You are carrying out your first third-party ISMS surveillance audit as an audit team leader. You are presently in the auditee's data centre with another member of your audit team and the organisation's guide. You request access to a locked room protected by a combination lock and iris scanner. In the corner of the room is a collection of hard drives piled on a desk. You ask the guide what the status of the drives is. He tells you the drives are redundant and awaiting disposal. They should have been picked up last week, but the organisation's external provider of secure destruction services was unable to source a driver due to staff sickness. He says this has recently become more common though he does not know why. He then presents you with a job ticket that confirms the pickup has been rescheduled for tomorrow. Based on the scenario above which three of the following actions would you now take?

Question

Accepted Answer

D. Ensure that the organisation's arrangements for the secure disposal and reuse of equipment have G. Ensure that the organisation's arrangements for the life cycle management of storage media have H. Follow an audit trail to determine whether the organisation is complying with its obligations in

Answer

A. Record a nonconformity against control A.5.13 'labelling of information' as the disk drives' status

Answer

B. Raise a nonconformity against control A.7.7, 'clear desk and clear screen' because the drives have

Answer

C. Record an opportunity for improvement in respect of the external provider's inventory management

Answer

E. Record the finding but note no further action is required as the pickup has now been rescheduled.

Answer

F. Raise a nonconformity against control A.7.5, 'protecting against physical and environmental

LEAD-AUDITOR Question #128: Real Exam Question with Answer & Explanation

Question

Options

Community Discussion