The requirement for guidance in response and recovery from cybersecurity incidents is not a part of ISO27001 compliance. This is a guideline provided by the NIST Framework for Improving Critical Infrastructure Cybersecurity. ISO27001 focuses on the establishment and maintenance of an Information Security Management System (ISMS), risk management, and the implementation of effective controls. While it does require a procedure for responding to and managing information security incidents, it does not specifically require guidance in response and recovery from cybersecurity incidents. Therefore, this is not a requirement for a company to be certified as ISO27001 compliant.

Choice A is incorrect. Having an Information Security Management System (ISMS) that manages its information security risks is indeed a requirement for ISO27001 certification. The ISMS should be designed to ensure the selection of adequate and proportionate security controls that protect information assets and give assurance to interested parties.

Choice B is incorrect. Designing and implementing effective and comprehensive controls for information security is also a requirement for ISO27001 certification. These controls are necessary to manage or reduce the risks identified through the risk assessment process.

Choice C is incorrect. Adopting an ongoing risk management process is another requirement for ISO27001 certification. This involves conducting regular reviews and audits of the ISMS to ensure its continual improvement in line with changes in the threat environment, business circumstances, legal requirements, etc.

Things to Remember

• ISO27001 is an international standard for Information Security Management Systems (ISMS) that provides a framework for organizations to manage and protect their information assets.
• ISMS helps organizations identify, manage, and minimize risks to information security, ensuring the confidentiality, integrity, and availability of information.
• Risk management is a key component of ISO27001, requiring organizations to assess risks, implement controls to mitigate those risks, and regularly review and update their security measures.
• ISO27001 certification demonstrates to stakeholders, customers, and partners that an organization has implemented best practices for information security management.