ISO 27001 LA Domain 2: Information Security Management System (ISMS) and ISO/IEC 27001 Requirements (10%)

Overview

Domain 2 is the audit criteria domain. Its 13 knowledge statements cover ISO/IEC 27001:2022 and its supporting standards, management system terminology, integrated management systems, the requirements in clauses 4 to 10, the 93 Annex A controls, internal and external issues and interested parties, scope and policy, leadership roles, objectives, risk assessment and treatment, control selection and the Statement of Applicability, performance evaluation, and continual improvement.

The handbook frames this domain as identifying and explaining requirements, but for a lead auditor the useful question is always what conforming evidence would look like. For each clause, know which documented information is mandatory, which activities must be shown in practice, and how the clauses link: issues and interested parties shape scope, scope bounds the risk assessment, risk treatment drives the Statement of Applicability, and performance evaluation feeds improvement.

Why it matters on the exam

Only 8 of the 80 questions sit in this domain, yet every audit-process question in Domains 4 to 6 assumes you know the requirements well enough to recognize a gap. You cannot judge whether a missing management review input is a nonconformity unless you know clause 9.3.2 lists it. The 2022 revision changed details auditors still get wrong: Annex A dropped from 114 to 93 controls in four themes, clause 6.3 on planning changes was added, clause 4.4 now refers to processes and their interactions, and 9.2 and 9.3 were split into subclauses. Candidates who studied the 2013 edition often quote old control numbers. Because the exam is open book, the score here depends less on memory and more on knowing how to navigate the standard fast.

How it's tested

Items in this domain usually describe what an auditee has or has not done and ask which clause applies, whether a requirement is met, or which document is mandatory. Your open-book copy of ISO/IEC 27001 is the main tool, so questions reward fast navigation and careful reading of shall statements over recall of control numbers.

Mandatory or not

You decide whether a document, such as an asset inventory or a risk treatment plan, is required documented information or only expected where the organization decides it is necessary.
Clause mapping

A described activity, like top management assigning ISMS reporting responsibility, must be matched to the clause that requires it, here 5.3.
Exclusion justification

The scenario shows an Annex A control excluded in the Statement of Applicability, and you judge whether the justification satisfies clause 6.1.3 d.

Reasoning it through

An auditee excludes control 8.28 Secure coding because it buys all software. A question asks whether this is acceptable. Reason through clause 6.1.3 d: exclusions need a justification, and the risk assessment should support it. If the auditee truly develops no code, the exclusion holds; if staff write scripts or configure low-code apps, the justification may be invalid and the auditor should seek more evidence.

Knowledge statements 13

Official knowledge statements from the PECB outline, in outline order.

2.1 ISO/IEC 27001:2022 and its complementary standardsThe current edition and the standards that support it.

What it means: ISO/IEC 27001:2022, published in October 2022 and amended in 2024, follows the ISO harmonized structure with clauses 4 to 10 and a normative Annex A. Complementary standards include ISO/IEC 27000 for vocabulary, 27002 for control guidance, 27003 for implementation, 27004 for measurement and 27005 for risk management.
What to understand: Annex A is normative, so the organization must compare its controls with it, but each control applies only where the risk treatment requires it. Amendment 1:2024 asks the organization to determine whether climate change is a relevant issue (4.1) and notes that interested parties can have climate-related requirements (4.2). An auditor should confirm the auditee works to the current edition.
How it shows up: Questions check which document is normative, which edition has 93 controls, or what Amendment 1:2024 added.
Common confusion: Thinking the 2024 amendment changed Annex A; it only touched clauses 4.1 and 4.2.

2.2 Concepts, principles and terminology related to management systemsThe language of the harmonized structure shared by ISO management system standards.

What it means: A management system is a set of interrelated elements used to establish policies, objectives and processes to achieve them. The harmonized structure gives ISO standards identical core clauses, shared terms and a Plan-Do-Check-Act logic: plan in clauses 4 to 7, operate in 8, check in 9 and act in 10.
What to understand: Shall indicates a requirement, should a recommendation, may a permission and can a possibility. The process approach means outputs of one process feed others, so an auditor follows audit trails across functions rather than checking clauses in isolation.
How it shows up: Expect a question on the PDCA phase of a given clause or the meaning of a verbal form such as should.
Common confusion: Raising a nonconformity against a should statement in guidance; only shall statements and the organization's own commitments are requirements.

