(True or false) ISO 27002 can be used to certify an enterprise's information securitysystem.A. TrueB. False

Understanding the Question

The statement asked is whether ISO 27002 can be used to certify an enterprise's information security system.

Relevant Concepts

1. ISO 27001 and ISO 27002:
   • ISO 27001 is the specification for an information security management system (ISMS), and it is the standard against which companies can be certified.
   • ISO 27002, on the other hand, is a code of practice that provides guidelines for organizational information security standards, offering best practices for implementing information security controls but does not itself provide a certification.

Analysis

• ISO 27001: Companies looking to get certified in information security need to comply with ISO 27001.
• ISO 27002: While it supports the implementation of an ISMS per ISO 27001, it does not offer certification on its own.

Conclusion

Based on the distinction between the two standards:

Final Answer: B. False. ISO 27002 does not provide certification for an enterprise's information security system.