This practice is a fundamental component of physical security controls mandated by ISO/IEC 27001. The standard requires organizations to implement controls to protect secure areas and ensure only authorized personnel are allowed access. Verifying identification badges is a direct method of confirming authorization. Checking bags is a preventative measure to stop unauthorized assets (e.g., unapproved laptops, recording devices) from entering or leaving a secure facility, thereby protecting information assets from compromise, theft, or damage. These procedures are typically defined in an organization's physical access control policy, which employees and visitors must adhere to as a condition of entry.

B. False: This is incorrect. Not allowing security to perform these checks would render physical entry controls ineffective, creating a significant vulnerability and failing to comply with the principles of securing physical areas as required by ISO/IEC 27001.

1. International Organization for Standardization (ISO). (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Reference: Annex A, Control A.7.2 (Physical entry). This control's objective is "to ensure that only authorized individuals are allowed to physically access the organization’s premises," which is achieved through procedures like ID verification.

2. International Organization for Standardization (ISO). (2022). ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Guidance on the application of ISO/IEC 27001.

Reference: Section 7.2 (Physical entry). This section provides implementation guidance, suggesting controls such as "an appropriate form of identification for each individual" and "challenging individuals who are not known or who are not wearing visible identification." Bag checks are a logical extension of controlling the physical perimeter.

3. Whitman, M. E., & Mattord, H. J. (2019). Management of Information Security (6th ed.). Cengage Learning.

Reference: Chapter 8, "Physical Security," Section on "Physical Access Controls." This university-level textbook describes the role of security guards in enforcing physical access controls, which includes verifying credentials (ID badges) and inspecting packages and bags to prevent unauthorized items from entering or leaving the premises.

CMM stands for Capability Maturity Model. It is a developmental model created by the Software Engineering Institute (SEI) at Carnegie Mellon University. It was originally designed to assess and improve the software development processes of government contractors. The model describes a five-level evolutionary path of increasingly organized and systematically mature processes. Organizations can use the CMM to evaluate their process maturity and identify areas for improvement, moving from ad-hoc, chaotic processes to mature, disciplined ones.

A. Capability Maturity Matrix: The framework is a "Model" that describes levels and key process areas, not simply a "Matrix" for plotting data points.

B. Capacity Maturity Matrix: The model assesses an organization's "Capability" (its ability to perform processes effectively), not its "Capacity" (the volume of work it can handle).

D. Capable Mature Model: This is an incorrect and grammatically awkward phrasing. The model's name describes the maturity of an organization's capabilities.

1. Paulk, M. C., Curtis, B., Chrissis, M. B., & Weber, C. V. (1993). Capability Maturity Model for Software, Version 1.1 (Technical Report CMU/SEI-93-TR-024). Software Engineering Institute, Carnegie Mellon University. The title and abstract explicitly define CMM as Capability Maturity Model.

2. MIT OpenCourseWare. (2005). 16.355J Software Engineering Concepts, Lecture 20: Process Improvement. Massachusetts Institute of Technology. Slide 4, "Process Maturity," introduces and defines the "Capability Maturity Model (CMM)."

3. Humphrey, W. S. (1988). Characterizing the software process: A maturity framework. IEEE Software, 5(2), 73-84. This foundational article introduces the concept of a process maturity framework, which evolved into the Capability Maturity Model. (DOI: https://doi.org/10.1109/52.2014)

The fundamental reason for information classification, as outlined in information security management frameworks like ISO/IEC 27001, is to structure and categorize information assets based on their level of sensitivity, criticality, and value to the organization. This systematic approach ensures that security controls are applied in proportion to the identified risks. By understanding the sensitivity of information, an organization can implement appropriate handling procedures, access controls, and protection measures, thereby optimizing security resources and effectively mitigating risks of unauthorized disclosure, alteration, or destruction.

A: Providing clear identification tags is a mechanism or an outcome of the classification process (e.g., labeling a document "Confidential"), not the primary reason for undertaking the classification itself.

C: Creating a BYOD policy is a specific administrative control where classification principles would be applied to data accessed by devices, but it is not the foundational reason for the entire practice.

1. ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security controls, Section 5.12 Classification of information: The guidance for this control states that classification should consider "the information's sensitivity to unauthorized disclosure or modification." It further explains that the classification scheme helps ensure that information assets receive an appropriate level of protection. This directly supports that structuring by sensitivity is the core reason.

2. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House. In Chapter 10, which discusses Annex A controls, the rationale for A.8.2.1 (Classification of information in the 2013 version, now 5.12 in 2022) is explained as ensuring that information receives an appropriate level of protection based on its importance to the organization.

3. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page. In Chapter 12, "Information classification and handling," the text clarifies that the purpose of classification is to "define an appropriate set of protection levels for information" and to communicate the need for special handling measures based on sensitivity.

Under ISO 27002 clause 5.12 an organisation labels information according to its value and audience. “Internal” (sometimes “Internal Use Only”) is applied to data meant for distribution to all employees but not outside the organisation. A CEO’s e-mail setting out company status, vision and strategy is intended for the workforce and contains no highly sensitive trade-secret detail that must be limited to a subset of staff. Therefore the appropriate classification is “Internal Mail”.

B. Public Mail – For information intended for external/public release; the message is not authorised for outside audiences.

C. Confidential Mail – Used when access must be limited to specific groups; this message is addressed to the entire staff.

D. Restricted Mail – Highest sensitivity (trade secrets, regulated data); content here is not that critical nor restricted to select personnel.

1. ISO/IEC 27002:2022, clause 5.12 “Information classification” – defines assigning labels such as Internal to material for general staff use.

2. University of Cambridge Information Classification Policy v3.1 (2023) §3, Table 1: “Internal – Internal announcements, newsletters, staff communications”.

3. MIT Information Protection & Handling Standard (MIT IS&T, 2022) §2.3: “Internal Use Only – organisational communications for all employees; not public”.

The best practice for the acceptable use of information assets is to ensure they are used for their intended business purpose. An Acceptable Use Policy (AUP), a key component of an Information Security Management System (ISMS) under ISO 27001, establishes rules to protect assets from misuse. Limiting the use of information and communication systems to business purposes minimizes risks such as malware infections from non-business websites, legal liability from inappropriate content, and loss of productivity. While some organizations may permit limited personal use, the foundational principle and most secure posture is that company assets are provided for business use only.

B. Interfering with or denying service to any user is a malicious act, a direct violation of any AUP, and often illegal. It is the opposite of acceptable use.

C. Playing computer games during office hours is a misuse of company time and resources and is typically explicitly forbidden in an AUP.

D. This statement is ambiguous but implies unauthorized access to network transmissions (e.g., sniffing), which is a serious security breach and a prohibited activity.

1. ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security controls, Section 5.10 - Acceptable use of information and other associated assets. The implementation guidance for this control states that rules for acceptable use should be defined. A primary rule is to specify the authorized business purposes for which assets can be used, thereby restricting non-business activities that introduce risk.

2. von Solms, R., & von Solms, B. (2018). Cybersecurity and Information Security: What Everyone Needs to Know. Oxford University Press. In discussions on information security policies (Chapter 4), the authors emphasize that an AUP's core function is to "define what users are allowed and not allowed to do with the organization's IT assets," with the primary allowed function being job-related tasks.

3. Massachusetts Institute of Technology (MIT). (2023). Policy on the Use of MIT Information Technology Resources (Policy 13.2). This university policy, reflecting best practices, states: "The primary purpose of MIT's IT resources is to enhance and support the educational mission of the Institute... Uses that are inconsistent with this purpose are not permitted." This aligns directly with the principle of restricting use to the organization's primary (business) purpose.

Social engineering is a term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information. The attacker creates a situation or pretext, such as impersonating a trusted entity, to deceive a victim into divulging confidential data like credentials or financial information. This method exploits human trust and error rather than technical system vulnerabilities. Within an ISO 27001 framework, controls like information security awareness, education, and training (A.6.3) are implemented specifically to mitigate the risks posed by social engineering attacks.

A. This describes literal event planning within a company and is unrelated to the information security concept of manipulation for information gain.

C. This refers to corporate social responsibility (CSR), which involves community outreach and has no connection to security threats or deception.

