ISO 27001 LA Domain 1: Fundamental Principles and Concepts of an Information Security Management System (ISMS) (16.25%)

Overview

This domain tests whether you can explain and apply the core ideas behind ISO/IEC 27001 before any audit work starts. Its eight knowledge statements cover the legal, regulatory and contractual sources of security requirements, the main standards in the ISO/IEC 27000 family, key terminology, the concept of risk, the relationships between assets, threats, vulnerabilities and impact, the difference between objectives and controls, control types and attributes, and the security features of big data, AI, machine learning, cloud and outsourcing.

The current PECB exam is 80 three-option multiple-choice questions, open book, with a 70% pass mark, replacing the older 12-question essay format, and it is based on ISO/IEC 27001:2022. An auditor uses these concepts to decide whether what the auditee calls a control really addresses a risk, so read every term from the viewpoint of someone who must later verify it with evidence.

Why it matters on the exam

Domain 1 holds 13 of the 80 questions, the third-largest share, and it is easy to underrate because the material feels introductory. The concepts return in every later domain: a Stage 2 finding is only valid if you can say which risk the missing control was meant to treat, and a nonconformity statement fails if it confuses a security objective with a control. Candidates from technical roles often know individual tools well but mix up threat and vulnerability, or call a log review preventive. Candidates from compliance roles may know the clauses but miss why a contract or a privacy law becomes an ISMS requirement. Getting this vocabulary exact lets you read scenario questions quickly and reserve time for the harder audit-process items.

How it's tested

Questions here are short definitions or one-paragraph scenarios about an organization's assets, threats or controls. You are asked to classify something correctly: the source of a requirement, the type of control, the security property affected, or the element of risk. With only three options per item, one is usually a near-synonym that is wrong in a precise way.

Classify the control

A described measure, such as reviewing access logs weekly, must be labeled preventive, detective or corrective, or matched to a ISO/IEC 27002 attribute value.
Risk element identification

A scenario names an unpatched server, a ransomware group and lost revenue; you pick which is the vulnerability, the threat and the impact.
Requirement source

You decide whether an obligation comes from law, regulation, contract, an industry standard or internal policy, and therefore what evidence an auditor would expect.

Reasoning it through

A question says a hospital keeps paper charts in an unlocked room and asks which control type a badge-controlled door would be. Work it through: the door acts before anyone can reach the charts, so it is preventive. A camera recording the room would be detective, and a procedure to notify patients after a loss would be corrective. Choose preventive, and note the protected property is confidentiality.

Knowledge statements 8

Official knowledge statements from the PECB outline, in outline order.

1.1 Laws, regulations, international and industry standards, contracts, market practices and internal policies an organization must comply withWhere an organization's information security obligations come from.

What it means: Security requirements reach the ISMS from several sources: statutes such as data protection law, sector regulations, international and industry standards like PCI DSS, customer and supplier contracts, accepted market practice, and the organization's own policies. ISO/IEC 27001 clause 4.2 asks the organization to determine the requirements of interested parties and which of them it will address through the ISMS.
What to understand: Legal and regulatory requirements are not optional, while a standard becomes binding only when a law, contract or the organization itself adopts it. Annex A control 5.31 asks the auditee to identify and document legal, statutory, regulatory and contractual requirements, and the auditor checks that this list exists, is current and drives control selection.
How it shows up: A scenario lists several obligations and asks which one is a contractual requirement, or which source the auditor should check first when a customer demands a specific encryption level.
Common confusion: Assuming ISO/IEC 27001 itself is a legal requirement; certification is voluntary unless a regulator or contract makes it mandatory.

1.2 Main standards related to information securityThe ISO/IEC 27000 family and the companion standards an ISMS auditor meets.

