You are the audit team leader conducting a third-party audit of an online insurance organisation. During Stage 1, you found that the organisation took a very cautious risk approach and included all the information security controls in ISO/IEC 27001:2022 Appendix A in their Statement of Applicability. During the Stage 2 audit, your audit team found that there was no evidence of the implementation of the three controls (5.3 Segregation of duties, 6.1 Screening, 7.12 Cabling security) shown in the extract from the Statement of Applicability. No risk treatment plan was found. Select three options for the actions you would expect the auditee to take in response to a nonconformity against clause 6.1.3.e of ISO/IEC 27001:2022.

Question

Accepted Answer

C. Implement the appropriate risk treatment for each of the applicable controls. F. Revise the relevant content in the Statement of Applicability to justify their exclusion. G. Revisit the risk assessment process relating to the three controls.

Answer

A. Allocate responsibility for producing evidence to prove to auditors that the controls are

Answer

B. Compile plans for the periodic assessment of the risks associated with the controls.

Answer

D. Incorporate written procedures for the controls into the organisation's Security Manual.

Answer

E. Remove the three controls from the Statement of Applicability.

Answer

H. Undertake a survey of customers to find out if the controls are needed by them.

You are the audit team leader conducting a third-party audit of an online insurance organisation. During Stage 1, you found that the organisation took a very cautious risk approach and included all th

Question

Exhibit

Options

How the community answered

Explanation

Topics

Community Discussion