These two options are not required for audit planning of a certification audit, as they are not relevant

to the audit objectives, scope, criteria, and methods. The working experience of the management

system representative is not a requirement of ISO/IEC 27001, nor does it affect the conformity or

effectiveness of the ISMS. The organisation’s financial statement is not part of the ISMS

documentation, nor does it provide evidence of the ISMS performance or improvement. The other

options are required for audit planning, as they help to determine the audit activities, resources,

schedule, and sampling strategy. Reference: PECB Candidate Handbook1, page 19-20; ISO 9001

Auditing Practices Group Guidance on2, page 1-2; ISO/IEC 27001:2022 (en)3, clause 9.2.

Jack collected mathematical evidence when he identified nonconformities by comparing the number

of purchased invoices for software licenses with the software inventory. This type of evidence

involves numerical, quantifiable data that highlights discrepancies and supports findings of

compliance or non-compliance.

Reference: ISO/IEC 27001:2013 Standard, general guidelines on auditing

The following statements are true:

The role of a certification body auditor involves evaluating the organization’s processes for ensuring

compliance with their legal requirements. This is part of the auditor’s responsibility to assess the

effectiveness and conformity of the organization’s ISMS against the ISO/IEC 27001:2022 standard and

the applicable legal and regulatory requirements.

During a third-party audit, the auditor evaluates how the organization ensures that they are made

aware of changes to the legal requirements. This is part of the auditor’s responsibility to verify that

the organization has established and maintained a process for identifying and updating their legal

and other requirements related to information security. The following statement is false:

As part of a certification body audit, the auditor is responsible for verifying the organization’s legal

compliance status. This is not true, as the auditor is not authorized or qualified to provide legal

advice or judgment on the organization’s compliance status. The auditor can only report on the

evidence of compliance or noncompliance observed during the audit, but the ultimate responsibility

for ensuring legal compliance lies with the organization. Reference: : CQI & IRCA ISO 27001:2022

Lead Auditor Course Handbook, page 66. : CQI & IRCA ISO 27001:2022 Lead Auditor Course

Handbook, page 67. : ISO/IEC 27001 LEAD AUDITOR - PECB, page 22.

Phishing is a type of information security incident that falls under the category of cracker/hacker

attacks. Phishing is a form of fraud that uses deceptive emails or other messages to trick recipients

into revealing sensitive information, such as passwords, credit card numbers, bank account details,

etc. Phishing emails often impersonate legitimate organizations or individuals and create a sense of

urgency or curiosity to lure the victims into clicking on malicious links, opening malicious

attachments or providing personal information. Phishing is a common and serious threat to

information security, as it can lead to identity theft, financial loss, data breach, malware infection or

other damages. ISO/IEC 27001:2022 requires the organization to implement awareness and training

programs to make users aware of the risks of social engineering attacks, such as phishing, and how to

avoid them (see clause A.7.2.2). Reference: CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor

Training Course, ISO/IEC 27001:2022 Information technology — Security techniques — Information

security management systems — Requirements, What is Phishing?

Confidentiality is one of the principles of audit conduct that auditors should adhere to when

performing audits. Confidentiality means that auditors should exercise discretion in the use and

protection of information acquired in the course of their duties3. Auditors should respect the

intellectual property rights of the auditee and other parties involved in the audit, and should not

disclose any information that is sensitive, proprietary, or confidential without prior approval from the

auditee or other authorized parties3. Auditors should also obtain the auditee’s permission before

using a camera or recording equipment during an audit, as these devices may capture confidential

information or infringe on the privacy of individuals3. Therefore, these two options correctly state

the function of confidentiality in an audit. The other options are either incorrect or irrelevant to

confidentiality. For example, auditors are not forced by regulatory requirements to maintain

confidentiality in an audit, but rather by ethical obligations and contractual agreements3. Observers

in an audit team can access confidential information if they have signed a confidentiality agreement

and have been authorized by the auditee3. Audit information can be used for improving personal

competence by the auditor only if it does not compromise confidentiality or conflict with other

interests3. As an auditor is always accompanied by a guide, there is still a risk to the auditee’s

sensitive information if the guide is not trustworthy or authorized to access such

information3. Reference: ISO 19011:2018 - Guidelines for auditing management systems

According to ISO 27001:2022 Annex A Control 8.30, the organisation shall ensure that externally

provided processes, products or services that are relevant to the information security management

system are controlled. This includes developing and entering into licensing agreements that cover

code ownership and intellectual property rights, and implementing appropriate contractual

requirements related to secure design and coding in accordance with Annex A 8.25 and 8.2912

In this case, the organisation and the developer have performed security tests that failed, which

indicates that the secure design and coding requirements of Annex A 8.29 were not met. The IT

Manager explains that the encryption and pseudonymization functions failed because they slowed

down the system and service performance, and that an extra 150% of resources are needed to cover

this. However, this does not justify the acceptance of the test results by the Service Manager, who is

not authorised to approve the test according to the software security management procedure. The

Service Manager should have consulted with the IT Manager, who is the owner of the process, and

followed the procedure for handling nonconformities and corrective actions. The Service Manager’s

decision to continue the service based on access control alone exposes the organisation to the risk of

compromising the confidentiality, integrity, and availability of personal data processed by the mobile

app. Therefore, there is a nonconformity (NC) with clause 8.1, control A.8.30.

According to ISO 27001:2022 Clause 8.1, the organisation shall plan, implement and control the

processes needed to meet information security requirements, and to implement the actions

determined in Clause 6.1. The organisation shall also control planned changes and review the

consequences of unintended changes, taking action to mitigate any adverse effects, as necessary12

In this case, the organisation has not controlled the planned change of the mobile app from version

1.0 to version 1.01, which was a minor update provided by the outsourced developer in response to

frequent ransomware attacks. The IT Manager explains that the developer performed an emergency

release of the updated software, and gave a verbal guarantee that there will be no impact on any

security functions. However, this is not sufficient to ensure that the change is properly assessed,

tested, documented, and approved before deployment. The IT Manager should have followed the

change management process and procedure, and verified that the updated software meets the

security requirements and does not introduce any new vulnerabilities or risks. The IT Manager’s

reliance on his 20 years of information security experience and the developer’s verbal guarantee is

not a valid basis for skipping the re-testing of the software. Therefore, there is a nonconformity (NC)

with clause 8.1.

Reference:

1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Course by CQI and

IRCA Certified Training 1 2: ISO/IEC 27001 Lead Auditor Training Course by PECB 2

Vehicular incidents are not a type of information security attack. A vehicular incident is an event that

involves a vehicle or its driver causing damage or injury to people or property. A vehicular incident

may have an impact on information security if it affects the availability or integrity of information or

systems that are transported or accessed by vehicles, but it is not an intentional or malicious attack

on information security. Legal incidents are a type of information security attack that involve legal

actions or disputes that may compromise the confidentiality or integrity of information or systems.

Technical vulnerabilities are a type of information security attack that exploit weaknesses or flaws in

software or hardware that may compromise the confidentiality, integrity, or availability of

information or systems. Privacy incidents are a type of information security attack that involve

unauthorized access or disclosure of personal or sensitive information that may compromise the

confidentiality or integrity of information or systems. Reference: : CQI & IRCA ISO 27001:2022 Lead

Auditor Course Handbook, page 25. : [ISO/IEC 27001 LEAD AUDITOR - PECB], page 13.

According to ISO/IEC 27001:2022, which specifies the requirements for establishing, implementing,

maintaining and continually improving an information security management system (ISMS), clause

8.1 requires an organization to plan, implement and control its processes needed to meet ISMS

requirements2. This includes determining what needs to be done, how it will be done, who will do it,

when it will be done, what resources are required, how performance will be evaluated, etc2.

Therefore, if an ISMS auditor conducting a third-party surveillance audit of a telecom’s provider

notes that there has been a significant increase in the number of switches failing their initial

configuration test and being returned for reprogramming due to a recent ISMS upgrade that reduced

access to work instructions, this indicates a nonconformity against clause 8.1 of ISO/IEC

27001:2022. The organization has failed to plan and control its operational processes effectively to

ensure information security and quality2. The other options are not correct clauses to raise a

nonconformity against based solely on this information. For example, clause 7.5 deals with

documented information required by ISMS or determined by an organization as necessary for its

effectiveness2, but it does not specify how many copies or formats of work instructions should be

available; clause 10.2 deals with nonconformity and corrective action as a response to an identified

problem or incident2, but it does not address how to prevent or avoid such problems or incidents in

operational processes; clause 7.3 deals with awareness of ISMS policy, objectives, roles and

responsibilities among persons doing work under an organization’s control2, but it does not relate to

how work instructions are accessed or followed; clause 7.2 deals with competence of persons doing

work under an organization’s control that affects its ISMS performance2, but it does not imply that

lack of competence is caused by insufficient work instructions; clause 7.4 deals with communication

about ISMS among internal and external interested parties2, but it does not cover how operational

information is communicated within an organization. Reference: ISO/IEC 27001:2022 - Information

technology – Security techniques – Information security management systems – Requirements

Audit methods are techniques used by auditors to obtain audit evidence. Audit methods can be

classified into two categories: those that involve human interaction and those that do not2. Audit

methods that involve human interaction require direct communication between the auditor and the

auditee or other relevant parties, such as interviews, questionnaires, surveys, meetings, etc. Audit

methods that do not involve human interaction rely on observation, inspection, measurement,

testing, sampling, analysis, etc., without requiring any verbal or written exchange2. Therefore,

performing an independent review of procedures in preparation for an audit and reviewing the

auditee’s response to an audit finding are examples of audit methods that involve human

interaction, as they require reading and evaluating documents provided by the auditee or other

sources. On the other hand, analysing data by remotely accessing the auditee’s server and observing

work performed by remote surveillance are examples of audit methods that do not involve human

interaction, as they do not require any direct communication with the auditee or other

parties. Reference: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) |

CQI | IRCA

The difference between a restricted and confidential document is that a restricted document is to be

shared among named individuals, while a confidential document is to be shared among an

authorized group. Restricted and confidential are examples of information classification levels that

indicate the sensitivity and value of information and the degree of protection required for it.

Restricted documents contain information that could cause serious damage or harm to the

organization or its stakeholders if disclosed to unauthorized persons. Therefore, they should only be

accessed by specific individuals who have a legitimate need to know and are authorized by the

information owner. Confidential documents contain information that could cause damage or harm to

the organization or its stakeholders if disclosed to unauthorized persons. Therefore, they should only

be accessed by a defined group of people who have a legitimate need to know and are authorized by

the information owner. ISO/IEC 27001:2022 requires the organization to classify information in terms

of legal requirements, value, criticality and sensitivity to unauthorized disclosure or modification (see

clause A.8.2.1). Reference: CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training

Course, ISO/IEC 27001:2022 Information technology — Security techniques — Information security

management systems — Requirements, What is Information Classification?