You are a certification body auditor, conducting a surveillance audit to ISO/IEC 27001:2022 of a data center operated by a client who provides hosting services for ICT facilities.You and your guide are currently in one of the private suites that the client rents out to customers. Access to each suite is controlled using a combination lock. CCTV is also installed in every suite.Within each suite are three data cabinets in which the client can locate mission-critical servers and other items of networking equipment such as switches and routers.You notice that whilst two of the cabinets in your suite are locked, the third is unlocked. You ask the guide why. They reply "This is because the client is currently swapping out a hard drive unit. Their technician is currently on a lunch break".What three actions should you undertake next? (Choose three.)
Answer(s): E,F,H
Raise an opportunity for improvement suggesting cabinet doors are locked whenever clients leave their suites, even if they intend to return within a short time. This is an opportunity to enhance the security of the data center. Even though the technician might have plans to return soon, leaving a cabinet unlocked is a potential security risk. Recommending that the cabinet doors be locked whenever clients leave the suite, even temporarily, improves security protocols.Review the CCTV records to ensure that only the client has accessed the cabinet since it was last confirmed as locked. It is important to verify that the cabinet was accessed only by authorized individuals and that there was no unauthorized access. Reviewing the CCTV records will provide an audit trail of who accessed the cabinet and ensure that security procedures were followed.With the permission of the guide, speak to the customer to confirm that they are in the process of swapping out a drive. Confirming directly with the customer that they are in the process of swapping out a drive ensures that there is no misunderstanding about the reason for the unlocked cabinet. This is an important step to verify that the situation is legitimate and no security incidents have occurred.
You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify the information security of the business continuity management process. During the audit, you learned that the organization activated one of the business continuity plans (BCPs) to make sure the nursing service continued during the recent pandemic. You ask the Service Manager to explain how the organization manages information security during the business continuity management process.The Service Manager presents the nursing service continuity plan for a pandemic and summarizes the process as follows:Stop the admission of any NEW residents.70% of administration staff and 30% of medical staff will work from home.Regular staff self-testing, including submitting a negative test report 1 day BEFORE they come to the office.Install ABC's healthcare mobile app, tracking their footprint and presenting a GREEN Health Status QR-Code for checking on the spot.You ask the Service Manager how to prevent non-relevant family members or interested parties from accessing residents' personal data when staff work from home. The Service Manager cannot answer and suggests the IT Security Manager should help with that.You would like to further investigate other areas to collect more audit evidence. Select three options that will be in your audit trail. (Choose three.)
Answer(s): A,D,F
Collect more evidence by interviewing more staff to ensure they have the necessary awareness to work from home. (Relevant to clause 7.3) This option is relevant because it addresses staff awareness and competence, which is crucial for ensuring that staff working from home understand the information security requirements of their roles. Clause 7.3 focuses on ensuring that personnel have the necessary competence, which would include their understanding of information security practices when teleworking.Collect more evidence on how and when the Business Continuity Plan has been tested. (Relevant to control A.5.29) This option is important as it investigates how the organization tests its business continuity plans, specifically related to information security. Control A.5.29 deals with ensuring that business continuity plans are regularly tested to ensure they remain effective, which is essential to manage risks and ensure continuity during disruptions like a pandemic.Collect more evidence on how the organization manages information security on mobile devices and during teleworking (Relevant to control A.6.7) This option is directly related to the security measures the organization implements for staff working remotely. Control A.6.7 focuses on ensuring the security of mobile devices and teleworking practices, which is highly relevant when staff members are working from home, especially in the context of protecting sensitive personal data.
You are performing an ISMS audit at a residential nursing home that provides healthcare services and are reviewing the Software Code Management (SCM) system. You found a total of 10 user accounts on the SCM. You confirm that one of the users, Scott, resigned 9-months ago. The SCM System Administrator confirmed Scott's last check out of the source code was found 1 month ago. He was using one of the authorized desktops from the local network in a secure area.You check with the user de-registration procedure which states "Managers have to make sure of deregistration of the user account and authorization immediately from the relevant ICT system and/or equipment after resignation approval." There was no deregistration record for user Scott.The IT Security Manager explains that Scott still comes back to the office every month after he resigned to provide support on source code maintenance. That's why his account on SCM still exists.You would like to investigate other areas further to collect more audit evidence. Select three options that would not be valid audit trails. (Choose three.)
