Study HIGH Quality ISO-IEC-27001-Lead-Auditor Free Study Guides and Exams Tutorials [Q50-Q74]

NEW QUESTION 50
An employee caught with offense of abusing the internet, such as P2P file sharing or video/audio streaming, will not receive a warning for committing such act but will directly receive an IR.

True

False

NEW QUESTION 51
You are the audit team leader conducting a third-party audit of an online insurance company. During Stage 1, you found that the organization took a very cautious risk approach and included all the information security controls in ISO/IEC 27001:2022 Appendix A in their Statement of Applicability.
During the Stage 2 audit, your audit team found that there was no evidence of a risk treatment plan for the implementation of the three controls (5.3 Segregation of duties, 6.1 Screening, 7.12 Cabling security). You raise a nonconformity against clause 6.1.3.e of ISO 27001:2022.
At the closing meeting, the Technical Director issues an extract from an amended Statement of Applicability (as shown) and asks for the nonconformity to be withdrawn.

Select three options of the correct responses of an audit team leader to the request of the Technical Director.

Advise management that the information provided will be reviewed when the auditors have more time.

Advise the Technical Director that his request will be included in the audit report.

Advise the Technical Director that once a nonconformity is raised it cannot be withdrawn.

Advise the Technical Director that the nonconformity must stand since the evidence obtained for it was clear.

Ask the auditor who raised the issue for their opinion on how you should respond to the request.

Inform the Technical Director that the nonconformity will be changed to an Opportunity for Improvement.

Review the documentation produced and withdraw the nonconformity.

State that a follow up audit will be necessary to review the evidence for the updated Statement of Applicability.

Explanation
The three options of the correct responses of an audit team leader to the request of the Technical Director are:
B: Advise the Technical Director that his request will be included in the audit report.
D: Advise the Technical Director that the nonconformity must stand since the evidence obtained for it was clear.
H: State that a follow up audit will be necessary to review the evidence for the updated Statement of Applicability.
B: This response is correct because the audit team leader should document the request of the Technical Director and include it in the audit report, along with the audit findings and conclusions12. This will ensure transparency and traceability of the audit process and the audit results.
D: This response is correct because the audit team leader should not withdraw the nonconformity based on the amended Statement of Applicability alone. The nonconformity was raised against clause 6.1.3.e of ISO 27001:2022, which requires the organisation to produce and maintain a risk treatment plan that defines how the information security risks are treated, including the controls selected and their implementation status34. The Statement of Applicability is only one part of the risk treatment plan, and it does not provide sufficient evidence that the controls have been implemented effectively. The audit team leader should base the nonconformity on the objective evidence obtained during the audit, not on the subjective claims of the auditee12.
H: This response is correct because the audit team leader should state that a follow up audit will be necessary to review the evidence for the updated Statement of Applicability. A follow up audit is an audit that is conducted after a previous audit to verify the implementation and effectiveness of the corrective actions and/or opportunities for improvement that were agreed upon as a result of the previous audit56. The follow up audit should seek to ensure that the nonconformity has been effectively addressed and that the ISMS is compliant and effective. The follow up audit should also consider any new or changed risks or requirements that may affect the ISMS56.
References:
1: PECB Candidate Handbook – ISO 27001 Lead Auditor, page 25 2: ISO 19011:2018 – Guidelines for auditing management systems, clause 6.7 3: ISO/IEC 27001:2022 – Information technology – Security techniques – Information security management systems – Requirements, clause 6.1.3.e 4: ISO/IEC
27005:2022 – Information technology – Security techniques – Information security risk management, clause
8.3.2 5: PECB Candidate Handbook – ISO 27001 Lead Auditor, page 25 6: ISO 19011:2018 – Guidelines for auditing management systems, clause 6.7

NEW QUESTION 52
During a Stage 1 audit opening meeting, the Management System Representative (MSR) asks to extend the audit scope to include a new site overseas which they have expanded into since the certification application was made.
Select two options for how the auditor should respond.

