Exam ISO-IEC-27035-Lead-Incident-Manager Topic 1 Question 32 Discussion
Actual exam question for PECB's ISO-IEC-27035-Lead-Incident-Manager exam
Question #: 32
Topic #: 1
Question #: 32
Topic #: 1
Who should have access to training materials on information security incident management?
Suggested Answer: C Vote an answer
Comprehensive and Detailed Explanation From Exact Extract:
ISO/IEC 27035 and ISO/IEC 27001 emphasize that information security awareness and training must extend to all personnel, not just those in technical roles. Clause 7.3.2 of ISO/IEC 27035-2 specifically states that
"training should be made available to all staff," including non-technical users, third-party service providers, contractors, and any personnel with access to organizational assets or systems.
The rationale is that every user is a potential entry point for cyber threats. Whether through phishing, social engineering, or misconfiguration, untrained staff can unintentionally compromise the organization's security posture. Therefore, organizations must ensure that everyone-especially new hires, contractors, and third- party partners-is trained on incident reporting procedures, security responsibilities, and escalation paths.
Reference Extracts:
ISO/IEC 27035-2:2016, Clause 7.3.2: "Training and awareness activities should be targeted at all users of the organization's systems and services." ISO/IEC 27001:2022, Control 6.3: "Ensure that personnel are aware of their information security responsibilities." Correct answer: C
-
ISO/IEC 27035 and ISO/IEC 27001 emphasize that information security awareness and training must extend to all personnel, not just those in technical roles. Clause 7.3.2 of ISO/IEC 27035-2 specifically states that
"training should be made available to all staff," including non-technical users, third-party service providers, contractors, and any personnel with access to organizational assets or systems.
The rationale is that every user is a potential entry point for cyber threats. Whether through phishing, social engineering, or misconfiguration, untrained staff can unintentionally compromise the organization's security posture. Therefore, organizations must ensure that everyone-especially new hires, contractors, and third- party partners-is trained on incident reporting procedures, security responsibilities, and escalation paths.
Reference Extracts:
ISO/IEC 27035-2:2016, Clause 7.3.2: "Training and awareness activities should be targeted at all users of the organization's systems and services." ISO/IEC 27001:2022, Control 6.3: "Ensure that personnel are aware of their information security responsibilities." Correct answer: C
-
by Rod at Oct 06, 2026, 10:00 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).