What it means: ISO/IEC 27000 provides the overview and vocabulary, ISO/IEC 27001 holds the certifiable requirements, ISO/IEC 27002 gives guidance on the 93 controls, ISO/IEC 27005 covers information security risk management, and ISO/IEC 27003 and 27004 guide implementation and measurement. Audit-related standards include ISO 19011, ISO/IEC 17021-1, ISO/IEC 27006-1 and ISO/IEC 27007.
What to understand: Only ISO/IEC 27001 contains requirements an organization is certified against; the others are guidance or requirements for certification bodies. ISO/IEC 27002 explains how a control might be implemented, but an auditor cannot raise a nonconformity solely because the auditee ignored a 27002 recommendation. Sector extensions such as ISO/IEC 27017 for cloud and 27701 for privacy add controls or requirements for specific contexts.
How it shows up: Expect questions asking which standard is used for certification, which gives control implementation guidance, or which sets requirements for bodies certifying ISMSs.
Common confusion: Treating ISO/IEC 27002 as auditable criteria; it is a code of practice, while 27001 clauses and the Statement of Applicability define what is audited.

1.3 Main concepts and terminology of ISO/IEC 27001Defined terms used across the ISMS and its audits.

What it means: ISO/IEC 27001 relies on terms defined in ISO/IEC 27000 and the ISO harmonized structure: information security, confidentiality, integrity, availability, interested party, documented information, risk owner, nonconformity, corrective action, continual improvement and effectiveness, among others.
What to understand: Precise terms matter because findings quote them. Documented information replaced the old split between documents and records. A risk owner is the person with accountability and authority to manage a risk, not necessarily the asset owner. Effectiveness means the extent to which planned activities are realized and planned results achieved, so an auditor checks results, not only the existence of procedures.
How it shows up: Definition questions offer three phrasings that differ by one word; pick the one that matches ISO/IEC 27000, which you can check in your open-book copy.
Common confusion: Equating information with data or records; information is any meaningful content in any form, including spoken and paper-based information.

1.4 The concept of risk and its application in information securityRisk as the effect of uncertainty on objectives, assessed by likelihood and consequence.

What it means: ISO defines risk as the effect of uncertainty on objectives. In information security, risk is usually expressed through the likelihood of an event and its consequences for confidentiality, integrity or availability. ISO/IEC 27001 also requires the organization to address opportunities, not only threats.
What to understand: The organization defines its own risk criteria, including acceptance criteria, and must produce consistent, valid and comparable results when assessments are repeated (clause 6.1.2). Residual risk is what remains after treatment and needs acceptance by risk owners. The auditor does not judge whether a risk rating is the one they would have chosen; they test whether the defined method was followed and applied consistently.
How it shows up: A question describes two assessments of the same asset giving different results with no change in context, pointing to a problem with method consistency rather than with a specific control.
Common confusion: Thinking ISO/IEC 27001 prescribes a risk methodology; it requires a defined, repeatable process but leaves the method to the organization.

1.5 Relationships between the aspects of information securityHow assets, threats, vulnerabilities, impacts and controls connect.

What it means: An asset has value to the organization. A threat is a potential cause of an unwanted incident, a vulnerability is a weakness that a threat can exploit, and impact is the result on the organization when it happens. Controls reduce likelihood, consequence or both, and the three properties of confidentiality, integrity and availability describe what is being protected.
What to understand: Risk exists only when a threat can exploit a vulnerability affecting a valued asset. Removing a vulnerability lowers likelihood, while a backup lowers consequence without changing the vulnerability. Auditors use this chain to test whether a control in the Statement of Applicability actually maps to a risk in the assessment.
How it shows up: Scenario items ask you to label each element of a short incident or to choose the control that addresses the vulnerability rather than the impact.
Common confusion: Calling a missing patch a threat; it is a vulnerability, while the attacker or malware that could use it is the threat.

1.6 Difference between and characteristics of security objectives and controlsWhat the organization wants to achieve versus the measures that achieve it.

What it means: An information security objective is a result to be achieved, set at relevant functions and levels, measurable where practicable and consistent with the policy (clause 6.2). A control is a measure that maintains or modifies risk, such as a procedure, technical setting or physical barrier.
What to understand: Objectives answer what and by when, with responsibility and evaluation method defined; controls answer how risk is treated. Clause 6.2 requires objectives to be monitored, communicated and updated, and kept as documented information. Auditors test objectives through measurement results and management review inputs, while controls are tested through design and operating evidence.
How it shows up: Questions present a statement such as reducing phishing click rates to under 5% by year end and ask whether it is an objective, a policy statement or a control.
Common confusion: Listing Annex A control titles as security objectives; the 2022 Annex A no longer has control objectives, and objectives belong to clause 6.2.

