Framework

ISO/IEC 27001:2022: what it anchors in a questionnaire

The certificate most suppliers hold. Annex A is quoted; the management clauses (risk assessment, internal audit) are named where a question tests them, not quoted.

The requirement lines are our statement of each clause, read against the copy we hold and cited to it.

Families anchored here

31 families, 31 clauses cited, 2 named

Family	Clause
Information security policy	5.1
Security roles and a named security lead	5.2
Risk assessment	clause 6.1.2 (named)
Independent audit and certification	5.35 · clause 9.2 (named)
Background checks	6.1
Security awareness training	6.3
Confidentiality terms and leavers	6.6
Multi-factor authentication	8.5
Password policy	5.17
Access provisioning and review	5.18
Privileged access	8.2
Encryption at rest	8.24
Encryption in transit	8.24
Data retention and secure deletion	8.10
Data location and transfers	5.31
Logging and monitoring	8.15 · 8.16
Vulnerability and patch management	8.8
Penetration testing	8.8
Malware protection and endpoints	8.7
Secure development and change	8.25
Network security and segmentation	8.20
Physical security	7.1
Incident response plan	5.24 · 5.26
Notifying the customer of an incident	5.24 · 5.25 · 5.26
Business continuity plan	5.29 · 5.30
Backup and disaster recovery	8.13
Subcontractors and subprocessors	5.19 · 5.20 · 5.21
Assessing your own suppliers	5.22
Data subject requests	5.34
Lawful basis, consent and privacy notice	5.34
Data processing agreement	5.34

Every ISO 27001 clause the register cites, with its text and evidence