ISO 27001 LI · Domain 4 of 7

ISO 27001 LI Domain 4: Implementation of an ISMS Based on ISO/IEC 27001

Turning the plan into a working ISMS: managing documented information, handling new technologies such as big data, AI and cloud, running awareness and communication, and operating incident management and business continuity.

Exam weight
17.5%
Official knowledge statements
11
Estimated questions estimate
~14
Suggested study time estimate
11–14 hrs

About 15 min read Reviewed October 2026

Overview

Domain 4 covers the Do phase of an ISMS project. Its eleven knowledge statements address documented information life cycle management, the differences between policies, procedures, guidelines, standards, baselines and worksheets, the documents needed for ISO/IEC 27001 conformity, the three V's of big data, weak and strong artificial intelligence and machine learning, cloud service models, the security impact of new technologies, training and awareness programmes, communication plans, incident management, and business continuity with disaster recovery.

Relevant clauses are 7.2 to 7.5 and 8.1 to 8.3, together with Annex A controls such as 5.23, 5.24 to 5.30, 6.3 and 8.13. The domain accounts for 14 of the 80 exam questions.

How it's tested

Items are practical. You may be asked how to control a document, which document type fits a need, what a cloud customer remains responsible for, how to respond to a reported event, or what a communication plan must define. Scenario sets often follow an organization through rollout problems such as low awareness or an incident during implementation.

  • Document type

    A described text, such as mandatory password length or step-by-step backup instructions, is matched to standard, baseline, procedure, guideline or policy.

  • Who is responsible in the cloud

    A cloud service model is described and you decide whether the customer or provider handles a given security task.

  • Incident sequence

    You choose the next step after an event is reported, following planning, assessment, response and learning stages.

Reasoning it through

Staff report a suspicious email, and the service desk immediately wipes the user's laptop. The question asks what went wrong. Reason through Annex A 5.25 and 5.28: events must be assessed to decide whether they are incidents, and evidence should be collected and preserved. Wiping before assessment destroys evidence and may be unnecessary. The best answer is that assessment and evidence handling were skipped.

Knowledge statements 11

Official knowledge statements from the PECB outline, in outline order.

