You are an experienced ISMS auditor conducting a third-party surveillance audit at an organisation which...

Question

You are an experienced ISMS auditor conducting a third-party surveillance audit at an organisation which offers ICT reclamation services. ICT equipment which companies no longer require is processed by the organisation. It is either recommissioned and reused or is securely destroyed.
You notice two servers on a bench in the corner of the room. Both have stickers on them with the server's name, IP address and admin password. You ask the ICT Manager about them, and he tells you they were part of a shipment received yesterday from a regular customer.
Which one action should you take?

Accepted Answer

C. Note the audit finding and check the process for dealing with incoming shipments relating to customer IT security

Answer

A. Ask the auditee to remove the labels, then carry on with the audit

Answer

B. Ask the ICT Manager to record an information security incident and initiate the information security incident management process

Answer

D. Raise a nonconformity against control 5.31 'Legal, staturary, regulatory and contractual requirements'

Answer

E. Raise a nonconformity against control 8.20 'network security' (networks and network devices shall be secured, managed and controlled to protect information in systems and applications)

Answer

F. Record what you have seen in your audit findings, but take no further action

Pre-Summer Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: validbest

Exam ISO-IEC-27001-Lead-Auditor All Questions

PECB ISO 27001 ISO-IEC-27001-Lead-Auditor Question # 42 Topic 5 Discussion

Correct Answer:

Options Selected by Other Users:

Contribute your Thoughts: