You are an experienced ISMS auditor conducting a third-party surveillance audit at an organisation which offers ICT reclamation services. ICT equipment which companies no longer require is processed by the organisation. It is either recommissioned and reused or is securely destroyed. You notice two servers on a bench in the corner of the room. Both have stickers on them with the server's name, IP address and admin password. You ask the ICT Manager about them, and he tells you they were part of a shipment received yesterday from a regular customer. Which one action should you take?

Question

Accepted Answer

C. Note the audit finding and check the process for dealing with incoming shipments relating to

Answer

A. Ask the auditee to remove the labels, then carry on with the audit

Answer

B. Ask the ICT Manager to record an information security incident and initiate the information security

Answer

D. Raise a nonconformity against control 5.31 'Legal, staturary, regulatory and contractual

Answer

E. Raise a nonconformity against control 8.20 'network security' (networks and network devices shall

Answer

F. Record what you have seen in your audit findings, but take no further action

You are an experienced ISMS auditor conducting a third-party surveillance audit at an organisation which offers ICT reclamation services. ICT equipment which companies no longer require is processed b

Question

Options

How the community answered

Explanation

Topics

Community Discussion