Property that information is well-known and communicated

Property that an entity is what it claims to be

Invulnerability

ISO/IEC 27019

ISO/IEC 27006

The standard specifies requirements for bodies providing audit and certification of information security management systems.

PDCA describes the characteristics of information to be maintained in the context of information security.

ISO/IEC 27002 defines 14 information security processes to ensure that the objectives from Annex A of ISO/IEC 27001 can be achieved.

In Annex A of the ISO/IEC 27001 standard, each control refers to one or more control objectives.

FitSM

Treat Information security risks 

Avoid information security risks

Risk documentation criteria

Criteria for performing assessments of risk treatment actions

Annex A provides an overview of the most relevant information security threats that need to be considered when assessing information security risks.

Annex A contains a scope statement that must be adopted by all organizations that claim conformity against ISO/IEC 27001.

Which information security incidents could have been avoided.

Internal audits are carried out by an the organization's top management.

Evaluate information security risks

All information security risk treatment actions according to the risk treatment plan

An appropriate level of confidentiality and integrity can only be achieved by the use of encryption and digital signatures.

Information that are not confidential can not be protected in their integrity.

All measures formulated in ISO / IEC 27001 Annex A are of a purely organizational nature

All controls formulated in ISO/IEC 27001 (Annex A) are of a technical nature.

It must be controlled by an external party.

Reporting of serious information security incidents to supervisory authorities

Distribution of the risk treatment plan to all interested parties

Information classification

Establish organizational responsibilities for suppliers in collaboration with administrative units

Ensure that the security officer has released and approved the information security policy

Every risk assessment shall be followed by a management review of the ISMS.

The lawfulness of the ISMS

The accuracy of the ISMS

Attend all meetings of the computer emergency response team (CERT)

A document has not been encrypted.

Information in a document was made available to an unauthorized individual.

Assess all information security risks

Conduct audit interviews with all employees

Energy efficiency

Annex A is a catalog of security threats.

Controls against malware

Physical access control

Secure login procedures 

The full implementation of ISO/IEC 27002 is a mandatory requirement for a certification according to ISO/IEC 27001.

ISO/IEC 27003 contains requirements for the implementation of information security controls.

Which communication is to be classified as undesirable

Thresholds and limits of communication costs

Risk support

24 hours support 

Service desk 

The organization shall audit its customers.

The organization shall conduct an internal audit at least every 6 months.

Ensure that there are identical rules for teleworking and remote working during business trips

Background verification checks of candidates for employment do not include a review of social media profiles.

Information security responsibilities are defined as part of the contractual arrangements with employees. However, they are not explicitly stated in the contract. Instead, only a reference is made to the obligation to comply with relevant policies.

Security screening of applicants takes place, but to varying extent and in varying thoroughness, which depends on the position for which a candidate for employment is evaluated.

The personnel records of all employees have been reviewed and approved by the information security officer.

The disciplinary process is confidential and only communicated to senior staff members.

Reliability

User access provisioning

There are several delivery and loading areas on the organization's premises.

No preventive measures have been implemented against the effects of earthquakes.

There is no electronic locking system. All doors are only secured with mechanical locks.

To ensure that auditing activities during operation are effectively prevented.

To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered.

To ensure the protection of data used for testing.

Clock synchronization

An accumulation of several information security events has to be defined as an information security problem.

Every information security event results into an information security incident.

Provision of user access rights

Not all traffic over the communication networks is encrypted.

The separation of networks takes place only via virtual private networks (VPN).

Information security considerations in business continuity management may be excluded from the applicability to the ISMS without further justification in the statement of applicability.

Ensuring non-verifiability of compliance violations

Redundant allocation of responsibilities for information security

Backend security comes before client security

Classification schemes for information assets

Defense of legal claims in connection with information security incidents

The certification body must comply with the requirements of ISO/IEC 27021.

Classification of media

Inventory of data storage media

The described procedure lacks an important 3rd factor to be considered during risk analysis.