Advise the MSR that an extension of the scope may be incorporated but will have to go through established procedures

Advise the MSR that the audit scope has been determined based on their initial application so the audit has to proceed as planned

Suggest that the MSR cancels the audit contract and reapplies for the new situation

Determine whether the Management System covers the processes at the new site and, if so, proceed with the audit

Advise the MSR that, within the existing scope, the new work area can be included without any problem

Confirm that the auditor will advise the auditee that the audit scope will be revised to include the new work area

Explanation
The correct options for how the auditor should respond are:
* A. Advise the MSR that an extension of the scope may be incorporated but will have to go through established procedures
* D. Determine whether the Management System covers the processes at the new site and, if so, proceed with the audit These options are consistent with the ISO/IEC 27006:2015 standard, which states that any changes to the scope of certification should be notified by the client to the certification body, and that the certification body should evaluate and decide on these changes in accordance with its procedures1. The auditor should also verify that the ISMS is implemented and maintained at all sites included in the scope of certification1.
The other options are not appropriate for how the auditor should respond, because:
* B. Advise the MSR that the audit scope has been determined based on their initial application so the audit has to proceed as planned: This option is too rigid and does not allow for any flexibility or adaptation to the client’s situation. The auditor should be open to consider any changes to the scope of
* certification that may have occurred since the initial application, as long as they are properly notified and evaluated by the certification body.
* C. Suggest that the MSR cancels the audit contract and reapplies for the new situation: This option is too drastic and unnecessary, as it would cause delays and costs for both the client and the certification body.
The auditor should not suggest that the client cancels the audit contract, but rather that they follow the established procedures for requesting and approving an extension of the scope of certification.
* E. Advise the MSR that, within the existing scope, the new work area can be included without any problem: This option is too lenient and does not ensure that the new work area meets the requirements of ISO/IEC 27001 and the ISMS. The auditor should not assume that the new work area can be included within the existing scope without any problem, but rather that they need to verify that the ISMS is implemented and maintained at the new site, and that any changes to the scope of certification are approved by the certification body.
* F. Confirm that the auditor will advise the auditee that the audit scope will be revised to include the new work area: This option is too presumptuous and does not respect the authority of the certification body.
The auditor should not confirm that they will revise the audit scope to include the new work area, but rather that they will advise the certification body of the client’s request for an extension of the scope of certification, and wait for their decision.

NEW QUESTION 53
What type of legislation requires a proper controlled purchase process?

Personal data protection act

Computer criminality act

Government information act

Intellectual property rights act

NEW QUESTION 54
You are an experienced ISMS audit team leader guiding an auditor in training. She asks you about the grading of nonconformities in audit reports. You decide to test her knowledge by asking her which four of the following statements are true.

Major nonconformities may be subject to on-site follow up

Nonconformities must be graded only using the terms ‘major’ or ‘minor’

The action taken to address major nonconformities is typically more substantial than the action taken to address minor nonconformities

Very minor nonconformities should be re-graded as opportunities for improvement

Several minor nonconformities can be grouped into a major nonconformity

The grading of nonconformities must be explained to the auditee at the opening meeting

The auditee is always responsible for determining the criteria for grading nonconformities

