Control A.8.1.1 requires an inventory of *all* assets associated with information and information processing facilities. This includes information assets, software assets, and physical assets. Being ‘cloud-first’ does not eliminate the organization’s responsibility to identify and manage its information assets. The justification confuses the asset type (servers) with the control’s broader purpose.

Clause 7.3 (Awareness) specifically requires that persons doing work under the organization’s control are aware of the information security policy, their contribution to the ISMS effectiveness, and the implications of not conforming. While training supports competence (7.2), the failure to complete mandatory training is directly a failure of maintaining awareness as required by clause 7.3. Option D is an Annex A control, not a mandatory clause.

Implementing a security control like MFA is an example of ‘modifying the risk’ (also commonly called ‘treating’ or ‘mitigating’ the risk). The control is put in place to reduce the likelihood and/or impact of the identified risk (phishing leading to credential theft). It does not avoid the activity, retain it without action, or transfer it to another party.

The ‘Check’ stage corresponds to Clause 9 (Performance evaluation). Its core purpose is to systematically monitor, measure, analyze, and evaluate the performance and effectiveness of the ISMS. This includes conducting internal audits and management reviews. While option D is an action that may result from the ‘Check’ stage, it is part of the ‘Act’ stage. Option A is ‘Do’, and option C is ‘Plan’.

Clause 4.3, which defines the requirements for determining the scope of the ISMS, explicitly states that the organization must consider ‘the interfaces and dependencies between activities performed by the organization, and those that are performed by other organizations.’ The other options are not mandated considerations by the standard.

For a risk to be legitimately accepted, the decision must be based on the organization’s defined risk acceptance criteria (Clause 6.1.3 c). If the risk level (likelihood and impact) falls within the bounds of what the organization has pre-defined as acceptable, it can be accepted. This decision and its justification should be documented, but the core requirement is alignment with the established criteria.

Clause 4.1 requires the organization to determine external and internal issues relevant to its purpose and affecting its ability to achieve the ISMS objectives. The fundamental distinction is that the internal context pertains to factors inside the organization (e.g., culture, resources, processes), which it can generally control or influence. The external context pertains to factors outside the organization (e.g., legal, regulatory, competitive, technological environment), which it cannot control but must understand and respond to.

The Information Security Policy is an internal document that may contain sensitive information about the organization’s security posture, objectives, and governance. Before sharing it with any external party, the organization must apply its information classification and handling procedures (linked to controls like A.8.2.1 and A.8.2.2) to determine if it should be shared, and if so, under what conditions (e.g., under an NDA). This is a practical application of protecting the organization’s information assets.

The Information Security Policy is the cornerstone document of the ISMS, mandated by Clause 5.2. It is established by top management and provides the overarching framework, objectives, and commitment for information security. The SoA and RTP are derived from it, and the audit report assesses conformity against it and the standard.

Control A.8.1.1 requires an inventory of *all* assets associated with information and information processing facilities. This includes information assets, software assets, and physical assets. Being ‘cloud-first’ does not eliminate the organization’s responsibility to identify and manage its information assets. The justification confuses the asset type (servers) with the control’s broader purpose.0