2.3 Main characteristics of an integrated management systemRunning ISMS, QMS and other systems through shared processes.

What it means: An integrated management system combines two or more management systems, such as ISO 9001 and ISO/IEC 27001, into shared processes for policy, document control, internal audit, management review and corrective action, while keeping each standard's specific requirements.
What to understand: Integration is possible because of the harmonized structure. Auditors may run combined audits of an integrated system, but each standard's requirements must still be covered and reported, and audit time cannot simply be cut without justification.
How it shows up: A scenario describes one management review covering quality and security and asks whether this can satisfy clause 9.3; it can if every required input is addressed.
Common confusion: Believing integration removes standard-specific requirements such as the Statement of Applicability.

2.4 Requirements of ISO/IEC 27001 in clauses 4 to 10The certifiable requirements and their mandatory documented information.

What it means: Clause 4 covers context, 5 leadership, 6 planning, 7 support, 8 operation, 9 performance evaluation and 10 improvement. All are mandatory for certification; no clause 4 to 10 requirement can be excluded.
What to understand: Mandatory documented information includes the scope (4.3), policy (5.2), risk assessment and treatment processes (6.1.2, 6.1.3), Statement of Applicability, risk treatment plan, objectives (6.2), competence evidence (7.2), operational planning information (8.1), risk assessment and treatment results (8.2, 8.3), monitoring results (9.1), audit programme and results (9.2), management review results (9.3), and nonconformities and corrective actions (10.2). Other documents are required only where the organization decides they are necessary for effectiveness (7.5.1 b).
How it shows up: Questions offer three documents and ask which one ISO/IEC 27001 explicitly requires.
Common confusion: Thinking procedures for every Annex A control must be documented; only those the organization deems necessary, plus those a control itself requires, such as 5.37 operating procedures.

2.5 The 93 controls listed in Annex A of ISO/IEC 27001Reference controls grouped into organizational, people, physical and technological themes.

What it means: Annex A lists 37 organizational controls (5.1 to 5.37), 8 people controls (6.1 to 6.8), 14 physical controls (7.1 to 7.14) and 34 technological controls (8.1 to 8.34). Eleven controls are new in 2022, including threat intelligence, cloud services, ICT readiness for business continuity, data masking, data leakage prevention, monitoring activities and secure coding.
What to understand: Annex A is a checklist to make sure no necessary control is overlooked (6.1.3 c), not a mandatory set. The auditor samples controls based on risk and checks both the Statement of Applicability entry and implementation evidence.
How it shows up: A scenario names a control by description and asks for its theme or whether it is new in 2022.
Common confusion: Quoting 2013 numbering such as A.12.4 Logging; the 2022 equivalent is 8.15.

2.6 Internal and external issues and interested parties of the ISMSClause 4.1 and 4.2 context analysis.

What it means: The organization determines external and internal issues relevant to its purpose that affect its ability to achieve ISMS outcomes, identifies interested parties and their relevant requirements, and decides which requirements the ISMS will address.
What to understand: ISO/IEC 27001 does not require the issues list to be documented, but it must be demonstrable, and the 2022 text adds 4.2 c on which requirements are addressed. Since 2024 climate change must be considered. Auditors look for evidence that context analysis actually feeds scope and risk assessment.
How it shows up: Questions ask whether a missing written context analysis is a nonconformity, which depends on whether the auditee can demonstrate it another way.
Common confusion: Treating clause 4.1 output as mandatory documented information.

2.7 Main steps for establishing the ISMS scope and information security policyDefining boundaries and top-level intent.

What it means: Clause 4.3 requires the scope to consider internal and external issues, interested party requirements, and interfaces and dependencies with activities performed by other organizations. The policy (5.2) must suit the organization's purpose, include or frame objectives, and commit to meeting requirements and to continual improvement.
What to understand: Scope must be documented and available; the policy must be documented, communicated internally and available to interested parties as appropriate. Auditors compare the certificate scope wording against actual processes, sites and interfaces to detect scopes drawn to avoid difficult areas.
How it shows up: A scope excluding a data center that processes in-scope information is a typical scenario where interfaces have not been handled.
Common confusion: Confusing the ISMS scope with the audit scope, which can be smaller for a given audit.

2.8 Top management leadership and commitment, and organizational roles and responsibilitiesClause 5 requirements on leadership.

What it means: Top management must demonstrate leadership by ensuring policy and objectives align with strategy, integrating ISMS requirements into business processes, providing resources, communicating the importance of security, and directing people. Clause 5.3 requires responsibilities and authorities to be assigned and communicated, including reporting ISMS performance to top management.
What to understand: Leadership cannot be delegated away. Auditors interview top management directly and look for decisions, budgets and review records rather than accepting a signed policy as proof of commitment.
How it shows up: Scenarios describe an ISMS run entirely by the CISO with no executive involvement and ask which clause is at risk.
Common confusion: Assuming appointing an ISMS manager satisfies clause 5.1.