This is a risk identification procedure.

The scope of the ISMS must be protected from disclosure (loss of confidentiality).

The scope of the ISMS can be limited by selecting those requirements from ISO/IEC 27001 that need to be fulfilled.

Process definition for customer relationship management

Implementation of corrective actions

Continuous performance assessment of employees

Their results form the basis for creating the statement of applicability.

Total costs for the ISMS

Status of information security events currently being processed

The overall information security policy must be approved by the information security officer.

Information security policies must be aligned with the procedures for handling information security incidents.

Terms and conditions of employment

Physical entry controls

Anonymity

Professional correctness

Compliance with physical laws

Manage changes to the infrastructure to avoid future information security events

All IT services provided by ACME IT are governed by the ISMS.

Some services are provided by multiple suppliers (co-sourcing).

Controls for the development of prototypes

A known error is an incident that has occurred more than three times during the last 28 days.

While a procedure states intentions and direction as formally expressed by its top management, a procedure is a specified way to carry out an activity or process.

The scope determines the number of internal audits that will be conducted to evaluate the performance of the SMS.

The scope of the SMS must cover all services delivered by the organization.

Approve every document that is part of the SMS.

It shall include all requirements from ISO/IEC 20000-1.

It shall include detailed procedures for each service management process.

Records of all activities carried out by the organization

To achieve conformity with ISO/IEC 20000-1, no sub-contracted suppliers must occur in the supply chain of the organization.

Maintaining the service catalogue(s) is subject to the configuration management process.

The service catalogue(s) may cover proposed services, those in development, live services and services that are to be removed.

Priority

Information security controls are implemented to mitigate all potential information security risks and achieve the maximum level of information security.

Capacity management

Configuration management

Number of requests for changes already waiting for approval

Number of problems that are allowed to occur during the transition phase

Change management

Verification

While incidents and problems are prioritized, service requests are not.

The urgency with which an incident has to be resolved is independent from any SLAs with customers.

Service acceptance criteria

Maintain and update information on known errors

After a major incident occurred

After a new problem has been identified

Economic viability analysis

Balanced scorecard analysis

Management reviews may be conducted by senior consultants on behalf of the organization’s top management.

ITIL: Auditable requirements for IT service management

The ISO/IEC 20000-1 certificate proves that the highest possible service level has been achieved for all services in the scope of the certification.

Property that information is well-known and communicated

Property that an entity is what it claims to be

Only blockchains with encrypted user data are called distributed ledger chains.

POW is only used in bitcoins

10 bitcents equal 1 bitcoin.

10,000,000 satoshi amount to one bitcoin.

When the Block Reward drops below 100 BTC, the transaction fees will no longer be charged.

All miners who have solved the computational puzzle are rewarded, regardless of whether their block chain continues or not.

It is necessary to ensure the integrity of personal data.

SegWit

Lightning protocol

There is no upper limit for the total amount of bitcoins generated.

RSA

A hash function is a character string agreed between two parties that is used for authentication.

Property that information is well-known and communicated

Stability

ISO/IEC 27006

ISO/IEC 27001

The standard specifies requirements for bodies providing audit and certification of information security management systems.

The standard defines binding security features for information processing facilities.

PDCA describes the principles of information security.

ISO/IEC 27002 defines 14 information security processes to ensure that the objectives from Annex A of ISO/IEC 27001 can be achieved.

Processes are the formal expression of the intentions and direction of an organization as defined by top management.

Criteria for determining the degree of conformity of the ISMS

Risk documentation criteria

The frequency of surveillance audits and audits for re-certification to be carried out in order to maintain certification against ISO/IEC 27001.

Whether the maximum level of information security has been achieved based on the current state of technology.

Visit to the website

The Social Engineer manipulates the system administrator PC.

The Social Engineer manipulates the boss's smartphone to access his contact list.

The company's website is a good source of private information about the victim.

Google Hacking is only available to registered Google users.

Google hacking refers to the attack on Google's infrastructure.