4.1 The best practices on documented information life cycle managementCreating, controlling and disposing of ISMS documents and records.
What it means
Clause 7.5.2 requires appropriate identification and description, format and media, and review and approval when documented information is created or updated. Clause 7.5.3 requires control of availability, protection, distribution, access, retrieval, use, storage, preservation, change control, retention and disposition.
What to understand
The life cycle runs from drafting through review, approval, publication, use, periodic review, revision and archiving or disposal. External documents, such as supplier contracts and regulations, must also be identified and controlled. Records are a type of documented information that must be protected from unintended alteration.
How it shows up
Questions ask which control is missing when an outdated procedure is still in use, typically version or distribution control.
Common confusion
Forgetting that external origin documents also need control.
4.2 The characteristics and the differences between the different documented information related to an ISMS policy, procedure, guideline, standard, baseline, worksheet, etc.Choosing the right document type.
What it means
A policy states management intent and direction. A standard sets mandatory specific requirements, such as encryption algorithms. A baseline defines minimum configuration for a system type. A procedure gives step-by-step instructions. A guideline offers recommended, non-mandatory practice. A worksheet or form captures data, often becoming a record.
What to understand
The hierarchy runs from policy to standards and baselines to procedures and guidelines. Mandatory documents use 'must' language; guidelines use 'should'. Placing the right content at the right level keeps policies stable and lets technical details change without re-approving top-level documents.
How it shows up
Expect items describing content and asking which document type it belongs to.
Common confusion
Treating guidelines as mandatory or standards as optional.
4.3 The documents that ensure compliance with ISO/IEC 27001 requirementsDocumented information the standard explicitly requires.
What it means
Required items include the scope, information security policy, risk assessment process, risk treatment process, Statement of Applicability, objectives, evidence of competence, documented information for operational planning and control, risk assessment and treatment results, monitoring and measurement results, internal audit programme and results, management review results, and nonconformities with corrective action results.
What to understand
Some Annex A controls add documentation needs when selected, such as 5.1 policies, 5.9 inventory, 5.37 operating procedures and 5.31 legal requirements. Beyond these, the organization decides what is necessary for effectiveness. Auditors check that required items exist and are controlled.
How it shows up
Questions offer three documents and ask which is explicitly required by ISO/IEC 27001.
Common confusion
Believing a formal ISMS manual is mandatory.
4.4 The three V's of big data: volume, variety, and velocityCharacteristics of big data and their security implications.
What it means
Volume is the scale of data, variety is the range of structured and unstructured formats, and velocity is the speed at which data is generated and processed. Some models add veracity and value.
What to understand
Each V raises security issues: volume increases the impact of breaches and storage costs, variety complicates classification and access control, and velocity limits time for validation and monitoring. Controls such as 5.12 classification, 8.11 data masking, 8.10 information deletion and 5.34 privacy protection become harder at scale.
How it shows up
Expect definitional items, such as which V describes real-time streaming data.
Common confusion
Swapping the meanings of variety and velocity.
4.5 Weak and strong artificial intelligence, machine learningAI concepts relevant to information security.
What it means
Weak or narrow AI performs specific tasks, such as fraud detection or language translation. Strong or general AI would match human reasoning across tasks and does not yet exist. Machine learning is a subset of AI in which systems learn patterns from data rather than following explicit rules.
What to understand
Security concerns include training data confidentiality, poisoning of training data, model manipulation, leakage of sensitive information through outputs, and bias affecting decisions. AI also supports security through anomaly detection. ISO/IEC 42001 addresses AI management systems separately from the ISMS.
How it shows up
Questions ask whether a described system is weak AI, or what security risk applies to ML training data.
Common confusion
Describing current generative AI tools as strong AI.
4.6 Cloud computing services: infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS)Cloud service models and shared responsibility.
What it means
In IaaS the provider supplies compute, storage and networking, and the customer manages operating systems, applications and data. In PaaS the provider also manages the runtime and middleware. In SaaS the provider runs the application, and the customer mainly manages data, users and configuration.
What to understand
Responsibility shifts toward the provider from IaaS to SaaS, but the customer always remains accountable for its data and access. Annex A 5.23 requires processes for acquiring, using, managing and exiting cloud services. ISO/IEC 27017 and 27018 give cloud-specific guidance.
How it shows up
Expect items asking who patches the operating system in a given model, or which control covers cloud exit.
Common confusion
Assuming a SaaS provider is responsible for the customer's user access reviews.
4.7 The impact of new technologies in information securityHow emerging technology changes the risk picture.
What it means
New technologies such as cloud, IoT, AI, mobile and remote work tools, and operational technology integration change threats, vulnerabilities and dependencies. They often introduce third-party reliance, new attack surfaces and data spread beyond traditional boundaries.
What to understand
The ISMS handles them through change: context review under 4.1, risk assessment when significant changes occur under 8.2, planning of changes under 6.3 and controls such as 5.23 cloud, 8.9 configuration management and 5.7 threat intelligence. Adoption should be risk-assessed before deployment rather than afterwards.
How it shows up
Questions ask what the implementer should do when the business adopts a new technology mid-project.
Common confusion
Treating new technology as an IT decision outside the ISMS.
4.8 The characteristics and the best practices of implementing information security training and awareness programs and communication plansCompetence, awareness and training under clauses 7.2 and 7.3.
What it means
Clause 7.2 requires determining competence, ensuring it through education, training or experience, taking actions to acquire it and retaining evidence. Clause 7.3 requires people to be aware of the policy, their contribution to effectiveness and the implications of not conforming. Annex A 6.3 covers awareness, education and training.
What to understand
Awareness targets everyone and changes behaviour; training builds skills for specific roles; education builds deeper understanding. Good programmes use role-based content, varied formats, regular refreshers and effectiveness measures such as phishing simulation results. Training attendance alone does not prove competence.
How it shows up
Expect scenarios where incidents continue after training, and the answer involves measuring effectiveness or tailoring content.
Common confusion
Treating awareness sessions as evidence of competence for specialist roles.
4.9 The communication objectives, activities, and interested parties to enhance their support and confidenceInternal and external communication under clause 7.4.
What it means
Clause 7.4 requires the organization to determine the need for internal and external communication relevant to the ISMS, including on what to communicate, when, with whom and how. Communication builds support from staff, management, customers, suppliers and regulators.
What to understand
A communication plan sets objectives, audiences, messages, channels, frequency, responsibilities and approvals. External communications, such as breach notifications or customer assurance, need authorization and consistency. Annex A 5.5 and 5.6 cover contact with authorities and special interest groups.
How it shows up
Questions ask which element clause 7.4 requires, or who should approve external communications about an incident.
Common confusion
Confusing the communication plan with the awareness programme.
4.10 The incident management process based on information security best practicesDetecting, reporting, assessing and responding to incidents.
What it means
Annex A 5.24 to 5.28 and 6.8 cover planning and preparation, assessment and decision on events, response, learning from incidents, collection of evidence, and event reporting by personnel. ISO/IEC 27035 gives detailed guidance with phases such as plan and prepare, detect and report, assess and decide, respond, and learn lessons.
What to understand
Not every event is an incident; assessment decides. Roles, escalation, communication and legal or regulatory notification deadlines must be defined in advance. Evidence must be handled to preserve integrity and chain of custody. Lessons learned feed risk assessment and controls.
How it shows up
Expect sequence questions after an event is reported, or questions on evidence handling.
Common confusion
Treating every reported event as a confirmed incident.
4.11 Business continuity and disaster recoveryMaintaining information security and ICT during disruption.
What it means
Business continuity keeps critical activities running during disruption; disaster recovery restores IT systems and data. Annex A 5.29 requires information security to be maintained during disruption, 5.30 ICT readiness for business continuity, 8.13 information backup and 8.14 redundancy.
What to understand
Business impact analysis determines recovery time objectives and recovery point objectives, which drive backup frequency and recovery design. Plans must be tested. ISO 22301 is the continuity management standard and ISO/IEC 27031 covers ICT readiness. Security controls should not be dropped during a crisis.
How it shows up
Questions ask which metric defines acceptable data loss, or what 5.30 requires.
Common confusion
Mixing up recovery time objective and recovery point objective.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Documented information

