🔐 Master ISO 27001 — Everything You Need for the CPPG Exam, All in One Go!

Information security now speaks the international standard. If you don’t know what ISO 27001 is, you won’t pass the CPPG.

🎯 What this article covers

What ISO 27001 is and why it was created
ISMS structure based on the PDCA cycle
Key changes in the 2022 revision (114 items → 93 items)
Full summary of Annex A’s 4 control themes
Comprehensive review of frequently tested CPPG points

📌 Introduction — Why ISO 27001?

Any information security professional has probably heard the name, ISO/IEC 27001. But when asked, “What is ISO 27001?”, many struggle to give a clear answer.

ISO 27001 is an international standard that defines the requirements for establishing and operating an Information Security Management System (ISMS). Simply put, it’s a means for companies to demonstrate, in a globally recognized way, that “we systematically manage information security like this.”

In Korea, KISA’s ISMS(-P) certification is mandatory for legally obligated companies, but ISO 27001 is a voluntary international certification. Companies engaged in global business often require ISO 27001 certification as a condition of trade.

🔑 The CPPG exam focuses on the concepts, structure, and classification system of ISO 27001 control items.

🔍 Comprehensive Review of ISO 27001 Basic Concepts

📋 Full Name and Publication History


Category	Content
Official Name	ISO/IEC 27001 Information Security Management Systems – Requirements
Issuing Body	ISO (International Organization for Standardization) + IEC (International Electrotechnical Commission)
First Published	2005
1st Revision	2013 (ISO/IEC 27001:2013)
2nd Revision	October 25, 2022 (ISO/IEC 27001:2022)

🎯 CIA Triad — Core Objectives of ISO 27001

These are the three attributes of information that ISO 27001 aims to protect. This is a frequently tested item on the CPPG exam.


Attribute	English	Meaning
Confidentiality	Confidentiality	Only authorized persons can access information
Integrity	Integrity	Information is not altered without authorization
Availability	Availability	Authorized persons can access when needed

These three initial letters are called the CIA Triad.

🔄 PDCA Cycle — The Backbone of ISMS

ISO 27001 follows a continuous improvement model based on the PDCA (Plan-Do-Check-Act) cycle. This structure is linked to the HLS (High Level Structure) framework, which is common across all ISO management system standards.

Plan(계획)  →  Do(실행)  →  Check(점검)  →  Act(개선)
    ↑                                              ↓
    └──────────────── 지속적 개선 ─────────────────┘


Phase	Relevant Clauses	Key Activities
Plan	Clauses 4-6	Understanding organizational context, leadership, risk assessment and treatment planning
Do	Clauses 7-8	Securing support resources, operational execution
Check	Clause 9	Performance evaluation, internal audit, management review
Act	Clause 10	Nonconformity handling, continual improvement

—

📐 ISO 27001:2022 Structure — A Full Dissection of 10 Clauses

ISO 27001 consists of Clauses 1-3 (Scope, Normative references, Terms and definitions) and Clauses 4-10 (Requirements body). Clauses 4-10 are particularly important for the CPPG exam.

📌 Clause 4 — Context of the Organization

This is the stage where an organization first understands its own context before establishing an ISMS.

4.1 Understanding the organization and its context — Identifying internal/external issues
4.2 Understanding the needs and expectations of interested parties (2022 Revision: 4.2 c) newly added — additional stakeholder requirements handled through ISMS)
4.3 Determining the scope of the ISMS
4.4 Establishing and operating the ISMS (2022 Revision: explicitly includes processes and their interactions)

📌 Clause 5 — Leadership

5.1 Leadership and commitment — Role of top management
5.2 Establishing the Information Security Policy
5.3 Organizational roles, responsibilities and authorities — (2022 Revision: explicitly states assignment within the organization)

💡 Exam Point: Top management must directly establish and approve the information security policy and document it.

