LEAD-AUDITOR · Question #390
As an auditor, you have noticed that ABC Inc. has established a procedure to manage removable storage media. The procedure is based on the classification scheme adopted by ABC Inc.. Thus, if the infor
The correct answer is C. Conformity. The classification-based security approach aligns with ISO/IEC 27001:2022 Annex A Control A.5.12 (Classification of Information). The organization is applying a security control in accordance with the classification policy, ensuring conformity to information security best practic
Question
As an auditor, you have noticed that ABC Inc. has established a procedure to manage removable storage media. The procedure is based on the classification scheme adopted by ABC Inc.. Thus, if the information stored is classified as "confidential," the procedure applies. However, public information does not have confidentiality requirements, so only integrity and availability controls apply. What type of audit finding is this?
Options
- ANonconformity
- BAnomaly
- CConformity
How the community answered
(58 responses)- A5% (3)
- B12% (7)
- C83% (48)
Explanation
The classification-based security approach aligns with ISO/IEC 27001:2022 Annex A Control A.5.12 (Classification of Information). The organization is applying a security control in accordance with the classification policy, ensuring conformity to information security best practices.
Topics
Community Discussion
No community discussion yet for this question.