2.9 Security objectives, processes and procedures relevant to risk management and improvementClause 6.2 objectives and the processes that deliver them.

What it means: Objectives must be consistent with the policy, measurable if practicable, consider requirements and risk results, be monitored, communicated and updated. Planning must define what will be done, resources, responsibility, timing and how results will be evaluated.
What to understand: The 2022 edition explicitly requires objectives to be monitored and made available as documented information. Clause 6.3 adds that changes to the ISMS must be carried out in a planned manner. Auditors test whether objectives are tracked and whether shortfalls trigger action.
How it shows up: Expect a question asking what is missing from an objective statement, such as no owner or no evaluation method.
Common confusion: Accepting a vague aspiration like strong security culture as a compliant objective.

2.10 Risk assessment and risk treatment approaches and methodologiesClauses 6.1.2, 6.1.3, 8.2 and 8.3.

What it means: The organization defines and applies a risk assessment process with criteria for acceptance and for performing assessments, identifies risks to confidentiality, integrity and availability with risk owners, analyzes and evaluates them. It then selects treatment options, determines necessary controls and prepares a treatment plan approved by risk owners.
What to understand: Assessments must be repeated at planned intervals or when significant changes occur (8.2). Treatment options include modifying, retaining, avoiding or sharing risk. Auditors trace a sample of risks from identification through treatment to implemented controls and risk owner acceptance.
How it shows up: A scenario shows risks rated but no owners assigned; the gap is in 6.1.2 c 2.
Common confusion: Thinking asset-based identification is required; the 2013 and 2022 editions allow event-based approaches too.

2.11 Selection of Annex A and additional controls and their inclusion in the Statement of ApplicabilityControl determination and the SoA.

What it means: The organization determines controls needed to treat risks from any source, compares them with Annex A to check nothing necessary was omitted, and produces a Statement of Applicability containing necessary controls, justification for inclusion, whether they are implemented and justification for excluding any Annex A control.
What to understand: The SoA is the bridge between risk treatment and audit sampling. Auditors check that every Annex A control appears, that inclusion links to risk or requirements, that implementation status is accurate, and that exclusions are credible.
How it shows up: Questions ask what the SoA must contain or how to treat a control marked implemented when no evidence exists.
Common confusion: Believing controls can come only from Annex A; organizations may add controls from other frameworks.

2.12 Performance evaluation: monitoring, measurement, analysis and evaluation, internal audit and management reviewClause 9 requirements.

What it means: Clause 9.1 requires deciding what to monitor and measure, methods, timing and who analyzes results. Clause 9.2 requires internal audits at planned intervals under an audit programme, with objective and impartial auditors. Clause 9.3 requires management reviews with defined inputs and decisions on improvement and change.
What to understand: Methods should produce comparable and reproducible results. Internal auditors must not audit their own work. Management review inputs include status of previous actions, changes in issues, interested party needs, performance trends, risk assessment results and improvement opportunities. Certification auditors expect at least one full internal audit and management review cycle before Stage 2.
How it shows up: Scenarios show the ISMS manager auditing processes they designed, which breaches objectivity under 9.2.
Common confusion: Assuming the certification audit can replace the internal audit.

2.13 Continual improvement and its application to an ISMSClause 10 on improvement, nonconformity and corrective action.

What it means: Clause 10.1 requires continual improvement of the suitability, adequacy and effectiveness of the ISMS. Clause 10.2 requires reacting to nonconformities, evaluating the need to eliminate causes, implementing action, reviewing effectiveness and keeping records.
What to understand: Correction fixes the immediate problem; corrective action removes the cause to prevent recurrence. The 2022 edition no longer has a separate preventive action clause because risk-based planning covers it. Auditors check that root cause analysis exists and that effectiveness was reviewed.
How it shows up: Questions describe a fixed problem that recurred and ask which clause 10.2 step was missed, usually cause analysis or effectiveness review.
Common confusion: Treating correction and corrective action as the same thing.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Statement of Applicability

Document listing necessary controls, justification, implementation status and justification for Annex A exclusions.

Remember
Required by clause 6.1.3 d; every Annex A control must be addressed.

Tested as
Central to Stage 1 review and control sampling.

Trap
Accepting a SoA that only lists implemented controls.
Annex A themes

Organizational 37, people 8, physical 14, technological 34.

Remember
93 controls in total; 11 new in 2022.

Tested as
Theme and count questions.

Trap
Using 2013 domain numbering.
Clause 4.3 scope

Documented boundaries and applicability of the ISMS.