📌 Clause 6 — Planning

6.1 Actions to address risks and opportunities
6.1.2 Information security risk assessment
6.1.3 Information security risk treatment + Preparation of Statement of Applicability (SoA)
6.2 Information security objectives
6.3 Planning of changes (2022 New — managing changes in a planned manner)

💡 Exam Point: SoA (Statement of Applicability) is a key document that records the applicability/non-applicability of each of the 93 control items in Annex A and the rationale behind it. It must be remembered.

📌 Clause 7 — Support

7.1 Resources
7.2 Competence
7.3 Awareness
7.4 Communication (2022 Revision: d, e merged into d) Communication methods)
7.5 Documented information

📌 Clause 8 — Operation

8.1 Operational planning and control (2022 Revision: explicitly defines process criteria)
8.2 Performing information security risk assessment
8.3 Performing information security risk treatment

📌 Clause 9 — Performance Evaluation

9.1 Monitoring, measurement, analysis and evaluation
9.2 Internal audit (2022 Revision: subdivided into 9.2.1~9.2.2)
9.3 Management review (2022 Revision: subdivided into 9.3.1~9.3.3)

📌 Clause 10 — Improvement

10.1 Continual improvement (2022 Revision: order of 10.1 and 10.2 changed)
10.2 Nonconformity and corrective action

🗂️ Annex A — Comprehensive Review of 93 Security Controls

The absolute core of ISO 27001 is Annex A.

The 2022 revision reduced the number of control items from 114 to 93. This was not merely a reduction but a restructuring to fit modern environments.

📊 2013 vs 2022 Comparison


Category	2013 Version	2022 Version
Number of Control Items	114	93
Classification System	14 Domains	4 Themes
Newly Added	–	11
Merged	–	57 → 24
Existing Maintained	–	35

🏷️ 4 Theme Classification

In the 2022 version, control items are systematically classified into 4 main themes.

🏢 Theme 1 — Organizational Controls · A.5 · 37 items

Covers overall policies, systems, and frameworks for how an organization approaches and manages information security.

Examples of key items:

A.5.1 Information security policies
A.5.2 Information security roles and responsibilities
A.5.7 Threat intelligence (2022 New)
A.5.10 Acceptable use of information and other associated assets
A.5.19 Supplier chain security
A.5.23 Information security for use of cloud services (2022 New) ⭐
A.5.24 Information security incident management planning and preparation
A.5.30 ICT readiness for business continuity (2022 New)
A.5.31 Legal, regulatory and contractual requirements
A.5.36 Compliance with information security policies, rules and standards

💡 Exam Point: A.5.23 Cloud security control is a new item in 2022 reflecting the spread of cloud, and has a high probability of being tested in both CPPG and ISMS-P.

👥 Theme 2 — People Controls · A.6 · 8 items

Covers security management throughout the employee lifecycle, from recruitment to termination.

A.6.1 Screening
A.6.2 Terms and conditions of employment
A.6.3 Information security awareness, education and training
A.6.4 Disciplinary process
A.6.5 Responsibilities after termination or change of employment
A.6.6 Confidentiality or non-disclosure agreements
A.6.7 Remote working
A.6.8 Information security event reporting (Obligation for all employees)

🏗️ Theme 3 — Physical Controls · A.7 · 14 items

Controls for protecting physical spaces and equipment.

A.7.1 Physical security perimeter
A.7.2 Physical entry controls
A.7.3 Securing offices, rooms and facilities
A.7.4 Physical security monitoring (2022 New — CCTV, etc.)
A.7.5 Protection from physical and environmental threats
A.7.6 Working in secure areas
A.7.7 Clear desk and clear screen
A.7.8 Equipment siting and protection
A.7.9 Security of off-premise assets
A.7.10 Storage media security
A.7.11 Supporting utilities
A.7.12 Cabling security
A.7.13 Equipment maintenance
A.7.14 Secure disposal or re-use of equipment

💻 Theme 4 — Technological Controls · A.8 · 34 items

Technical security controls for systems, networks, and applications.