1.7 Use of control attributes and the difference between preventive, detective and corrective controlsClassifying controls by function and by ISO/IEC 27002:2022 attributes.

What it means: Preventive controls stop an incident from happening, detective controls identify one that has happened or is in progress, and corrective controls limit damage and restore normal operation. ISO/IEC 27002:2022 tags each control with attributes: control type, security properties, cybersecurity concepts, operational capabilities and security domains.
What to understand: Attributes are a filtering tool for building views of the control set; they are informative and not audit criteria. A single control can carry more than one type, for example 8.7 Protection against malware is preventive, detective and corrective. The cybersecurity concepts attribute uses identify, protect, detect, respond and recover.
How it shows up: Expect a measure described in plain language, such as restoring from backup after corruption, and three control-type labels to choose from.
Common confusion: Labeling an audit log as preventive because it deters misuse; its primary function is detective.

1.8 Main characteristics of big data, artificial intelligence, machine learning, cloud computing and outsourced operationsSecurity features and risks of modern technology and sourcing models.

What it means: Big data brings volume, velocity and variety, raising aggregation and privacy risks. AI and machine learning depend on training data and models that can be poisoned, biased or leak information. Cloud computing introduces shared responsibility across service models, and outsourcing moves operations, but not accountability, to a provider.
What to understand: ISO/IEC 27001:2022 added control 5.23 Information security for use of cloud services, and supplier controls 5.19 to 5.22 still apply to outsourced processes. Clause 8.1 requires the organization to control externally provided processes, products or services relevant to the ISMS. An auditor expects evidence of supplier agreements, monitoring and exit planning rather than accepting a provider's certificate alone.
How it shows up: A scenario describes a SaaS provider handling customer data and asks who remains accountable for the information security requirements, which is the organization.
Common confusion: Believing a cloud provider's ISO/IEC 27001 certificate covers the customer's own configuration and access management; shared responsibility leaves those with the customer.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

CIA triad

Confidentiality, integrity and availability are the three properties information security preserves.

Remember
Integrity covers accuracy and completeness; availability means accessible and usable on demand by an authorized entity.

Tested as
Scenarios ask which property an incident affected, such as altered payroll data affecting integrity.

Trap
Picking confidentiality for every data-related incident even when nothing was disclosed.
Threat vs. vulnerability

A threat is a potential cause of harm; a vulnerability is a weakness it can exploit.

Remember
Organizations usually control vulnerabilities, not threats.

Tested as
Classification items appear in short incident descriptions.

Trap
Labeling weak passwords as a threat.
Risk owner

The person or entity with accountability and authority to manage a risk.

Remember
Risk owners approve the risk treatment plan and accept residual risks (clause 6.1.3 f).

Tested as
Auditors look for evidence of risk owner approval during Stage 2.

Trap
Assuming the IT manager owns every information security risk.
Documented information

Information an organization must control and maintain, plus the medium that holds it.

Remember
It covers both what used to be called documents and records.

Tested as
Terminology questions and evidence-type questions both use it.

Trap
Thinking only paper or formal manuals count as documented information.
Control types

Preventive, detective and corrective, the first attribute in ISO/IEC 27002:2022.

Remember
One control may carry several type values.

Tested as
Direct classification questions.

Trap
Forcing each control into exactly one category.
ISO/IEC 27002 attributes

Five attribute sets used to tag and filter the 93 controls.

Remember
Control type, information security properties, cybersecurity concepts, operational capabilities, security domains.

Tested as
Asked as knowledge of attribute names or the use of attributes for creating control views.

Trap
Treating attributes as mandatory requirements an auditor can cite.
Interested parties

People or organizations that can affect, be affected by or perceive themselves affected by the ISMS.

Remember
Clause 4.2 also asks which of their requirements the ISMS will address.

Tested as
Requirement-source questions start here.

