You are an experienced audit team leader guiding an auditor in training. Your team is currently conducting a third-party surveillance audit of an organisation that stores data on behalf of external…

Question

Options

• AAccess to and from the loading bay
• BHow power and data cables enter the building
• CInformation security awareness, education, and training
• DThe conducting of verification checks on personnel
• EThe development and maintenance of an information asset inventory
• FThe operation of the site CCTV and door control systems
• GThe organisation's arrangements for maintaining equipment
• HThe organisation's business continuity arrangements

• A
  77% (47)
• C
  13% (8)
• D
  5% (3)
• E
  3% (2)
• H
  2% (1)

Explanation

The four controls from the list that are related to PHYSICAL aspects of the ISMS are: Access to and from the loading bay How power and data cables enter the building The operation of the site CCTV and door control systems The organisation's arrangements for maintaining equipment These controls are derived from the ISO 27001 Annex A, which provides a comprehensive list of information security controls that can be applied to an ISMS1. The other controls in the list are more related to ORGANIZATIONAL, LEGAL, or HUMAN aspects of the ISMS, which are also important, but not the focus of this question. According to the ISMS Auditing Guideline2, the auditor in training should review the PHYSICAL Checking the SoA to identify the applicable controls and their implementation status Interviewing the relevant staff and management to verify their understanding and involvement in Observing the physical and environmental conditions to confirm the existence and effectiveness Examining the relevant documents and records to validate the compliance and performance of

No community discussion yet for this question.