Nonconformities may be graded to indicate their significance

Explanation
The four statements that are true are:
*Major nonconformities may be subject to on-site follow up
*The action taken to address major nonconformities is typically more substantial than the action taken to address minor nonconformities
*Several minor nonconformities can be grouped into a major nonconformity
*Nonconformities may be graded to indicate their significance
According to ISO 19011:2018, a nonconformity is the non-fulfilment of a requirement1. Nonconformities may be graded to indicate their significance, based on the criteria established by the audit programme or the audit client2. The grading of nonconformities may use different terms or levels, such as major, minor, critical, etc., depending on the nature and context of the audit3. However, some common definitions of major and minor nonconformities are:
*A major nonconformity is a nonconformity that affects the ability of the management system to achieve its intended results, or that represents a significant breakdown of the management system4. Major nonconformities may require immediate corrective action and on-site follow up by the auditor to verify their closure5.
*A minor nonconformity is a nonconformity that does not affect the ability of the management system to achieve its intended results, or that represents an isolated lapse of the management system4. Minor nonconformities may require corrective action within a specified time frame and off-site verification by the auditor to confirm their closure5.
The action taken to address nonconformities depends on the severity and impact of the nonconformity, and the risk of recurrence or escalation. Typically, the action taken to address major nonconformities is more substantial than the action taken to address minor nonconformities, as it may involve identifying and eliminating the root cause of the problem, implementing preventive measures, and monitoring the effectiveness of the solution.
Several minor nonconformities can be grouped into a major nonconformity if they are related to the same requirement, process, or area, and if they indicate a systemic failure or a significant risk to the management system. The auditor should use professional judgment and evidence-based approach to decide whether to group or report nonconformities individually.
The other statements are false, based on the guidance of ISO 19011:2018. For example:
*Option B is false, because nonconformities can be graded using different terms or levels, depending on the criteria established by the audit programme or the audit client2. The terms ‘major’ and ‘minor’ are not mandatory or universal, but rather examples of possible grading levels3.
*Option D is false, because very minor nonconformities should not be re-graded as opportunities for improvement, but rather reported as nonconformities, as they still represent a non-fulfilment of a requirement1. An opportunity for improvement is a suggestion for enhancing the performance or effectiveness of the management system, but it is not a nonconformity or a requirement.
*Option F is false, because the grading of nonconformities does not have to be explained to the auditee at the opening meeting, but rather at the closing meeting, where the audit findings and conclusions are presented and discussed. The opening meeting is intended to provide an overview of the audit objectives, scope, criteria, and methods, and to confirm the audit arrangements and logistics.
*Option G is false, because the auditee is not always responsible for determining the criteria for grading nonconformities, but rather the audit programme or the audit client, in consultation with the auditee and other relevant parties2. The auditee is responsible for taking corrective action to address the nonconformities, and for providing evidence of their completion and effectiveness.
References: 1: ISO 19011:2018, 3.13; 2: ISO 19011:2018, 6.6.2; 3: ISO 19011:2018, 6.6.3; 4: ISO Audit Findings :Non-conformance – AUVA Certification1; 5: Annex III: Nonconformity grading – FSSC2; : ISO
27001 Certification – Major vs. Minor Nonconformities – Advisera3; : GUIDANCE FOR ADDRESSING AND CLEARING NONCONFORMITIES – SADCAS4; : ISO 19011:2018, 6.2; : ISO 19011:2018, 3.14; :
ISO 19011:2018, 6.7; : ISO 19011:2018, 6.4; : ISO 19011:2018, 6.7.2; : ISO 19011:2018; : ISO 19011:2018; :
ISO 19011:2018; : ISO 19011:2018; : ISO 19011:2018; : [ISO 19011:2018]; : [ISO 19011:2018]; : [ISO
19011:2018]; : [ISO 19011:2018]; : [ISO 19011:2018]; : [ISO 19011:2018]; : [ISO 19011:2018]

NEW QUESTION 55
What is a repressive measure in case of a fire?

Repairing damage caused by the fire

Taking out a fire insurance

Putting out a fire after it has been detected by a fire detector

NEW QUESTION 56
Which of the following statements are correct for Clean Desk Policy?

Don’t leave confidential documents on your desk.

Don’t leave valuable items on your desk if you are not in your work area.

Don’t leave highly confidential items.

Don’t leave laptops without cable lock.

NEW QUESTION 57
CEO sends a mail giving his views on the status of the company and the company’s future strategy and the CEO’s vision and the employee’s part in it. The mail should be classified as

Internal Mail

Public Mail

Confidential Mail

Restricted Mail

NEW QUESTION 58
How is the purpose of information security policy best described?

An information security policy documents the analysis of risks and the search for countermeasures.

An information security policy provides direction and support to the management regarding information security.

An information security policy makes the security plan concrete by providing it with the necessary details.

An information security policy provides insight into threats and the possible consequences.

NEW QUESTION 59
You are an experienced ISMS audit team leader. During the conducting of a third-party surveillance audit, you decide to test your auditee’s knowledge of ISO/IEC 27001’s risk management requirements.
You ask her a series of questions to which the answer is either ‘that is true’ or ‘that is false’. Which four of the following should she answer ‘that is true’?

