ISO 27001 Internal Auditor Practice Test

The assertion that the Information Security Policy does not need to be overly detailed is accurate. This is because an effective Information Security Policy serves as a high-level framework that outlines an organization’s approach to managing information security risks. The policy should provide clear guidance and direction without delving into granular specifics, which can be addressed in lower-level procedures or guidelines.

A policy that is overly detailed can become unwieldy and may lead to difficulties in implementation and maintenance. Additionally, if the policy is too specific, it may quickly become obsolete as technology and organizational needs evolve. Instead, a well-crafted policy provides the principles and context necessary for guiding behavior and decision-making while allowing flexibility to adapt to changing circumstances.

In contrast, the idea that the policy should be comprehensive and very detailed is not suitable for an Information Security Policy, as this could hinder its effectiveness. While management’s expectations are important, the policy needs to cover a broader range of topics related to information security, not just management's views. Lastly, stating that a policy should not require regular updates would undermine the policy's relevance, as regular reviews and updates are crucial to reflect evolving threats, compliance requirements, and organizational changes.