Remember
Must consider issues, requirements, interfaces and dependencies.

Tested as
Scope scenarios in Stage 1.

Trap
Equating it with the audit scope.
Risk treatment plan

Plan for implementing chosen treatments, approved by risk owners.

Remember
Risk owners also accept residual risks.

Tested as
Evidence auditors request in Stage 2.

Trap
Accepting approval by the ISMS manager alone.
Clause 6.3 planning of changes

New 2022 requirement for planned ISMS changes.

Remember
Changes must be carried out in a planned manner.

Tested as
Edition-difference questions.

Trap
Thinking it is the same as Annex A 8.32 change management.
Management review inputs

Defined list in clause 9.3.2.

Remember
Includes interested party needs, changes in issues and nonconformity trends.

Tested as
Auditors test completeness of review minutes.

Trap
Accepting a meeting with no recorded decisions.
Internal audit objectivity

Auditors selected to ensure objectivity and impartiality (9.2.2).

Remember
People do not audit their own work.

Tested as
Common nonconformity scenario.

Trap
Thinking internal auditors must be external consultants.
Correction vs. corrective action

Immediate fix versus cause removal.

Remember
Clause 10.2 needs both plus effectiveness review.

Tested as
Repeated in Domain 6 action plan evaluation.

Trap
Closing a finding on correction alone.
Amendment 1:2024

Climate change consideration in clauses 4.1 and 4.2.

Remember
Organizations decide whether climate change is relevant.

Tested as
Current-edition questions.

Trap
Thinking it added new Annex A controls.
Documented information 7.5.1 b

Information the organization decides is necessary for ISMS effectiveness.

Remember
Required documents beyond the explicit list depend on this judgment.

Tested as
Mandatory-document questions.

Trap
Demanding a written procedure for every process.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

ISMS scope vs. audit scope vs. certificate scope

Concept	Meaning	Key difference	Common trap
ISMS scope	Boundaries and applicability set by the organization under clause 4.3	Defined by the auditee	Assuming the auditor sets it
Audit scope	Extent and boundaries of one audit: sites, processes, time period	Defined for each audit; may be a subset	Believing every audit must cover the whole ISMS
Certificate scope	Scope statement on the certificate issued by the certification body	Reflects what was audited and certified	Letting marketing wording claim more than was audited

Annex A control in the SoA: included, excluded, not yet implemented

Concept	Meaning	Key difference	Common trap
Included and implemented	Necessary control in operation	Auditor seeks implementation and effectiveness evidence	Accepting a policy as proof of operation
Included, not yet implemented	Necessary control planned in the treatment plan	Acceptable if the plan and residual risk acceptance exist	Raising an automatic nonconformity
Excluded	Annex A control judged not necessary	Needs a justification consistent with the risk assessment	Accepting not applicable with no reason

Correction vs. corrective action vs. continual improvement

Concept	Meaning	Key difference	Common trap
Correction	Action to eliminate a detected nonconformity	Fixes the instance	Treating it as sufficient
Corrective action	Action to eliminate the cause and prevent recurrence	Addresses root cause	Skipping effectiveness review
Continual improvement	Recurring activity to enhance performance (10.1)	Not limited to nonconformities	Thinking it requires a nonconformity to start

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

All Annex A controls required

What candidates pick
A nonconformity for not implementing an excluded control.

Why it looks right
Annex A is normative.

Why it's wrong
Normative means it must be compared and addressed in the SoA; exclusion is valid with justification.

Clue to watch for The SoA gives a reason consistent with the risk assessment.
Context must be written

What candidates pick
A nonconformity because issues under 4.1 are not documented.

Why it looks right
Auditors like documents.

Why it's wrong
Clause 4.1 does not require documented information; the auditee can show the analysis through other evidence.

Clue to watch for Interviews show issues were considered in scope and risk.
Old edition numbering

What candidates pick
An answer citing A.9 Access control.

Why it looks right
Many study sources still use 2013 numbering.

Why it's wrong
The 2022 edition uses controls 5.15 to 5.18 and 8.2 to 8.5 for access topics.

Clue to watch for Options mix numbering styles.
Delegated leadership

What candidates pick
Clause 5.1 is met because a CISO was appointed.

Why it looks right
Appointment is visible evidence.

Why it's wrong
Top management must itself demonstrate leadership and commitment through actions, resources and direction.

Clue to watch for No evidence of executive decisions or review participation.
Risk owner equals asset owner

What candidates pick
Approval by the asset custodian satisfies 6.1.3 f.

Why it looks right
The roles often overlap.