A.8.1 User endpoint devices
A.8.2 Privileged access rights
A.8.3 Information access restriction
A.8.4 Source code access
A.8.5 Secure authentication
A.8.6 Capacity management
A.8.7 Protection against malware
A.8.8 Management of technical vulnerabilities
A.8.9 Configuration management (2022 New)
A.8.10 Information deletion (2022 New)
A.8.11 Data masking (2022 New)
A.8.12 Data leakage prevention (DLP) (2022 New)
A.8.15 Logging
A.8.16 Monitoring activities
A.8.23 Web filtering (2022 New)
A.8.28 Secure coding (2022 New)
A.8.24 Use of cryptography
A.8.32 Change management
A.8.33 Test information

🆕 11 New Controls in 2022 — Key Exam Points

The 11 new control items in the 2022 revision are particularly noteworthy for both CPPG and ISMS-P exams.


Number	Control Name	Theme
A.5.7	Threat intelligence	Organizational
A.5.23	Information security for use of cloud services	Organizational
A.5.30	ICT readiness for business continuity	Organizational
A.7.4	Physical security monitoring	Physical
A.8.9	Configuration management	Technological
A.8.10	Information deletion	Technological
A.8.11	Data masking	Technological
A.8.12	Data leakage prevention (DLP)	Technological
A.8.16	Monitoring activities	Technological
A.8.23	Web filtering	Technological
A.8.28	Secure coding	Technological

—

📋 SoA (Statement of Applicability) — A Must-Know Core Document

The SoA (Statement of Applicability) is a key deliverable for ISO 27001 certification.

For each of the 93 control items, the following are documented:

Applicability — Is this control necessary for our organization?
Basis for applicability — Why was this control selected? (e.g., risk assessment results, legal requirements)
Reason for non-applicability — If not applied, what is the reason?

⚠️ Important: It is not necessary to apply all 93 items. However, if a control is decided not to be applied, the rationale must be explicitly stated in the SoA.

🔗 Relationship between ISO 27001 and domestic ISMS(-P)


Category	ISO 27001	ISMS-P
Issuing Body	ISO/IEC (International)	KISA (Domestic)
Certification Obligation	Voluntary	Mandatory for some companies
Control Framework	Annex A (93 items)	80 controls + 22 personal information controls
Scope of Application	Worldwide	Domestic-focused
Similarity	International standard that forms the basis of ISMS(-P)

ISMS-P was designed based on ISO 27001, reflecting domestic laws (Personal Information Protection Act, Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.).

⚠️ Common Pitfalls in CPPG Exam

❌ Common Mistake 1 — Number of control items

2013 version: 14 domains, 114 controls (already outdated)
2022 version: 4 themes, 93 controls ✅

❌ Common Mistake 2 — Application method of Annex A

Not all 93 items are applied. They are selectively applied based on the organization’s risk assessment results.

❌ Common Mistake 3 — Nature of ISO 27001

ISO 27001 is a Requirements standard.
ISO 27002 is a Guidelines standard.
Certification is based on ISO 27001.

❌ Common Mistake 4 — CIA and additional attributes

Basic 3 elements: Confidentiality, Integrity, Availability
Additional attributes (defined in ISO 27000): Authenticity, Accountability, Non-repudiation, Reliability

✅ Summary — Final Checklist Before CPPG Exam

Review the key memorization points once more.

✔️ ISO 27001 is an international standard for ISMS establishment requirements
✔️ Protection objectives: CIA (Confidentiality, Integrity, Availability)
✔️ Structure: PDCA cycle + HLS 10 clauses (Clauses 4-10 are key)
✔️ 2022 Revision: Annex A 114 items → 93 items, 4 themes (Organizational 37 + People 8 + Physical 14 + Technological 34)
✔️ Pay attention to new 11 controls including Cloud, DLP, Data Masking, Secure Coding
✔️ SoA (Statement of Applicability) = prepared in 6.1.3, documents basis for applicability/non-applicability
✔️ Essential to distinguish between ISO 27001 (Requirements) vs ISO 27002 (Guidelines)

In the next step, learning the connection with ISO 27701 (Privacy Information Management System, PIMS) will be of great help not only for CPPG but also for ISMS-P certification auditor preparation. 🚀