Answer(s): B,C,G
Collect more evidence on how the transition of Scott from full-time to part-time employment was managed (Relevant to control A.6.5) This option is not directly related to the issue of Scott's user account remaining active after his resignation. While the transition from full-time to part-time employment may be relevant to some human resources processes, it does not pertain to the information security concern of user account management after resignation.Collect more evidence from Scott's background verification checks performed by the human resource department under the new employment relationship. (Relevant to control A.6.1) This option is not directly related to the audit focus. The concern here is about the failure to remove Scott’s user account after resignation, not about his background checks when transitioning to a new employment status. The background checks were likely conducted at the time of hiring or re-engagement, which is outside the scope of this issue.Collect more evidence on how the organization pays for Scott's source code maintenance support service. (Relevant to control A.6.2) While payment for services is an important organizational issue, it is not directly related to the information security concern of Scott's account remaining active and not being deactivated. The focus of the audit should remain on the access controls and user account management processes, not on financial or contractual aspects of his post-resignation work.
You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify that the Statement of Applicability (SoA) contains the necessary controls. You review the latest SoA (version 5) document, sampling the access control to the source code (A.8.4), and want to know how the organization secures ABC's healthcare mobile app source code received from an outsourced software developer.The IT Security Manager explains the received source code will be checked into the SCM system to make sure of its integrity and security. Only authorized users will be able to check out the software to update it. Both check-in and check-out activities will be logged by the system automatically. The version control is managed by the system automatically.You found a total of 10 user accounts on the SCM. All of them are from the IT department. You further check with the Human Resource manager and confirm that one of the users, Scott, resigned 9 months ago. The SCM System Administrator confirmed Scott's last check-out of the source code was found 1 month ago. He was using one of the authorized desktops from the local network in a secure area.You check the user de-registration procedure which states "Managers have to make sure of deregistration of the user account and authorization immediately from the relevant ICT system and/or equipment after resignation approval." There was no deregistration record for user Scott.The IT Security Manager explains that Scott is a very good software engineer, an ex-colleague, and a friend. He still comes back to the office every month after he resigned to provide support on source code maintenance.That's why his account on SCM still exists. "We know Scott well and he passed all our background checks when he joined us. As such we didn't feel it necessary to agree any further information security requirements with him just because he is now an external provider".You prepare the audit findings. Select the three correct options. (Choose three.)
Answer(s): A,B,C
There is a nonconformity (NC). Scott should have been advised of applicable information security requirements relevant to his new relationship (external provider) with the nursing home. The IT security manager has however confirmed that this did not take place. This does not conform with control A.5.20. As Scott has transitioned from being an employee to an external service provider, it is critical that he is made aware of any updated information security requirements related to his new role. Control A.5.20 requires that information security policies and procedures be communicated to relevant parties, including external providers. Since this did not occur, it constitutes a nonconformity.There is a nonconformity (NC). The organization's access control arrangements are not operating effectively as an individual who is no longer employed by the organization is being permitted to access the nursing home's ICT systems. This does not conform with control A.5.15. Control A.5.15 requires that access to ICT systems is appropriately restricted, especially to individuals who no longer work for the organization. Since Scott's account was not deactivated after his resignation, this constitutes a failure in the access control arrangements.There is a nonconformity (NC). The IT Security manager did not make sure the user account for Scott was removed from the SCM and did not complete the user deregistration process after the resignation. This does not conform with clause 9.1 and control A.5.15. Clause 9.1 and control A.5.15 require that user accounts be deregistered promptly after an employee resigns. The failure to do so for Scott means the organization did not meet these requirements, leading to a nonconformity.
You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. The next step in your audit plan is to verity the information security of ABC's healthcare mobile app development, support, and lifecycle process. During the audit, you learned the organization outsourced the mobile app development to a professional software development organization with CMMI Level 5, ITSM (ISO/ IEC 20000-1), BCMS (ISO 22301) and ISMS (ISO/IEC 27001) certified.The IT Manager presents the software security management procedure and summarizes the process as follows: The mobile app development shall adopt "security-by-design" and "security-by-default" principles, as a minimum. The following security functions for personal data protection shall be available: Access control. Personal data encryption, i.e., Advanced Encryption Standard (AES) algorithm, key lengths: 256 bits; and Personal data pseudonymization. Vulnerability checked and no security backdoor You sample the latest Mobile App Test report - Reference ID: 0098, details as follows:You would like to investigate other areas further to collect more audit evidence. Select three options that will not be in your audit trail. (Choose three.)
Answer(s): A,C,G
Collect more evidence by downloading and testing the mobile app on your phone. Auditors do not perform functional or usability testing of the mobile app themselves. This falls outside the scope of auditing and is not aligned with auditing principles.Collect more evidence on how much residents' family members pay to install ABC's healthcare mobile app. The cost associated with using the mobile app is unrelated to information security management and is not relevant to the ISMS audit.Collect more evidence on the organization's business continuity policy. (Relevant to control A.5.30) While business continuity is a critical area, it does not directly align with the specific issue of mobile app security or its lifecycle management in this context.
Post your Comments and Discuss PECB ISO-IEC-27001-Lead-Auditor exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the ISO-IEC-27001-Lead-Auditor content, but please register or login to continue.