ISO-IEC-27001-LEAD-AUDITOR · Question #170
You are carrying out your first third-party ISMS surveillance audit as an audit team leader. You are presently in the auditee's data centre with another member of your audit team and the…
The correct answer is D. Ensure that the organisation's arrangements for the secure disposal and reuse of equipment have G. Ensure that the organisation's arrangements for the life cycle management of storage media have H. Follow an audit trail to determine whether the organisation is complying with its obligations in. Options D, G, and H are correct because they reflect the auditor's obligation to follow evidence and verify systemic compliance, not just accept surface-level assurances. Finding redundant drives piled on a desk - even in a secured room - triggers three legitimate audit lines…
Question
You are carrying out your first third-party ISMS surveillance audit as an audit team leader. You are presently in the auditee's data centre with another member of your audit team and the organisation's guide. You request access to a locked room protected by a combination lock and iris scanner. In the corner of the room is a collection of hard drives piled on a desk. You ask the guide what the status of the drives is. He tells you the drives are redundant and awaiting disposal. They should have been picked up last week, but the organisation's external provider of secure destruction services was unable to source a driver due to staff sickness. He says this has recently become more common though he does not know why. He then presents you with a job ticket that confirms the pickup has been rescheduled for tomorrow. Based on the scenario above which three of the following actions would you now take?
Options
- ARecord a nonconformity against control A.5.13 'labelling of information' as the disk drives' status
- BRaise a nonconformity against control A.7.7, 'clear desk and clear screen' because the drives
- CRecord an opportunity for improvement in respect of the external provider's inventory
- DEnsure that the organisation's arrangements for the secure disposal and reuse of equipment have
- ERecord the finding but note no further action is required as the pickup has now been rescheduled.
- FRaise a nonconformity against control A.7.5, 'protecting against physical and environmental
- GEnsure that the organisation's arrangements for the life cycle management of storage media have
- HFollow an audit trail to determine whether the organisation is complying with its obligations in
How the community answered
(46 responses)- A7% (3)
- B13% (6)
- C2% (1)
- D48% (22)
- E2% (1)
- F28% (13)
Explanation
Options D, G, and H are correct because they reflect the auditor's obligation to follow evidence and verify systemic compliance, not just accept surface-level assurances. Finding redundant drives piled on a desk - even in a secured room - triggers three legitimate audit lines: (D) verifying the organisation's procedures for secure disposal and reuse of equipment (ISO 27001:2022 A.7.14); (G) confirming lifecycle management of storage media is operating effectively (A.7.10), including whether drives have been sanitised or tracked; and (H) pursuing the supplier relationship angle, since the repeated delays from the external destruction provider raise concerns about whether contractual and information security obligations are being met (A.5.19/A.5.20).
Why the distractors fail:
- A (A.5.13 labelling): The drives' status is known - this isn't a labelling failure, it's a disposal and supplier issue.
- B (A.7.7 clear desk): That control targets unattended sensitive information (papers, unlocked screens) in working areas, not equipment awaiting controlled destruction in a secured room.
- C (OFI on provider's inventory): Too narrow; the supplier delay is better handled through H's audit trail, which examines contractual compliance holistically.
- E (no further action needed): An auditor cannot accept a rescheduled pickup as closure - the delay pattern must be investigated, not accepted at face value.
- F (A.7.5 physical/environmental threats): The room has a combination lock and iris scanner; physical protection is demonstrably in place, so this control isn't triggered.
Memory tip: When you spot hardware awaiting destruction, think "DGH - Disposal, Governance, History trail." Always verify the procedure (D), the media lifecycle (G), and follow the supplier thread (H) - never close on a promise.
Topics
Community Discussion
No community discussion yet for this question.