1. Krombholz, K., Hobel, H., Huber, M., & Weippl, E. (2015). Advanced social engineering attacks. Journal of Information Security and Applications, 22, 113-122. In Section 1, Paragraph 1, the paper defines social engineering as attacks that "directly target the human user in order to retrieve sensitive information." DOI: https://doi.org/10.1016/j.jisa.2014.09.005

2. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Lecture 19: Web Security. Massachusetts Institute of Technology. The lecture notes define social engineering as an attack that "tricks a legitimate user into misusing their authority," which aligns with gaining confidential information through deception.

3. Mouton, F., Leenen, L., & Venter, H. S. (2016). Social Engineering Attack Detection Model: A Literature Review. In Information Security South Africa (ISSA), 2016 (pp. 1-8). IEEE. The paper's introduction (Section I) states, "Social engineering is the art of manipulating people into performing actions or divulging confidential information." DOI: https://doi.org/10.1109/ISSA.2016.7802920

Sharing passwords or access credentials is a critical violation of fundamental information security principles, as it breaks the chain of individual accountability and can lead to unauthorized access and significant data breaches. According to information security management frameworks like ISO/IEC 27001, organizations must establish a formal disciplinary process for security policy violations. While sanctions can vary, the "worst possible action" for a severe breach, such as intentional password sharing that leads to compromise, is termination of employment. This ultimate sanction serves as a powerful deterrent and underscores the seriousness with which the organization treats its information security obligations.

A. Being removed from a project is a serious consequence but is less severe than losing one's employment entirely.

B. A low performance rating is a negative administrative action but does not carry the immediate impact of suspension or termination.

C. Suspension is a temporary punitive measure, whereas termination is a permanent and final action, making it a more severe outcome.

1. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Reference: Control 6.3 (Disciplinary process).

Details: This control states, "A disciplinary process should be defined and communicated to take actions against persons and other relevant interested parties who have committed an information security policy violation." The implementation guidance notes that the process should be graduated, allowing for actions up to and including termination for severe violations.

2. Herath, T., & Rao, H. R. (2009). Protection motivation and deterrence: a framework for security policy compliance in organisations. European Journal of Information Systems, 18(2), 106–125.

Reference: Page 110, Section on "Sanction Severity".

Details: This peer-reviewed article discusses how the perceived severity of sanctions influences policy compliance. It implicitly supports that severe sanctions, such as job termination, are a component of an organization's deterrence strategy for security violations.

DOI: https://doi.org/10.1057/ejis.2009.6

3. Stanford University. (n.d.). Information Security Policy (Admin Guide Memo 6.2.1).

Reference: Section 4, "Policy Violations".

Details: As an example of reputable university documentation, this policy states: "Violations of information security policies may result in a temporary or permanent revocation of access privileges, and/or other disciplinary action up to and including termination of employment or relationship with the University." This confirms termination as a possible sanction for policy violations.

ISO/IEC 27002 is an international standard that provides a code of practice for information security. It offers a comprehensive set of guidelines and best practices for initiating, implementing, maintaining, and improving information security management in an organization. It is designed to be used in conjunction with ISO/IEC 27001, which specifies the requirements for an Information Security Management System (ISMS). The previous version, ISO/IEC 27002:2013, was explicitly titled "Code of practice for information security controls," clearly defining its purpose as a set of recommended practices rather than a auditable set of requirements.

B. A personal data protection act is legislation focused on the privacy and rights of individuals concerning their data, not a general information security code of practice.

C. A computer criminality act is a legal framework that defines cybercrimes and associated penalties, not a set of organizational best practices for security.

D. IT Service Management (e.g., ITIL) is a discipline for managing IT services to meet business needs, which is distinct from a specific code of practice for information security.

1. International Organization for Standardization (ISO). (2022). ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls. Geneva, Switzerland: ISO.

Reference: The introduction and scope sections of the standard describe it as a reference set of generic information security controls and implementation guidance. The historical title of the standard (ISO/IEC 27002:2013) was "Code of practice for information security controls," which directly answers the question.

2. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page.

Reference: Chapter 10, "ISO 27001 and ISO 27002," explicitly states, "ISO 27002 is a code of practice – a generic, advisory document, not a formal specification against which organizations can be certified" (p. 135).

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Reference: Chapter 2, "The ISO 27001 family of standards," describes ISO/IEC 27002 as the "code of practice for information security controls, providing guidance on the implementation of the controls listed in Annex A" (p. 12).

