You are an experienced ISMS audit team leader guiding an auditor in training. You are testing her understanding of follow-up audits by asking her a series of questions to which the answer is either 'true' or 'false'.Which two of the following questions should the answer be 'true'? (Choose two.)
Answer(s): C,D
A follow-up audit may be carried out where nonconformities are major A follow-up audit is often necessary when major nonconformities are identified to verify that corrective actions have been implemented effectively.The outcome of a follow-up audit could change an original major nonconformity into a minor nonconformity If corrective actions taken to address a major nonconformity are effective, the nonconformity could be downgraded to a minor one after the follow-up audit.
Select the option which best describes how Information Security Management System audits should be conducted:
Answer(s): D
Audit methods such as interviews, document reviews, and observation are used to gather and assess objective evidence. Audit findings are then generated based on the objective evidence collected. The audit conclusion summarizes the results of the audit and is presented to the auditee at the closing meeting.
You are performing an Information Security Management System (ISMS) audit at a European-based residential nursing home called ABC that provides healthcare services. The next step in your audit plan is to verify the effectiveness of the continual improvement process.During the audit, you learned most of the residents' family members (90%) receive WeCare medical device promotion advertisements through email and SMS once a week via ABC's healthcare mobile app. All of them do not agree on the use of the collected personal data for marketing or any other purposes than nursing and medical care on the signed service agreement with ABC. They have very strong reason to believe that ABC is leaking residents' and family members' personal information to a non-relevant third party and they have filed complaints.The Service Manager says that, after investigation, all these complaints have been treated as nonconformities. The corrective actions have been planned and implemented according to the nonconformity and corrective management procedure (Document reference ID: ISMS_L2_10.1, version 1).You write a non-conformity which you will follow up on later. Select the best sentence for the non-conformity:
Answer(s): F
In the context of an audit, the effectiveness of corrective actions taken in response to a nonconformity is evaluated by looking for evidence that the actions will address the root cause and prevent the recurrence of the issue.This sentence aligns with the principle of evaluating corrective actions by focusing on the prevention of the recurrence of the nonconformity, which is critical in assessing the effectiveness of the actions taken.
You are the audit team leader conducting a third-party audit of an online insurance organization. During Stage 1, you found that the organization took a very cautious risk approach and included all the information security controls in ISO/IEC 27001:2022 Appendix A in their Statement of Applicability.During the Stage 2 audit, your audit team found that there was no evidence of the implementation of the three controls (5.3 Segregation of duties, 6.1 Screening, 7.12 Cabling security) shown in the extract from the Statement of Applicability. No risk treatment plan was found.Select three options for the actions you would expect the auditee to take in response to a nonconformity against clause 6.1.3.e of ISO/IEC 27001:2022. (Choose three.)
Answer(s): C,F,G
Implement the appropriate risk treatment for each of the applicable controls. Clause 6.1.3.e requires organizations to implement the controls they have identified as necessary to treat risks. Since these controls are listed in the Statement of Applicability as applicable, the organization must implement them.Revise the relevant content in the Statement of Applicability to justify their exclusion. If the organization decides not to implement certain controls, the Statement of Applicability must justify their exclusion, ensuring alignment with the risk assessment and treatment plan.Revisit the risk assessment process relating to the three controls. Revisiting the risk assessment process ensures that the inclusion or exclusion of controls is based on a thorough evaluation of risks, legal requirements, and customer needs, ensuring compliance with the standard.
You are performing an ISO 27001 ISMS surveillance audit at a residential nursing home, ABC Healthcare Services. ABC uses a healthcare mobile app designed and maintained by a supplier, WeCare, to monitor residents' well-being. During the audit, you learn that 90% of the residents' family members regularly receive medical device advertisements from WeCare, by email and SMS once a week. The service agreement between ABC and WeCare prohibits the supplier from using residents' personal data. ABC has received many complaints from residents and their family members.The Service Manager says that the complaints were investigated as an information security incident which found that they were justified. Corrective actions have been planned and implemented according to the nonconformity and corrective action management procedure.You write a nonconformity "ABC failed to comply with information security control A.5.34 (Privacy and protection of PII) relating to the personal data of residents' and their family members. A supplier, WeCare, used residents' personal information to send advertisements to family members."Select three options of the corrections and corrective actions listed that you would expect ABC to make in response to the nonconformity. (Choose three.)
Answer(s): C,F,H
ABC confirms that information security control A.5.34 is contained in the Statement of Applicability (SoA). Ensuring that privacy and protection of PII are included in the SoA aligns with the organization's ISMS framework and confirms that relevant controls are being implemented.ABC periodically monitors compliance with all applicable legislation and contractual requirements involving third parties. Regular monitoring ensures that third-party suppliers like WeCare adhere to contractual obligations and legal requirements, preventing future incidents.ABC trains all staff on the importance of maintaining information security protocols. Educating staff about information security and personal data protection protocols helps prevent similar issues by raising awareness and reinforcing best practices.
Post your Comments and Discuss PECB ISO-IEC-27001-Lead-Auditor exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the ISO-IEC-27001-Lead-Auditor content, but please register or login to continue.