ISO-IEC-27001-LEAD-AUDITOR · Question #168
You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. The next step in your audit plan is to verify the information security of ABC's…
The correct answer is A. Collect more evidence on how much residents' family members pay to install ABC's healthcare C. Collect more evidence to determine the number of users of ABC's healthcare mobile app. H. Collect more evidence to verify the developer's CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS. The three options that will not be in your audit trail are A, C, and H. These options are either not relevant to the information security of ABC's healthcare mobile app development, support, and lifecycle process, or not within the scope of your audit. The amount of money that…
Question
You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. The next step in your audit plan is to verify the information security of ABC's healthcare mobile app development, support, and lifecycle process. During the audit, you learned the organisation outsourced the mobile app development to a professional software development organisation with CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS (ISO 22301) and ISMS (ISO/IEC 27001) certified. The IT Manager presents the software security management procedure and summarises the process as follows:
The mobile app development shall adopt "security-by-design" and "security-by-default" principles, as a minimum. The following security functions for personal data protection shall be available:
Access control. Personal data encryption, i.e., Advanced Encryption Standard (AES) algorithm, key lengths: 256 bits; and Personal data pseudonymization. Vulnerability checked and no security backdoor You sample the latest Mobile App Test report - Reference ID: 0098, details as follows:
You would like to investigate other areas further to collect more audit evidence. Select three options that will not be in your audit trail.
Exhibits
Options
- ACollect more evidence on how much residents' family members pay to install ABC's healthcare
- BCollect more evidence by downloading and testing the mobile app on your phone. (Relevant to
- CCollect more evidence to determine the number of users of ABC's healthcare mobile app.
- DCollect more evidence on how the organisation performs testing of personal data handling.
- ECollect more evidence on the organisation's business continuity policy. (Relevant to control
- FCollect more evidence on how the organisation manages information security in the selection of
- GCollect more evidence on how the developer trains its product support personnel. (Relevant to
- HCollect more evidence to verify the developer's CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS
How the community answered
(65 responses)- A65% (42)
- B5% (3)
- D18% (12)
- E2% (1)
- F2% (1)
- G9% (6)
Explanation
The three options that will not be in your audit trail are A, C, and H. These options are either not relevant to the information security of ABC's healthcare mobile app development, support, and lifecycle process, or not within the scope of your audit. The amount of money that residents' family members pay to install the app (A) and the number of users of the app (C) are not related to the information security aspects or objectives of the ISMS1. The verification of the developer's certifications (H) is not your responsibility as an ISMS auditor, as you should rely on the competence and impartiality of the certification bodies that issued them2. The other options are relevant and within the scope of your audit, as they relate to the security functions, testing, policies, and procedures of the mobile app development, support, and lifecycle process13.
Topics
Community Discussion
No community discussion yet for this question.