Why it's wrong
The requirement is approval by risk owners, who need accountability and authority to manage the risk.

Clue to watch for A technician signs off residual risk.

Answer framework

For a requirements question, locate the clause or control in your copy of the standard before judging conformity.

Identify the topic of the scenario and find the matching clause in 4 to 10 or the Annex A control by theme.
Read the exact shall statement and list what it requires: activity, documented information, approval or communication.
Check whether the auditee's situation lacks any listed element, and whether alternative evidence could still show conformity.
For Annex A items, check the Statement of Applicability and risk treatment link before deciding a control was required.
Pick the option that ties the gap to the precise requirement, rejecting answers based on ISO/IEC 27002 guidance, the 2013 edition, or the auditor's personal preference about how security should be done.

Practice question

At Stage 1, the auditor reviews a Statement of Applicability listing 81 Annex A controls as applicable and implemented. The other 12 controls do not appear anywhere in the document. What should the auditor conclude?

The SoA does not meet clause 6.1.3 d because every Annex A control must be addressed, with justification for exclusions The SoA is acceptable because organizations may implement any subset of Annex A The SoA is acceptable if the risk treatment plan lists the 12 missing controls The auditor should add the missing controls to the SoA during the audit

Show the answer

Answer A. Clause 6.1.3 d requires the SoA to contain the necessary controls, their justification, implementation status and the justification for excluding any Annex A control. Omitting 12 controls entirely means exclusions are not justified, so the requirement is not met. Organizations can exclude controls, but not silently. The risk treatment plan does not replace the SoA, and editing the auditee's document would breach auditor independence.

Want more like this? The ISO 27001 LA practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Work with a clean printed copy of ISO/IEC 27001:2022, because that is what you take into the exam. Tab each clause from 4 to 10 and the start of each Annex A theme. Then build a one-page table of mandatory documented information with clause references, and mark each entry in the margin of your copy.

Read every clause twice: once as an implementer would, and once asking what you would request as evidence and from whom. For example, for clause 9.3 write down the minutes, attendance and decisions you would sample. For Annex A, read the 11 new controls closely and practice mapping 2013 control references to their 2022 equivalents, since scenario stems sometimes describe a control in old terms.

Next, take one realistic Statement of Applicability, from training material or a template, and audit it: check for all 93 controls, justification, implementation status and exclusions. Finally, do timed practice questions, noting how long it takes you to find each clause. If navigation is slow, improve your tabs rather than trying to memorize text.

FAQ

How many questions come from Domain 2, ISMS and ISO/IEC 27001 Requirements?

The candidate handbook allots 8 of 80 questions, or 10%, to this domain. Its content is also needed to answer many Stage 1, Stage 2 and closing questions in other domains.

Can I take ISO/IEC 27001 into the exam?

Yes. PECB allows a printed copy of ISO/IEC 27001, the course materials, personal notes from the course and a printed dictionary. Electronic devices other than the exam application are not allowed.

Is Annex A mandatory?

Annex A is normative, so the organization must compare its controls against it and address every control in the Statement of Applicability. Individual controls are required only where risk treatment or other requirements make them necessary.

Do I need to know 2013 control numbers?

No, the exam uses the 2022 edition. Knowing the mapping helps only when auditees or old documents still use 2013 references.

Which clauses can an organization exclude?

None of clauses 4 to 10 can be excluded for certification. Only Annex A controls can be excluded, with justification in the Statement of Applicability.

Does ISO/IEC 27001 require a specific risk assessment method?

No. It requires defined criteria, consistent and comparable results, identified risk owners, and analysis and evaluation. The method, whether asset-based or scenario-based, is the organization's choice.

Related domains

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

ISO 27001 LA Domain 2: Information Security Management System (ISMS) and ISO/IEC 27001 Requirements

Overview

How it's tested

Mandatory or not

Clause mapping

Exclusion justification

Knowledge statements 13

High-yield concepts

Statement of Applicability

Annex A themes

Clause 4.3 scope

Risk treatment plan

Clause 6.3 planning of changes

Management review inputs

Internal audit objectivity

Correction vs. corrective action

Amendment 1:2024

Documented information 7.5.1 b

Side by side

ISMS scope vs. audit scope vs. certificate scope

Annex A control in the SoA: included, excluded, not yet implemented

Correction vs. corrective action vs. continual improvement

Exam traps

All Annex A controls required

Context must be written

Old edition numbering

Delegated leadership

Risk owner equals asset owner

Answer framework

Practice question

Checklist

Study strategy

FAQ

Other Cybersecurity certifications

Test your Domain 2 knowledge

Keep going