Compliance & GRC Quiz

Governance, risk, and compliance. Frameworks, audits, and the regulatory side of running IT.

This category currently has 100 questions in the SERVBG quiz bank. Below are a few sample questions: the full interactive quiz shuffles through the whole set with instant scoring.

Sample questions

In ISO/IEC 27001:2022, how many controls are listed in Annex A?

Which document in an ISO 27001 ISMS explicitly records which Annex A controls are applicable and justifies exclusions?

Statement of Applicability (SoA)
ISMS Policy
Asset Register
Internal Audit Report
Risk Treatment Plan

Under ISO 27001:2022, which of the following is a NEW control theme that did NOT exist as a separate theme in the 2013 edition?

Organizational controls
Physical controls
Operational controls
People controls
Technological controls (Theme D)

ISO 27001 requires internal audits to be conducted at what minimum frequency?

At planned intervals determined by the organisation
Every six months
Every two years
Annually without exception
Only before certification renewal

During ISMS scope definition, an organisation excludes its data centre operations. Which statement is correct?

Exclusions are freely allowed if documented in the risk register only.
Excluded areas require a separate ISO 27001 certificate.
Scope exclusions only need approval from the certification body.
Exclusions must not affect the organisation's ability to achieve intended ISMS outcomes and must be justified in the SoA.
ISO 27001 prohibits any scope exclusions once certification is sought.

Start the full quiz ›