LEAD-AUDITOR Question #245: Real Exam Question with Answer & Explanation

You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify the information security incident management process. The IT Security Manager presents the information security incident management procedure and explains that the process is based on ISO/IEC 27035-1:2016. You review the document and notice a statement "any information security weakness, event, and incident should be reported to the Point of Contact (PoC) within 1 hour after identification". When interviewing staff, you found that there were differences in the understanding of the meaning of "weakness, event, and incident". You sample incident report records from the event tracking system for the last 6 months with summarized results in the following table. You would like to further investigate other areas to collect more audit evidence. Select two options that will not be in your audit trail.