Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

PECB Exam ISO-IEC-27001-Lead-Auditor Topic 1 Question 37 Discussion

Actual exam question for PECB's ISO/IEC 27001 Lead Auditor exam
Question #: 37
Topic #: 1
[All ISO/IEC 27001 Lead Auditor Questions]

You are performing an ISMS audit at a residential nursing home that provides healthcare services. The next step in your audit plan is to verify the information security of the business continuity management process. During the audit, you learned that the organisation activated one of the business continuity plans (BCPs) to make sure the nursing service continued during the recent pandemic. You ask Service Manager to explain how the organisation manages information security during the business continuity management process.

The Service Manager presents the nursing service continuity plan for a pandemic and summarises the process as

follows:

Stop the admission of any NEW residents.

70% of administration staff and 30% of medical staff will work from home.

Regular staff self-testing including submitting a negative test report 1 day BEFORE they come to the office.

Install ABC's healthcare mobile app, tracking their footprint and presenting a GREEN Health Status QR-Code for checking

on the spot.

You ask the Service Manager how to prevent non-relevant family members or interested parties from accessing residents' personal data when staff work from home. The Service Manager cannot answer and suggests the n" Security Manager should help with that.

You would like to further investigate other areas to collect more audit evidence Select three options that will be in your audit trail.

Show Suggested Answer Hide Answer
Suggested Answer: A, E, F

According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), control A.5.29 requires an organization to establish and maintain a business continuity management process to ensure the continued availability of information and information systems at the required level following disruptive incidents1.The organization should identify and prioritize critical information assets and processes, assess the risks and impacts of disruptive incidents, develop and implement business continuity plans (BCPs), test and review the BCPs, and ensure that relevant parties are aware of their roles and responsibilities1. Therefore, when verifying the information security of the business continuity management process, an ISMS auditor should verify that these aspects are met in accordance with the audit criteria.

Three options that will be in the audit trail for verifying control A.5.29 are:

Collect more evidence on how the organisation manages information security on mobile devices and during teleworking (Relevant to control A.6.7): This option is relevant because it can provide evidence of how the organization has implemented appropriate controls to protect the confidentiality, integrity and availability of information and information systems when staff work from home using mobile devices, such as laptops, tablets or smartphones.This is related to control A.6.7, which requires an organization to establish a policy and procedures for teleworking and use of mobile devices1.

Collect more evidence on how and when the Business Continuity Plan has been tested (Relevant to control A.5.29): This option is relevant because it can provide evidence of how the organization has tested and reviewed the BCPs to ensure their effectiveness and suitability for different scenarios, such as a pandemic.This is related to control A.5.29, which requires an organization to test and review the BCPs at planned intervals or when significant changes occur1.

Collect more evidence on how the organisation makes sure only staff with a negative test result can enter the organisation (Relevant to control A.7.2): This option is relevant because it can provide evidence of how the organization has implemented appropriate controls to prevent or reduce the risk of infection or transmission of diseases among staff or residents, such as requiring regular staff self-testing and using a health status app.This is related to control A.7.2, which requires an organization to ensure that all employees and contractors are aware of information security threats and concerns, their responsibilities and liabilities, and are equipped to support organizational policies and procedures in this respect1.

The other options are not relevant to verifying control A.5.29, as they are not related to the control or its requirements. For example:

Collect more evidence by interviewing more staff about their feeling about working from home (Relevant to clause 4.2): This option is not relevant because it does not provide evidence of how the organization has established and maintained a business continuity management process or ensured the continued availability of information and information systems following disruptive incidents. It may be related to clause 4.2, which requires an organization to understand the needs and expectations of interested parties, but not specifically to control A.5.29.

Collect more evidence on what resources the organisation provides to support the staff working from home (Relevant to clause 7.1): This option is not relevant because it does not provide evidence of how the organization has established and maintained a business continuity management process or ensured the continued availability of information and information systems following disruptive incidents. It may be related to clause 7.1, which requires an organization to determine and provide the resources needed for its ISMS, but not specifically to control A.5.29.

Collect more evidence on how the organisation performs a business risk assessment to evaluate how fast the existing residents can be discharged from the nursing home (Relevant to clause 6): This option is not relevant because it does not provide evidence of how the organization has established and maintained a business continuity management process or ensured the continued availability of information and information systems following disruptive incidents. It may be related to clause 6, which requires an organization to plan actions to address risks and opportunities for its ISMS, but not specifically to control A.5.29.


