirements": This control states: "The organization should identify, document, and comply with relevant legal, statutory, regulatory, and contractual requirements related to information security." This inherently includes processes for staying aware of changes.
ISO/IEC 27002:2022, 5.31 (Guidance for A.5.31): Provides more detail, emphasizing the need for processes to "identify all relevant legal, statutory, regulatory and contractual requirements, and to ensure that appropriate action is taken to comply with these requirements." This explicitly includes monitoring for changes.
ISO/IEC 17021-1:2015, Clause 9.1.2 "Audit objectives": An audit objective is to determine "the ability of the management system to ensure the client meets applicable statutory, regulatory and contractual requirements." This necessarily involves checking the process for identifying changes.
Explanation for E (True):
ISO 27001 mandates the retention of documented information for various aspects of the ISMS, including the identification of legal requirements. Auditors will look for evidence that the organization has indeed identified and documented the applicable legislation it needs to comply with.
Reference:
ISO/IEC 27001:2022, Clause 7.5.1 "General," 7.5.2 "Creating and updating documented information," and
7.5.3 "Control of documented information": These clauses generally require documented information to be maintained and retained as specified by the standard.
ISO/IEC 27001:2022, Annex A.5.31 "Legal, statutory, regulatory and contractual requirements": As mentioned above, this control explicitly states that the organization should "identify, document, and comply with relevant legal, statutory, regulatory and contractual requirements." The term "document" directly implies
"documented information is retained."
ISO/IEC 27002:2022, 5.31 (Guidance for A.5.31): Further elaborates that the identified requirements should be documented and kept up to date.
Explanation for A (False):
The organization is required to comply with all applicable legal, statutory, and regulatory requirements, as well as contractual obligations. Information security often intersects with broader legal frameworks (e.g., data protection, privacy, industry-specific regulations) that may not directly relate to the ISMS in a narrow sense, but are critical to the organization's overall compliance and its information security posture.
Reference:
ISO/IEC 27001:2022, Annex A.5.31 "Legal, statutory, regulatory and contractual requirements": This control does not limit compliance to only what "directly relates" but to "relevant" requirements. The scope of
"relevant" is determined by the organization's context, operations, and information it handles.
Explanation for C (False):
Organizations can and often do outsource tasks like legal environment reviews to specialized legal firms or subscribe to legal compliance services. The ISO 27001 standard does not prohibit outsourcing. However, the organization remains ultimately accountable for ensuring that these outsourced processes meet the requirements of the ISMS and that legal compliance is maintained. The auditor would verify the organization's oversight of such outsourced activities.
Reference:
ISO/IEC 27001:2022, Clause 8.1 "Operational planning and control": This clause states that organizations should "control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects" and "ensure that outsourced processes are controlled." This implicitly allows outsourcing but requires control.
Explanation for D (False):
A certification body auditor's role is not to act as a legal compliance officer or to definitively verify the organization's actual legal compliance status (i.e., whether they are perfectly compliant with every law). That responsibility lies with the organization itself, often supported by its legal counsel. The auditor's role is to verify that the organization has established, implemented, and maintains an effective process for identifying, managing, and complying with legal requirements as required by ISO 27001. They audit the management system's approach to compliance, not the legal compliance outcome itself.
Reference:
ISO/IEC 17021-1:2015, Clause 9.1.2 "Audit objectives": States that the audit is to determine "the ability of the management system to ensure the client meets applicable statutory, regulatory and contractual requirements." It does not state the auditor's role is to legally verify compliance.
ISO/IEC 27001:2022, Introduction: Emphasizes that the standard specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS, not for guaranteeing absolute legal compliance outside the scope of the ISMS processes.
Explanation for F (This statement is generally aligned with the role, but less precise as a 'sole true' statement compared to B and E):
While this statement is generally true about the auditor's role, its phrasing "to ensure compliance with their legal requirements" can be misinterpreted. As explained for D, the auditor evaluates the processes designed to achieve compliance, not the absolute legal compliance itself. However, in the context of multiple-choice questions where you pick the "most true" statements, it conveys a similar intent to B, but B and E are more precise regarding specific auditor actions and ISMS requirements. Given B and E are unequivocally true as specific audit actions/requirements, they are the stronger correct answers.
Reference:
ISO/IEC 17021-1:2015, Clause 9.1.2 "Audit objectives": As noted before, the audit objective includes evaluating the management system's ability to meet requirements. This aligns with evaluating processes.