Trap
Listing only customers and forgetting regulators, staff and suppliers.
Shared responsibility (cloud)

Security duties split between cloud provider and customer, varying by IaaS, PaaS or SaaS.

Remember
Accountability for information stays with the customer organization.

Tested as
Outsourcing and cloud scenarios.

Trap
Accepting a provider certificate as full evidence for the customer's controls.
Residual risk

Risk remaining after treatment has been applied.

Remember
It must be accepted by risk owners against defined criteria.

Tested as
Risk concept items and links to Stage 2 evidence.

Trap
Believing treatment eliminates risk entirely.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Preventive, detective and corrective controls

Concept	Meaning	Key difference	Common trap
Preventive	Stops an incident before it occurs, such as access control or input validation	Acts before the event	Classing deterrent monitoring as preventive
Detective	Identifies an incident during or after it occurs, such as log monitoring or intrusion detection	Acts on discovery	Assuming detection alone reduces impact
Corrective	Limits damage and restores operations, such as backup restoration or incident response	Acts after the event to recover	Confusing corrective controls with corrective action for nonconformities

Asset, threat, vulnerability and impact

Concept	Meaning	Key difference	Common trap
Asset	Anything with value to the organization, including information and supporting systems	What is protected	Listing only hardware
Threat	Potential cause of an unwanted incident	Source of harm, often outside direct control	Confusing it with the weakness
Vulnerability	Weakness of an asset or control that a threat can exploit	Condition the organization can usually fix	Calling it the risk itself
Impact	Outcome affecting objectives when an incident occurs	Consequence side of risk	Ignoring non-financial impacts such as reputation

ISO/IEC 27001 vs. ISO/IEC 27002 vs. ISO/IEC 27005

Concept	Meaning	Key difference	Common trap
ISO/IEC 27001	Requirements for an ISMS, with Annex A reference controls	Certifiable; uses shall	Thinking every Annex A control is mandatory regardless of risk
ISO/IEC 27002	Guidance on implementing the 93 controls, with attributes	Guidance; not certifiable	Raising nonconformities against its wording
ISO/IEC 27005	Guidance on information security risk management	Supports clause 6.1 and 8.2-8.3; not certifiable	Believing its method is required for certification

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

Guidance as criteria

What candidates pick
An answer citing an ISO/IEC 27002 recommendation as the basis for a nonconformity.

Why it looks right
ISO/IEC 27002 is detailed and sounds authoritative.

Why it's wrong
Audit criteria for certification are ISO/IEC 27001 requirements and the organization's own documented ISMS, not guidance.

Clue to watch for Words like should or guidance in the cited source.
Single control type

What candidates pick
Only one type label for anti-malware software.

Why it looks right
Classification questions seem to want one bucket.

Why it's wrong
ISO/IEC 27002 assigns several type values to some controls, and malware protection blocks, detects and cleans.

Clue to watch for A control described doing more than one thing.
Provider certificate solves everything

What candidates pick
Accepting the SaaS vendor's certificate as proof the customer's data is protected.

Why it looks right
Certificates are third-party evidence.

Why it's wrong
The certificate's scope covers the provider's ISMS, not the customer's configuration, access rights or supplier oversight.

Clue to watch for Scenario mentions customer-managed settings or user accounts.
Data equals information

What candidates pick
A definition limiting information to electronic data.

Why it looks right
Most controls discussed are technical.

Why it's wrong
Information security covers information in every form, including paper, conversation and knowledge held by people.

Clue to watch for Scenario involves printed documents or verbal disclosure.
Risk method prescribed

What candidates pick
An option saying the auditee must use ISO/IEC 27005 or a quantitative method.

Why it looks right
It sounds rigorous.

Why it's wrong
Clause 6.1.2 requires a defined, consistent process with criteria, but the organization chooses the method.

Clue to watch for Answer insists on a specific methodology.

Answer framework

For a concepts question, translate the scenario into precise ISO/IEC 27000 terms before reading the options.