The results of risk assessments must be maintained

Risk identification is used to determine the severity of an information security risk

ISO/IEC 27001 provides an outline approach for the management of risk

The organisation must produce a risk treatment plan for every business risk identified

The organisation must operate a risk treatment process to eliminate it’s information security risks

The initial phase in an organisation’s risk management process should be information security risk assessment

Risks assessments should be undertaken at monthly intervals

Risk assessments should be undertaken following significant changes

Explanation
The following four statements are true according to ISO/IEC 27001’s risk management requirements: 12 The results of risk assessments must be maintained. This is true because clause 8.2.3 of ISO/IEC
27001:2022 requires the organisation to retain documented information of the information security risk assessment process and the results12 ISO/IEC 27001 provides an outline approach for the management of risk. This is true because clause
6.1.2 of ISO/IEC 27001:2022 specifies the general steps for the information security risk management process, which include establishing the risk criteria, assessing the risks, treating the risks, and monitoring and reviewing the risks12 The organisation must produce a risk treatment plan for every business risk identified. This is true because clause 6.1.3 of ISO/IEC 27001:2022 requires the organisation to produce a risk treatment plan that defines the actions to be taken to address the unacceptable risks, the responsibilities, the expected dates, and the resources required12 Risk assessments should be undertaken following significant changes. This is true because clause 8.2.4 of ISO/IEC 27001:2022 requires the organisation to review and update the risk assessment at planned intervals or when significant changes occur12 The following four statements are false according to ISO/IEC 27001’s risk management requirements:
Risk identification is used to determine the severity of an information security risk. This is false because risk identification is used to identify the assets, threats, vulnerabilities, and existing controls that are relevant to the information security risk management process. The severity of an information security risk is determined by the risk analysis, which evaluates the likelihood and impact of the risk scenarios12 The organisation must operate a risk treatment process to eliminate its information security risks. This is false because the organisation can choose from four options to treat its information security risks: avoid, transfer, mitigate, or accept. The organisation does not have to eliminate all its information security risks, but only those that are unacceptable according to its risk criteria12 The initial phase in an organisation’s risk management process should be information security risk assessment. This is false because the initial phase in an organisation’s risk management process should be establishing the risk management framework, which includes defining the risk management policy, objectives, scope, roles, responsibilities, and criteria. The information security risk assessment is the second phase in the risk management process12 Risks assessments should be undertaken at monthly intervals. This is false because there is no fixed frequency for conducting risk assessments in ISO/IEC 27001. The organisation should determine the appropriate intervals for reviewing and updating the risk assessment based on its risk appetite, risk profile, and operational context12 References:
1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Course by CQI and IRCA Certified Training 1 2: ISO/IEC 27001 Lead Auditor Training Course by PECB 2

NEW QUESTION 60
You are an ISMS audit team leader who has been assigned by your certification body to carry out a follow-up audit of a client. You are preparing your audit plan for this audit.
Which two of the following statements are true?

Verification should focus on whether any action undertaken taken has been undertaken efficiently

Corrections should be verified first, followed by corrective actions and finally opportunities for improvement

Verification should focus on whether any action undertaken is complete

Opportunities for improvement should be verified first, followed by corrections and finally corrective actions

Corrective actions should be reviewed first, followed by corrections and finally opportunities for improvement

Verification should focus on whether any action undertaken has been undertaken effectively

