You are carrying out your first third-party ISMS surveillance audit as an Audit Team Leader. You are presently in the auditee's data centre with another member of your audit team. You are currently…

Question

Options

• ATake no action. Irrespective of any recommendations, contractors will always act in this way
• BRaise a nonconformity against control A.5.20 'addressing information security in supplier
• CRaise a nonconformity against control A.7.6 'working in secure areas' as security measures for
• DDetermine whether any additional effective arrangements are in place to verify individual access
• ERaise an opportunity for improvement that contractors must be accompanied at all times when
• FRaise an opportunity for improvement to have a large sign in reception reminding everyone
• GRaise a nonconformity against control A.7.2 'physical entry' as a secure area is not adequately
• HTell the organisation they must write to their contractors, reminding them of the need to use

• A
  5% (3)
• B
  10% (6)
• D
  23% (14)
• E
  2% (1)
• G
  59% (36)
• H
  2% (1)

Explanation

According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), control A.7.2 requires an organization to implement appropriate physical entry controls to prevent unauthorized access to secure areas1. The organization should define and document the criteria for granting and revoking access rights to secure areas, and should monitor and record the use of such access rights1. Therefore, when auditing the organization's application of control A.7.2, an ISMS auditor should verify that these aspects are met in accordance with the audit criteria. Based on the scenario above, the auditor should raise a nonconformity against control A.7.2, as the secure area is not adequately protected from unauthorized access. The auditor should provide the following evidence and justification for the nonconformity: Evidence: The auditor observed two external contractors using a swipe card and combination number provided by the centre's reception desk to gain access to a client's suite to carry out authorized electrical repairs. The auditor checked the door access record for the client's suite and found that only one card was swiped. The auditor asked the receptionist and was told that it was a common problem that contractors tend to swipe one card and tailgate their way in, but they were known from the reception sign-in. Justification: This evidence indicates that the organization has not implemented appropriate physical entry controls to prevent unauthorized access to secure areas, as required by control A.7.2. The organization has not defined and documented the criteria for granting and revoking access rights to secure areas, as there is no verification or authorization process for providing swipe cards and combination numbers to external contractors. The organization has not monitored and recorded the use of access rights to secure areas, as there is no mechanism to ensure that each individual swipes their card and enters their combination number before entering a secure area. The organization has relied on the reception sign-in as a means of identification, which is not sufficient or reliable for ensuring information security. The other options are not valid actions for auditing control A.7.2, as they are not related to the control or its requirements, or they are not appropriate or effective for addressing the

No community discussion yet for this question.