Scenario 6: Sinvestment is an insurance company that offers home, commercial, and life insurance. The company was founded in North Carolina, but have recently expanded in other locations, including Europe and Africa.
Sinvestment is committed to complying with laws and regulations applicable to their industry and preventing any information security incident. They have implemented an ISMS based on ISO/IEC 27001 and have applied for ISO/IEC 27001 certification.
Two auditors were assigned by the certification body to conduct the audit. After signing a confidentiality agreement with Sinvestment. they started the audit activities. First, they reviewed the documentation required by the standard, including the declaration of the ISMS scope, information security policies, and internal audits reports. The review process was not easy because, although Sinvestment stated that they had a documentation procedure in place, not all documents had the same format.
Then, the audit team conducted several interviews with Sinvestment's top management to understand their role in the ISMS implementation. All activities of the stage 1 audit were performed remotely, except the review of documented information, which took place on-site, as requested by Sinvestment.
During this stage, the auditors found out that there was no documentation related to information security training and awareness program. When asked, Sinvestment's representatives stated that the company has provided information security training sessions to all employees. Stage 1 audit gave the audit team a general understanding of Sinvestment's operations and ISMS.
The stage 2 audit was conducted three weeks after stage 1 audit. The audit team observed that the marketing department (which was not included in the audit scope) had no procedures in place to control employees' access rights. Since controlling employees' access rights is one of the ISO/IEC 27001 requirements and was included in the information security policy of the company, the issue was included in the audit report. In addition, during stage 2 audit, the audit team observed that Sinvestment did not record logs of user activities.
The procedures of the company stated that "Logs recording user activities should be retained and regularly reviewed," yet the company did not present any evidence of the implementation of such procedure.
During all audit activities, the auditors used observation, interviews, documented information review, analysis, and technical verification to collect information and evidence. All the audit findings during stages 1 and 2 were analyzed and the audit team decided to issue a positive recommendation for certification.
Based on scenario 6, during stage 1 audit, the auditor found out that some documents regarding the ISMS had different format. What should the auditor do in this case?

• A. Verify only if the information required by the standard is documented without taking into account the format since this is not a requirement of the standard
• B. Verify if the documented information has the appropriate format and is in accordance with the company's documentation procedure since this is a requirement of the standard
• C. Document this observation as an issue that should be verified during stage 2 audit

You are an experienced audit team leader conducting a third-party surveillance audit of an organisation that designs websites for its clients. You are currently reviewing the organisation's Statement of Applicability.
Based on the requirements of ISO/IEC 27001, which two of the following observations about the Statement of Applicability are true?

• A. The Statement of Applicability must be reviewed at least annually
• B. Justification is only required for any controls that the organisations choses to exclude
• C. The Statement of Applicability is owned and amended by the organisation's top management
• D. Justification for both the inclusion and exclusion of Annex A controls in the Statement of Applicability is required
• E. The Statement of Applicability must be reviewed at Management Review
• F. A Statement of Applicability must be produced by organisations seeking ISO/IEC 27001 conformity

You are an experienced audit team leader conducting a third-party surveillance audit of an organisation that designs websites for its clients. You are currently reviewing the organisation's Statement of Applicability.
Based on the requirements of ISO/IEC 27001, which two of the following observations about the Statement of Applicability are false?

• A. The Statement of Applicability must include Organisational, Physical, People and Technological controls that are necessary
• B. Justification is only required for any controls that the organisations choses to exclude
• C. Additional controls not included in Appendix A may be added to the Statement of Applicability if the organisation choses to do so
• D. The Statement of Applicability is owned and amended by the organisation's top management
• E. Justification for both the inclusion and exclusion of Annex A controls in the Statement of Applicability is required
• F. A Statement of Applicability must be produced by organisations seeking ISO/IEC 27001 conformity

You are an experienced ISMS Audit Team Leader, talking to an Auditor in training who has been assigned to your audit team. You want to ensure that they understand the importance of the Check stage of the Plan- Do-Check-Act cycle in respect of the operation of the information security management system.
You do this by asking him to select the answer which best describes the purpose of the check activity
'management review.
The purpose of the management review is to: Select 1

• A. Assess the information security management system at random intervals to ensure its continuing efficiency, adequacy and effectiveness.
• B. Update the information security management system at documented intervals to ensure its continuing conformity, adequacy and effectiveness.
• C. Review the information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.
• D. Consider the information security management system at regular intervals to ensure its continuing compliance, adequacy and effectiveness.

You have a hard copy of a customer design document that you want to dispose off. What would you do

• A. Throw it in any dustbin
• B. Give it to the office boy to reuse it for other purposes
• C. Be environment friendly and reuse it for writing
• D. Shred it using a shredder