Contribute your Thoughts:

Jamika
4 months ago
Hey, did you hear about the nursing home that accidentally sent out residents' personal data to the whole town? Yikes, we don't want that happening here!
upvoted 0 times
Marguerita
3 months ago
Good idea, we should also gather evidence on how the organisation makes sure only staff with a negative test result can enter the organisation.
upvoted 0 times
...
Lamar
3 months ago
Let's collect more evidence on how the organisation manages information security on mobile devices and during teleworking.
upvoted 0 times
...
Rosio
3 months ago
The Security Manager should help with that.
upvoted 0 times
...
Blythe
3 months ago
How do we prevent non-relevant people from accessing residents' personal data when staff work from home?
upvoted 0 times
...
...
Francine
4 months ago
Only letting in staff with a negative test result? That's like a sickness bouncer at the door. Gotta make sure it's working properly!
upvoted 0 times
Graciela
3 months ago
You: Lastly, I will gather evidence on ensuring only staff with a negative test result can enter the organisation.
upvoted 0 times
...
Deandrea
3 months ago
You: I will also collect evidence on how the Business Continuity Plan has been tested.
upvoted 0 times
...
Genevive
3 months ago
You: I will collect more evidence on managing information security on mobile devices and during teleworking.
upvoted 0 times
...
Elden
3 months ago
Service Manager: The Security Manager can help with that.
upvoted 0 times
...
Ivette
3 months ago
You: How do you prevent non-relevant people from accessing residents' data when staff work from home?
upvoted 0 times
...
Nan
3 months ago
Service Manager: We also have staff working from home and doing self-testing.
upvoted 0 times
...
Caitlin
4 months ago
Service Manager: We have a plan to stop new residents from coming in during a pandemic.
upvoted 0 times
...
...
Erasmo
4 months ago
Ooh, testing the business continuity plan? Now that's a juicy one. Bet there's some good stuff to uncover there.
upvoted 0 times
...
Sena
4 months ago
Gotta make sure the staff feel comfortable and supported while working from home. Their well-being is crucial during these times.
upvoted 0 times
Elise
3 months ago
F) Collect more evidence on how the organisation makes sure only staff with a negative test result can enter the organisation (Relevant to control A.7.2)
upvoted 0 times
...
Stephaine
3 months ago
C) Collect more evidence on what resources the organisation provides to support the staff working from home. (Relevant to clause 7.1)
upvoted 0 times
...
Glory
4 months ago
A) Collect more evidence on how the organisation manages information security on mobile devices and during teleworking (Relevant to control A.6.7)
upvoted 0 times
...
...
Christiane
5 months ago
I agree with you, Shawnda. It's crucial to ensure that sensitive data is protected, especially when staff are working remotely.
upvoted 0 times
...
Magda
5 months ago
Hmm, definitely need to look at the security of those mobile devices and teleworking. Can't have sensitive data getting out, you know.
upvoted 0 times
Malcolm
3 months ago
You: I will also investigate how the Business Continuity Plan has been tested and ensure only staff with negative test results can enter.
upvoted 0 times
...
Helga
3 months ago
You: I will collect more evidence on managing information security on mobile devices and during teleworking.
upvoted 0 times
...
Reiko
3 months ago
Service Manager: The Security Manager can help with that.
upvoted 0 times
...
Isaac
3 months ago
You: How do you prevent non-relevant parties from accessing residents' data when staff work from home?
upvoted 0 times
...
Denise
3 months ago
Service Manager: Stop admission of new residents, staff work from home, and use a healthcare mobile app for tracking.
upvoted 0 times
...
Carol
3 months ago
Service Manager: We activated the BCP during the pandemic to ensure nursing service continued.
upvoted 0 times
...
Dottie
3 months ago
You: And let's look into how the organisation ensures only staff with negative test results can enter.
upvoted 0 times
...
Nadine
4 months ago
You: Let's also gather evidence on how the Business Continuity Plan has been tested.
upvoted 0 times
...
Jacquelyne
4 months ago
You: Let's collect more evidence on managing information security on mobile devices and during teleworking.
upvoted 0 times
...
Irma
4 months ago
Service Manager: The Security Manager can help with that.
upvoted 0 times
...
Salome
4 months ago
You: How do you prevent non-relevant people from accessing residents' data when staff work from home?
upvoted 0 times
...
Margo
4 months ago
F) Collect more evidence on how the organisation makes sure only staff with a negative test result can enter the organisation (Relevant to control A.7.2)
upvoted 0 times
...
Aliza
4 months ago
Service Manager: We activated the BCP during the pandemic to keep the nursing service running.
upvoted 0 times
...
Veronica
4 months ago
E) Collect more evidence on how and when the Business Continuity Plan has been tested. (Relevant to control A.5.29)
upvoted 0 times
...
Levi
4 months ago
A) Collect more evidence on how the organisation manages information security on mobile devices and during teleworking (Relevant to control A.6.7)
upvoted 0 times
...
...
Shawnda
5 months ago
I think we should focus on option A, to gather more evidence on how information security is managed on mobile devices and during teleworking.
upvoted 0 times
...

Save Cancel