EXAM-001 - Clauses 4-10 vs Annex A

Topic Summary

The exam often tests whether you understand the difference between mandatory management-system requirements and risk-selected controls.

Key Concepts

• ISO/IEC 27001 Clauses 4-10 define the ISMS requirements.
• Annex A is a control reference set.
• Annex A controls are not automatically all mandatory.
• Non-applicability must be justified in the Statement of Applicability.

Common Exam Traps

• Treating Annex A as a universal checklist.
• Saying Clauses 4-10 can be excluded.
• Confusing ISO/IEC 27002 guidance with ISO/IEC 27001 certification requirements.

Related Notes

• ISO 27001 Clauses 4-10 vs Annex A
• Annex A and the Statement of Applicability
• Statement of Applicability