Free ISO-27001-LA Web TestEngine Demo

Q50 Multiple choice

You are an experienced ISMS audit team leader conducting a third-party surveillance audit of an internet services provider. You are reviewing the organization's risk assessment processes for conformity with
ISO /IEC 27001:2022.

Which three of the following audit findings would prompt you to raise a nonconformity report?

Select all that apply.

A
Both systems contain additional information security risks which are not associated with preserving the
confidentiality, integrity and accessibility of information
B
The organisation is treating information security risks in the order in which they are identified
C
The organisation's information security risk assessment process suggests each risk is allocated a risk owner
D
The organisation has not used RAG (Red, Amber, Green) to classify its' information security risks.Instead, it has used a smiling emoji, a neutral face emoji and a sad face emoji
E
The organisation's risk assessment criteria have not been reviewed and approved by top management
F
The organisation's information security risk assessment process is based solely on an assessment of the impact of each risk
G
The organisation has assessed the probability of all of its information security risks as either 0%, 25%, 50%, 75% or 100%
H
There is a different system in place for assessing operational information security risks and for
assessing strategic information security risks

ISO-27001-LA Web TestEngine demo