Explanation
According to ISO 27001:2022 clause 9.1.2, the organisation shall conduct internal audits at planned intervals to provide information on whether the information security management system conforms to the organisation’s own requirements, the requirements of ISO 27001:2022, and is effectively implemented and maintained12 According to ISO 27001:2022 clause 10.1, the organisation shall react to the nonconformities and take action, as applicable, to control and correct them and deal with the consequences. The organisation shall also evaluate the need for action to eliminate the causes of nonconformities, in order to prevent recurrence or occurrence.
The organisation shall implement any action needed, review the effectiveness of any corrective action taken, and make changes to the information security management system, if necessary12 A follow-up audit is a type of internal audit that is conducted after a previous audit to verify whether the nonconformities and corrective actions have been addressed and resolved, and whether the information security management system has been improved12 Therefore, the following statements are true for preparing a follow-up audit plan:
Verification should focus on whether any action undertaken is complete. This means that the auditor should check whether the organisation has implemented all the planned actions to correct and prevent the nonconformities, and whether the actions have been documented and communicated as required12 Verification should focus on whether any action undertaken has been undertaken effectively. This means that the auditor should check whether the organisation has achieved the intended results and objectives of the actions, and whether the actions have eliminated or reduced the nonconformities and their causes and consequences12 The following statements are false for preparing a follow-up audit plan:
Verification should focus on whether any action undertaken has been undertaken efficiently. This is false because efficiency is not a criterion for verifying the actions taken to address the nonconformities and corrective actions. Efficiency refers to the optimal use of resources to achieve the desired outcomes, but it is not a requirement of ISO 27001:2022. The auditor should focus on the effectiveness and completeness of the actions, not on the efficiency12 Corrections should be verified first, followed by corrective actions and finally opportunities for improvement. This is false because there is no prescribed order for verifying the corrections, corrective actions, and opportunities for improvement. The auditor should verify all the actions taken by the organisation, regardless of their sequence or priority. The auditor may choose to verify the actions based on their relevance, significance, or impact, but this is not a mandatory requirement12 Opportunities for improvement should be verified first, followed by corrections and finally corrective actions. This is false because there is no prescribed order for verifying the opportunities for improvement, corrections, and corrective actions. The auditor should verify all the actions taken by the organisation, regardless of their sequence or priority. The auditor may choose to verify the actions based on their relevance, significance, or impact, but this is not a mandatory requirement12 Corrective actions should be reviewed first, followed by corrections and finally opportunities for improvement. This is false because there is no prescribed order for reviewing the corrective actions, corrections, and opportunities for improvement. The auditor should review all the actions taken by the organisation, regardless of their sequence or priority. The auditor may choose to review the actions based on their relevance, significance, or impact, but this is not a mandatory requirement12 References:
1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Course by CQI and IRCA Certified Training 1 2: ISO/IEC 27001 Lead Auditor Training Course by PECB 2

NEW QUESTION 61
You are conducting a third-party surveillance audit when another member of the audit team approaches you seeking clarification. They have been asked to assess the organisation’s application of control 5.7 – Threat Intelligence. They are aware that this is one of the new controls introduced in the 2022 edition of ISO/IEC
27001, and they want to make sure they audit the control correctly.
They have prepared a checklist to assist them with their audit and want you to confirm that their planned activities are aligned with the control’s requirements.
Which three of the following options represent valid audit trails?

I will ensure that the task of producing threat intelligence is assigned to the organisation’s internal audit team

I will ensure that the organisation’s risk assessment process begins with effective threat intelligence

I will speak to top management to make sure all staff are aware of the importance of reporting threats

I will ensure that appropriate measures have been introduced to inform top management as to the effectiveness of current threat intelligence arrangements

I will check that the organisation has a fully documented threat intelligence process

I will check that threat intelligence is actively used to protect the confidentiality, integrity and availability of the organisation’s information assets

I will review how information relating to information security threats is collected and evaluated to produce threat intelligence

I will determine whether internal and external sources of information are used in the production of threat intelligence