Identify what is being protected and which property (confidentiality, integrity or availability) the scenario puts at risk.
Separate the elements of risk: label the asset, the threat, the vulnerability and the impact in your own words.
For a control, ask when it acts: before the event (preventive), on discovery (detective) or after it to recover (corrective).
For a requirement, trace its source to law, regulation, contract, adopted standard or internal policy, since that sets its binding force.
Check the option against the definition in your open-book copy and reject answers that rely on guidance as if it were a requirement.

Practice question

During a Stage 2 audit, an auditor sees that a retailer encrypts card data with keys stored on the same server, and an external group is known to target retailers. What is the stored key arrangement in risk terms?

A threat to the confidentiality of card data An impact on the retailer's revenue A vulnerability that a threat could exploit A detective control

Show the answer

Answer C. Storing encryption keys beside the data they protect is a weakness in a control, which is the definition of a vulnerability. The external group is the threat, and lost revenue or fines would be the impact. Nothing in the arrangement detects anything, so it is not a detective control. An auditor would link this weakness to the risk assessment and to cryptography control 8.24 when writing any finding.

Want more like this? The ISO 27001 LA practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start by building a one-page glossary from ISO/IEC 27000 and your course manual: asset, threat, vulnerability, risk, risk owner, control, objective, documented information, interested party and effectiveness. Write each definition in your own words, then add a one-line example from an organization you know. Because the exam is open book, tab the definitions section of your course materials so you can confirm a wording in seconds rather than hunting for it.

Next, practice classification. Take twenty controls from ISO/IEC 27001 Annex A, read their ISO/IEC 27002 guidance, and label each by type and by the security property it protects. Then take five short incident stories, from news reports or your own experience, and break each into asset, threat, vulnerability and impact. For cloud and outsourcing, sketch who is responsible for what under IaaS, PaaS and SaaS for one real service your organization uses.

Finish with timed practice questions. If you miss a classification item, write down which word in the stem should have pointed you to the right answer; that habit pays off in the scenario-heavy later domains.

FAQ

How much of the ISO 27001 Lead Auditor exam is Domain 1, Fundamental Principles and Concepts of an ISMS?

PECB's candidate handbook assigns 13 of the 80 questions to this domain, which is 16.25% of the exam. Every question carries the same weight.

Is the PECB ISO 27001 Lead Auditor exam still an essay exam?

The current candidate handbook describes 80 multiple-choice questions with three options each, open book, and a 70% pass mark. Older guides describing 12 essay questions refer to the previous format, so check your exam confirmation.

Which edition of ISO/IEC 27001 does the exam use?

ISO/IEC 27001:2022, including its 93 Annex A controls. The transition period for 2013 certificates ended on 31 October 2025, and Amendment 1:2024 added a climate change consideration to clauses 4.1 and 4.2.

Do I need to memorize all ISO/IEC 27000 definitions?

No. You may bring a printed copy of ISO/IEC 27001 and your course materials, so focus on understanding terms well enough to apply them and on knowing where to find exact wording.

Why does an auditor exam test cloud, AI and big data?

Auditees increasingly run ISMS processes on cloud and outsourced services. Auditors need to recognize the related risks and know what evidence of supplier and cloud control to expect.

Are ISO/IEC 27002 control attributes audit criteria?

No. They are an informative tagging scheme for sorting controls. An auditor may use them to understand a control set, but findings are raised against ISO/IEC 27001 requirements and the auditee's documented ISMS.

Related domains

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

ISO 27001 LA Domain 1: Fundamental Principles and Concepts of an Information Security Management System (ISMS)

Overview

How it's tested

Classify the control

Risk element identification

Requirement source

Knowledge statements 8

High-yield concepts

CIA triad

Threat vs. vulnerability

Risk owner

Documented information

Control types

ISO/IEC 27002 attributes

Interested parties

Shared responsibility (cloud)

Residual risk

Side by side

Preventive, detective and corrective controls

Asset, threat, vulnerability and impact

ISO/IEC 27001 vs. ISO/IEC 27002 vs. ISO/IEC 27005

Exam traps

Guidance as criteria

Single control type

Provider certificate solves everything

Data equals information

Risk method prescribed

Answer framework

Practice question

Checklist

Study strategy

FAQ

Other Cybersecurity certifications

Test your Domain 1 knowledge

Keep going