    Information that must be controlled and maintained, and its medium.

    Remember
    Covers both documents and records.
    Tested as
    Clause 7.5 items.
    Trap
    Thinking only paper documents count.

  • Baseline

    Minimum security configuration for a system type.

    Remember
    Mandatory minimum, more specific than a standard.
    Tested as
    Document type items.
    Trap
    Calling it a guideline.

  • Guideline

    Recommended practice that is not mandatory.

    Remember
    Uses should rather than must.
    Tested as
    Document type items.
    Trap
    Enforcing it as a rule.

  • Shared responsibility model

    Split of security duties between cloud provider and customer.

    Remember
    Customer always keeps data and access accountability.
    Tested as
    Cloud scenarios.
    Trap
    Assuming SaaS removes customer duties.

  • Machine learning

    AI subset that learns patterns from data.

    Remember
    Training data integrity and confidentiality matter.
    Tested as
    New technology items.
    Trap
    Equating ML with strong AI.

  • Awareness

    Understanding of policy, role and consequences of nonconformity.

    Remember
    Clause 7.3 lists three awareness points.
    Tested as
    Programme design items.
    Trap
    Measured only by attendance.

  • Competence

    Ability to apply knowledge and skills to achieve results.

    Remember
    Evidence must be retained under 7.2.
    Tested as
    Role readiness items.
    Trap
    Assuming training equals competence.

  • Information security event

    Occurrence indicating a possible breach or control failure.

    Remember
    Assessed to decide whether it is an incident.
    Tested as
    Incident sequence items.
    Trap
    Escalating every event as an incident.

  • Chain of custody

    Record of evidence handling from collection onward.

    Remember
    Supports Annex A 5.28.
    Tested as
    Evidence questions.
    Trap
    Wiping devices before preserving evidence.

  • RPO and RTO

    Acceptable data loss and acceptable downtime targets.

    Remember
    RPO drives backup frequency; RTO drives recovery speed.
    Tested as
    Continuity questions.
    Trap
    Swapping the two.

  • Clause 7.4 communication

    What, when, with whom and how to communicate.

    Remember
    Applies internally and externally.
    Tested as
    Plan content items.
    Trap
    Treating it as awareness training.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Policy vs. standard vs. procedure vs. guideline

ConceptMeaningKey differenceCommon trap
Policy Management intent and direction High-level, stable, approved by management Filled with technical settings
Standard Mandatory specific requirements Defines what must be used Treated as optional
Procedure Step-by-step instructions Defines how to do it Confused with policy
Guideline Recommended practice Not mandatory Audited as a requirement

IaaS vs. PaaS vs. SaaS customer responsibility

ConceptMeaningKey differenceCommon trap
IaaS Customer manages OS, middleware, applications and data Most customer responsibility Expecting the provider to patch the OS
PaaS Customer manages applications and data Provider runs the platform Ignoring application security
SaaS Customer manages data, users and configuration Least customer responsibility Thinking no customer controls are needed

Business continuity vs. disaster recovery

ConceptMeaningKey differenceCommon trap
Business continuity Keeping critical activities running during disruption Business-wide focus Reduced to IT restore plans
Disaster recovery Restoring IT systems and data after disruption Technology focus Assumed to cover manual workarounds

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. ISMS manual required

    What candidates pick
    Create an ISMS manual because the standard requires it.
    Why it looks right
    Older quality systems used manuals.
    Why it's wrong
    ISO/IEC 27001 does not require a manual; it lists specific documented information and leaves the rest to the organization.