Explanation
These three options represent valid audit trails for control 5.7, as they are aligned with the control’s requirements and objectives. According to the web search results from my predefined tool, control 5.7 requires organisations to collect and analyse information relating to information security threats and use that information to take mitigation actions12. The control also specifies that threat intelligence should be relevant, perceptive, contextual, and actionable, and that it should be used to prevent, detect, or respond to threats34.
Therefore, the auditor should verify how the organisation collects, analyses, and produces threat intelligence, how it uses threat intelligence to protect its information assets, and how it monitors and evaluates the effectiveness of its threat intelligence arrangements. The other options are not valid audit trails, as they are either irrelevant, incorrect, or incomplete. For example:
*The task of producing threat intelligence is not assigned to the organisation’s internal audit team, but to the person or team responsible for the ISMS, such as the information security manager or the information security committee5 .
*The organisation’s risk assessment process does not begin with effective threat intelligence, but with the identification of the context, scope, and objectives of the ISMS . Threat intelligence is an input for the risk identification and analysis, but not the starting point of the risk assessment process.
*Speaking to top management to make sure all staff are aware of the importance of reporting threats is not sufficient to audit the control, as it does not address how the organisation collects, analyses, and produces threat intelligence, nor how it uses it to take mitigation actions. The auditor should also speak to the staff involved in the threat intelligence process, and review the relevant documents and records.
*Checking that the organisation has a fully documented threat intelligence process is not enough to audit the control, as it does not verify the implementation and effectiveness of the process. The auditor should also observe the process in action, and examine the outputs and outcomes of the process.
*Determining whether internal and external sources of information are used in the production of threat intelligence is a partial audit trail, as it only covers one aspect of the control. The auditor should also assess the quality, reliability, and relevance of the sources, and how the information is analysed and used.
References: = 1: ISO 27001:2022 Annex A 5.7 – Threat Intelligence – ISMS.online12: ISO 27001 Annex A
5.7 Threat Intelligence – High Table23: ISO/IEC 27001:2022 Information technology – Security techniques
– Information security management systems – Requirements, clause A.5.74: ISO 27002 Emphasizes Need For Threat Intelligence – Rapid745: ISO/IEC 27007:2011 Information technology – Security techniques – Guidelines for information security management systems auditing, clause 6.3.2. : ISO 27001 Statement of Applicability [Updated 2024] – Sprinto3 : ISO/IEC 27001:2022 Information technology – Security techniques – Information security management systems – Requirements, clause 6.1.1. : ISO 27001 Requirement 6.1.1 – Actions to address risks and opportunities | ISMS.online1

NEW QUESTION 62
In acceptable use of Information Assets, which is the best practice?

Access to information and communication systems are provided for business purpose only

Interfering with or denying service to any user other than the employee’s host

Playing any computer games during office hours

Accessing phone or network transmissions, including wireless or wifi transmissions

NEW QUESTION 63
You receive an E-mail from some unknown person claiming to be representative of your bank and asking for your account number and password so that they can fix your account. Such an attempt of social engineering is called

Shoulder Surfing

Mountaineering

Phishing

Spoofing

NEW QUESTION 64
The following are the guidelines to protect your password, except:

Don’t use the same password for various company system security access

Do not share passwords with anyone

For easy recall, use the same password for company and personal accounts

Change a temporary password on first log-on

NEW QUESTION 65
You are performing an ISMS audit at a residential nursing home that provides healthcare services and are reviewing the Software Code Management (SCM) system. You found a total of 10 user accounts on the SCM.
You confirm that one of the users, Scott, resigned 9-months
ago. The SCM System Administrator confirmed Scott’s last check-out of the source code was found 1 month ago. He was using one of the uthorized desktops from the local network in a secure area.
You check with the user de-registration procedure which states “Managers have to make sure of deregistration of the user account and authorisation immediately from the relevant ICT system and/or equipment after resignation approval.” There was no deregistration record for user Scott.
The IT Security Manager explains that Scott still comes back to the office every month after he resigned to provide support on source code maintenance. That’s why his account on SCM still exists.
You would like to investigate other areas further to collect more audit evidence. Select three options that would not be valid audit trails.

Collect more evidence on how access controls are periodically reviewed to maintain security (Relevant to control A.5.35)

Collect more evidence on how the transition of Scott from full-time to part-time employment was managed (relevant to control A.6.5)

Collect more evidence from Scott’s background verification checks performed by the human resource department under the new employment relationship. (Relevant to control A.6.1)

Collect more evidence of why Scott resigned and whether his re-engagement represents a conflict of interest. (relevant to control A.5.3)

Collect more evidence on how Scott can access the employee’s desktop and local network. (Relevant to control A.5.15)

Collect more evidence on how Scott can access the secure area. (Relevant to control A.8.4)

Collect more evidence on how the organization pays for Scott’s source code maintenance support service. (Relevant to control A.6.2)

Collect more evidence on where Scott kept the source code that he checked out and how it was secured.
(Relevant to control A.8.4)

NEW QUESTION 66
Which two of the following phrases are ‘objectives’ in relation to a first-party audit?