4. University of Alabama in Huntsville. (n.d.). UAH Information Security Management Program (ISMP) based on ISO 27002.

Reference: The program documentation states, "The University of Alabama in Huntsville (UAH) Information Security Management Program (ISMP) is based on the International Organization for Standardization (ISO) 27002, a code of practice for information security." This demonstrates its use as a foundational code of practice in an academic institutional setting.

An Access Control List (ACL) is the direct reference for determining who has access to a specific data object or document. An ACL is a table or list of permissions attached to an object, specifying which users or groups are granted access and what operations (e.g., read, write, execute) are allowed. It explicitly defines the "who" and "what" of access rights for a resource, directly aligning with the requirements of ISO 27001's control A.9.4.1 (Information access restriction). While other options are related to access control, the ACL is the fundamental implementation that lists the authorized entities.

A. Data Classification Label: This label indicates the data's sensitivity level (e.g., Confidential), which informs the access policy, but it does not list the specific individuals or groups who are granted access.

C. Masterlist of Project Records (MLPR): This is a records management or project management document used for inventory and tracking of documents, not for defining or enforcing granular user access rights.

D. Information Rights Management (IRM): IRM is a technology that enforces access policies on data (e.g., preventing printing/forwarding). The policy it enforces is typically defined by an underlying mechanism like an ACL.

1. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278–1308. (A foundational academic paper in computer security). In Section I.A.3, it defines an access control list as a list for each object "which enumerates all the subjects that have access to it and the kinds of access they have." This directly supports the ACL as the reference for "who" has access.

DOI: https://doi.org/10.1109/PROC.1975.9939

2. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2014). 6.858 Computer Systems Security, Lecture 2: Control Hijacking. In the section on "Access control," an ACL is defined as: "For each object, keep a list of subjects and their permissions." This university courseware explicitly identifies the ACL as the list defining subject (who) access to objects (data/document).

Source: MIT OCW, 6.858 Computer Systems Security, Fall 2014, Lecture 2 Notes

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House. While a commercial book, its principles are widely cited in academic contexts for ISMS implementation. It explains that control A.9.4.1 is implemented by defining and applying rules, which in technical systems are commonly realized through Access Control Lists (ACLs) that associate users with permissions on information assets.

An information security attack or incident is an event that adversely affects the confidentiality, integrity, or availability of an organization's information assets. Legal incidents (e.g., non-compliance with data protection laws), privacy incidents (e.g., data breaches), and the exploitation of technical vulnerabilities are all recognized categories of events within the information security domain. A vehicular incident, such as a car accident, is fundamentally a physical safety event. While such an event could have secondary consequences for information security (e.g., a laptop containing sensitive data is destroyed), the incident itself is not classified as a type of information security attack.

A. Legal Incidents: These are directly related to information security, as they can involve non-compliance with regulations (like GDPR) or intellectual property theft, which are security events.

C. Technical Vulnerabilities: The exploitation of technical vulnerabilities is a primary vector for information security attacks and is a core concept in the field.

D. Privacy Incidents: These are a critical subset of information security incidents, specifically dealing with the compromise of personally identifiable information (PII).

---

1. ISO/IEC 27000:2018 - Information technology — Security techniques — Information security management systems — Overview and vocabulary.

Section 3.33: Defines an "information security incident" as "a single or a series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security." This definition encompasses legal, privacy, and technical vulnerability-related events but does not include categories like vehicular incidents.

2. NIST Special Publication 800-61 Rev. 2, "Computer Security Incident Handling Guide."

Section 2.3.1, Incident Categorization: This guide provides a baseline set of incident categories, including Unauthorized Access, Denial of Service, Malicious Code, and Improper Usage. These categories align with the concepts of technical, legal, and privacy incidents but do not include physical events like vehicular incidents as a primary category of computer security incidents.

3. Blakley, B., & McDermott, E. (2016). The Official (ISC)2 Guide to the CISSP CBK. CRC Press.

Chapter 19, Managing Security Operations: This chapter details security operations and incident management. It classifies incidents into categories such as network intrusions, malware infections, and policy violations. The taxonomy is focused on threats to information systems, not general physical risks like vehicle accidents.