    Clue to watch for Question asks which document is mandatory.

  2. Provider owns everything

    What candidates pick
    In SaaS, the provider manages user access reviews.
    Why it looks right
    The provider runs the application.
    Why it's wrong
    The customer manages its own users, permissions and data, even when the provider runs the application.

    Clue to watch for Task concerns the customer's users or data.

  3. Training as competence

    What candidates pick
    Course certificates prove the SOC analyst is competent.
    Why it looks right
    Certificates are easy evidence.
    Why it's wrong
    Competence means ability to achieve results; it needs evaluation of performance as well as training records.

    Clue to watch for Scenario shows trained staff still making errors.

  4. Respond before assessing

    What candidates pick
    Immediately reimage the affected machine.
    Why it looks right
    Fast containment feels right.
    Why it's wrong
    Events need assessment and evidence collection first, or forensic data and legal options are lost.

    Clue to watch for Scenario mentions possible legal action or unclear cause.

  5. RPO as downtime

    What candidates pick
    RPO defines how long systems may be down.
    Why it looks right
    Both terms deal with recovery.
    Why it's wrong
    RPO is the maximum acceptable data loss measured in time; RTO is the acceptable downtime.

    Clue to watch for Question mentions backup frequency.

Answer framework

For implementation questions, identify the clause or control at play and check whether it is operating and evidenced.

  1. Determine whether the scenario concerns documents, technology adoption, people, communication, incidents or continuity, and locate the relevant clause or Annex A control.
  2. For documents, check creation, approval, version, distribution, access, retention and disposal requirements, and whether the document type fits its content.
  3. For technology, check that risk was assessed before adoption and that responsibilities are clearly assigned, especially with cloud providers.
  4. For people and communication, check role-based content, effectiveness measurement and a plan stating what, when, with whom and how.
  5. For incidents and continuity, follow the defined sequence, preserve evidence, meet notification obligations and test plans against RTO and RPO.

Practice question

A retailer moves its HR system to a SaaS provider during ISMS implementation. Three months later, an internal review finds former employees still have active accounts in the HR application. Who is primarily responsible for this control failure?

Want more like this? The ISO 27001 LI practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with clause 7.5 and list the mandatory documented information by clause number on one page. Then write five short texts, such as a password rule, a laptop hardening list and a backup checklist, and label each by document type. This covers the first three knowledge statements quickly.

Next, give two hours to the technology statements. Draw a shared responsibility table for IaaS, PaaS and SaaS, write definitions for the three V's, weak and strong AI and machine learning, and list one security risk and one Annex A control for each. These items are simple once studied but easy to miss.

Then study people and process. Compare clauses 7.2, 7.3 and 7.4 in a table. Read Annex A 5.24 to 5.30, 6.8, 8.13 and 8.14 and sketch the incident flow from report to lessons learned. Work through a continuity example with RTO and RPO values.

Finish with fourteen-question practice blocks and review every miss against the clause or control involved, adding tabs to your printed standard where you were slow.

FAQ

How many questions come from Domain 4, Implementation of an ISMS Based on ISO/IEC 27001?

PECB allots 14 of the 80 questions to this domain, which is 17.5% of the exam.

Why does an ISO/IEC 27001 exam include big data and AI?

The handbook lists them because implementers must assess how new technologies affect information security. Expect definitional questions and questions on related risks rather than technical depth.

Is an ISMS manual required?

No. ISO/IEC 27001 specifies particular documented information, such as scope, policy, risk processes and the Statement of Applicability, and leaves other documentation to the organization's judgement.

What is the difference between awareness and communication?

Awareness under clause 7.3 ensures people understand the policy, their contribution and consequences of nonconformity. Communication under clause 7.4 plans what is shared, when, with whom and how, internally and externally.

Which standard gives detailed incident management guidance?

ISO/IEC 27035 describes incident management phases in detail. The exam tests the Annex A controls 5.24 to 5.28 and 6.8 and the general process.

Does business continuity belong to the ISMS?

Information security continuity does. Annex A 5.29 and 5.30 require security to be maintained and ICT readiness during disruption. Full business continuity management is covered by ISO 22301.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

Find out whether you can control documented information, assign cloud responsibilities, plan awareness and handle incidents the way PECB tests them.

Take the ISO 27001 LI practice test Check your ISO 27001 LI readiness

Keep going