Apply international standards

Prepare the audit report for the certification body

Confirm the scope of the management system is accurate

Complete the audit on time

Apply Regulatory requirements

Update the management policy

NEW QUESTION 67
In the context of a management system audit, please identify the sequence of a typical process of collecting and verifying information. The first one has been done for you.

NEW QUESTION 68
Objectives, criteria, and scope are critical features of a third-party ISMS audit. Which two issues are audit objectives?

Evaluate customer processes and functions

Assess conformity with ISO/IEC 27001 requirements

Fulfil the audit plan

Confirm sites operating the ISMS

Determine the scope of the ISMS

Review organisation efficiency

Explanation
Audit objectives are the specific purposes or goals that the customer or the certification body wants to achieve through the audit. They define what the audit intends to accomplish and provide the basis for planning and conducting the audit. Audit objectives may vary depending on the type, scope, and criteria of the audit, but they should be clear, measurable, and achievable.
Some examples of audit objectives for a third-party ISMS audit are:
* Assess conformity with ISO/IEC 27001 requirements: This objective means that the audit aims to verify that the organisation’s ISMS meets the requirements of the ISO/IEC 27001 standard, which specifies the best practices for establishing, implementing, maintaining, and improving an information security management system. The audit will evaluate the organisation’s ISMS documentation, processes, controls, and performance against the standard’s clauses and annex A controls.
* Confirm sites operating the ISMS: This objective means that the audit aims to confirm that the organisation’s ISMS covers all the relevant sites or locations where the organisation operates or provides its services. The audit will verify that the scope of the ISMS is accurate and consistent with the organisation’s context, objectives, and risks.
The other phrases are not audit objectives, but rather:
* Evaluate customer processes and functions: This is not an audit objective, but rather a possible audit criterion or a requirement that the organisation’s processes and functions should meet. The audit criterion is the reference against which the audit evidence is compared to determine conformity or nonconformity. The audit criterion may include ISO/IEC 27001 requirements, customer requirements, or other applicable standards or regulations.
* Fulfil the audit plan: This is not an audit objective, but rather a task or an activity that the auditor performs during the audit. The audit plan is a document that describes the arrangements and details of the audit, such as the objectives, scope, criteria, schedule, roles, and responsibilities. The auditor should follow and fulfil the audit plan to ensure that the audit is conducted effectively and efficiently.
* Determine the scope of the ISMS: This is not an audit objective, but rather a prerequisite or an input for conducting the audit. The scope of the ISMS is the extent and boundaries of the information security management system within the organisation. It defines what processes, activities, locations, assets, and stakeholders are included or excluded from the ISMS. The scope of the ISMS should be determined by the organisation before applying for certification or undergoing an audit.
* Review organisation efficiency: This is not an audit objective, but rather a possible outcome or a result of conducting an audit. The organisation efficiency is a measure of how well the organisation uses its
* resources to achieve its goals and objectives. The audit may help review and improve the organisation efficiency by identifying strengths, weaknesses, opportunities, and threats in its information security management system.
References:
* ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) objectives and content from Quality.org and PECB
* ISO 19011:2018 Guidelines for auditing management systems [Section 5.3.1]

NEW QUESTION 69
What is the relationship between data and information?

Data is structured information.

Information is the meaning and value assigned to a collection of data.

NEW QUESTION 70
CMM stands for?

Capability Maturity Matrix

Capacity Maturity Matrix

Capability Maturity Model

Capable Mature Model

NEW QUESTION 71
What is the worst possible action that an employee may receive for sharing his or her password or access with others?

Forced roll off from the project

The lowest rating on his or her performance assessment

Three days suspension from work

Termination

NEW QUESTION 72
Select the words that best complete the sentence below to describe audit resources:

NEW QUESTION 73
What is the name of the system that guarantees the coherence of information security in the organization?

Information Security Management System (ISMS)

Rootkit

Security regulations for special information for the government

Information Technology Service Management (ITSM)

NEW QUESTION 74
What is the goal of classification of information?

To create a manual about how to handle mobile devices

Applying labels making the information easier to recognize

Structuring information according to its sensitivity

Study HIGH Quality ISO-IEC-27001-Lead-Auditor Free Study Guides and Exams Tutorials [Q50-Q74]

Leave a Reply Cancel reply