Access control test

IT forensics is a pure post-mortem analysis and only begins when the security incident has already occurred.

Establishing the identity of the attacker.

It is irrelevant if two experts arrive at different results by applying the same method and using the same tools.

A person commissioned by a firm to perform a penetration test is referred to as a cracker.

Crackers are often employees of intelligence services engaged in industrial espionage.

Trade secret

Promotion of freedom of information

The BDSG contains regulations which override those of the DSGVO.

The BDSG does not apply to clubs or associations.

Compliance with these principles is the basic foundation of legal data processing.

True legality can only be achieved through the consent of the data subject in conjunction with a national law.

True legality can only be achieved through the consent of the data subject.

Consent can also be assumed, even though there is no certainty about this.

Bank account information

Income

These data may only ever be collected and processed with the consent of the data subject.

In Germany, only persons with German citizenship are entitled to these rights.

Right to analyze data

The information requirements only affect companies with more than 50 employees.

The information must generally be provided within one month.

Data must always be completely deleted when a customer contract has been cancelled.

Data must always be deleted if data subjects request it.

The supervisory authorities only impose fines if several data subjects have suffered damage.

Data subjects are only entitled to compensation if their data has been processed without their knowledge.

If there is one, the workers' council must consent to  data processing in advance.

Consent is always required in advance for the processing of employee data.

Video surveillance recordings may be stored indefinitely if they could still be needed.

Video surveillance always requires the consent of the subjects.

Courier services

Cleaning services

Contracts for order processing

Under certain conditions, one person can be appointed as the data protection officer for all companies in a corporate group.

The prerequisite for appointment as a data protection officer is sufficient expertise.

Implementation of the data protection impact assessment

Keeping the inventory of processing activities

Data transfers to contract processors can be justified using binding corporate rules.

Data transfers to service providers in the USA may be permitted through the establishment of contracts for order processing. 

A data protection impact assessment must be conducted if there is a risk to the rights and freedoms of natural persons.

Sustainability

E-mail encryption increases the confidentiality of data during transfer.

Video surveillance increases protection against unauthorized access to data processing rooms.

The supervisory authority shall be involved immediately.

The supervisory authority shall be informed immediately.

Carrying out the data protection impact assessment upon request.

Type 1 and type 2 reports replace an ISO27001 certification. 

Type 1 and type 2 reports are designed to be industry-oriented. 

Both a Type 1 and a Type 2 report are required to assess effectiveness. 

An ISO27001 auditor may create such a report. 

Anyone who is accredited by the respective national accreditation body may prepare such a report. 

Section 1 contains the certificate issued by the auditor. 

Section 6 includes a cost presentation. 

An ISAE3402 report must always be supplemented by an audit, which the auditor of the User Organization carries out at the Service Organization. 

Aspects relevant to information security are never covered in an ISAE3402 report. 

Outsourced operation of an access control system.

An ISAE3402 Type 1 report is sufficient for evaluating the effectiveness of the internal control system at the Service Organization. 

The collaboration with the subcontractor does not have to be regulated. 

Subcontractors can be used without any precautions and without informing the User Organization. 

Service management criteria from ISO20000

ISAE3402 is the international equivalent of SOC2.

ISAE3402 and SOC1 are not related. 

The documentation of the internal control system is prepared by the auditor of the User Organization.

Documentation is required for internal purposes only and must always be kept secret. 

... must always be created by the IT management. 

... Necessitates an amount of effort that is disproportionate to the added value it generates, and therefore not worth it.

ITGCs are only required if the auditor of the User Organization explicitly requests them. 

Requests of the management

The auditing organization that audits a Service Organization is always chosen by the User Organization. 

A certificate issued by the auditor. 

... assessment of the conformity of processes to ISO27001. 

... the estimation of expected costs.

ISO9001

Costs

Requests of the IT management

Each ISAE3402 report must contain a section 5.

... irrelevant for outsourcing.

Deviations are not covered by the ISAE3402 standard. 

Deviations are not documented in the report. 

They want to use the ISAE3402 report to eliminate any kind of fraud.

They want to use the control environment to reduce the prices of the Service Organization. 

To receive a certificate. 

... are never a component.

Document all requirements model-based

Implement requirements, even if there are conflicts regarding their content

Technical requirements

It does not influence the architecture of a system. 

The reaction time must not exceed 0.5 seconds. 

Only internal employees should be managed as stakeholders.

The wife of the IT manager

Training in NLP (neurolinguistic programming)

In-depth knowledge in all areas of expertise related to system implementation

Business documentation

Class diagrams for the documentation of the system processes

State diagrams for the documentation of the data modeling

Source Code Perspective

Statecharts

UML activity diagram

ER Diagram

UML activity diagram

Competitive products available on the market may not be considered for copyright reasons. 

Controlling-oriented techniques

Commercial techniques

The Kano model is only used in IT Service Management because it is exclusively IT-related. 

In interview techniques, only closed questions may be asked. 

The use of several models for the graphical representation of requirements is not intended in requirements engineering. 

The syntax provides the basis for the interpretation of a conceptual model. 

The syntax of a modeling language determines the meaning of the individual model elements. 

Diversity

Inconsistency

When using natural language, misunderstandings can be avoided. 

Clarity

Use Case Diagrams provide a complete description of use cases and therefore do not require use case specifications.

Testing from different points of view has not proven to be successful in practice, as viewing from different angles only leads to additional requirements. 

The construction of development artifacts is not necessary, as this does not create the desired added value. 

The results of the test must be documented by the inspector only in the event of starting or errors. 

It is not necessary to introduce users to the use of the prototype, since all prototypes are always self-explanatory. 

The Kano model cannot be used to prioritize requirements. 

The Wiegers prioritization matrix is a representative of the ad-hoc prioritization procedures and is supplemented with the top ten technology. 

Political position of the requester within the company

IT system environment

Programming language

The strict compliance with project plans.

It has to be potentially releasable, but not necessarily documented yet.

The Scrum Master has the sole decision power over the product requirements.

The Product Backlog exclusively holds requirements of a sprint

The Scrum Master assembles the team and has personnel responsibility for the team members.

Which work results are accepted in the Sprint Review.

According to Tuckman, the "Forming" phase is directly followed by the "Performing" phase.

Splitting stories is not part of the refinement and should not claim capacity of the developers

That requirements with a high risk and little added value should be implemented first.

That the most important requirements are not implemented first.

After the Product Backlog has been initially filled, one should summarise the fundamental product aspects and characteristics in a concept.

A product goal is only used in large and distributed projects.

A task can be completed within one sprint.

The release consists of at least one sprint.

The development speed is independent of the amount of  developers.

Planning Poker is a method to bring about team decisions.

The Fibonacci sequence is a possible number sequence for Planning Poker.

Only 2 and 4.

Only 1 and 2.

Every sprint generates ist own and independent product increment.

The meeting takes place at the end of the Sprint and lasts for a maximum of 2 hours.

It is the result of the Sprint Planning.

It contains the requirements and tasks to which the team has committed itself.

What am I planning to work on before the next Daily?

Are there any impediments that may block my activities?

Only the Scrum Masters participate in the Scrum of Scrums.

Scrum of Scrums will only take place on a size of at least 5 Scrum teams.

Only 2 and 3.

Only 1 and 2.

A sprint lasts on average 2-4 days.

A Scrum team should have more than 20 developers

Detailed questions about requirements are clarified in Scrum by the developers directly with customers without the involvement of the product owner

It is of advantage, if the Scrum Master holds personnel responsibilities for the team members.

In order to prevent rivalry amongst the team, the Scrum Master should be appointed by the management.

The ideal curve in the development speed area is the typical sawtooth (zigzag) curve.

The Velocity Chart shows the development speed of the next sprint.

The Scrum Team

The development team and the Product Owner

Product Owner

Development Team