ISO-IEC-27001-LEAD-AUDITOR practice question 28 of 35

You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. You find all nursing home residents wear…

You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. You find all nursing home residents wear an electronic wristband for monitoring their location, heartbeat, and blood pressure always. You learned that the electronic wristband automatically uploads all data to the artificial intelligence (AI) cloud server for healthcare monitoring and analysis by healthcare staff. To verify the scope of ISMS, you interview the management system representative (MSR) who explains that the ISMS scope covers an outsourced data center. Select three options for the audit evidence you need to find to verify the scope of the ISMS.

Answer options

A: The auditee has identified the resident's needs and expectations on the facility and environmental safety

B: The auditee has ISO 9001 certification

C: The auditee has identified the governmental authorities' needs and expectations on healthcare services and patient data handling Correct answer

D: The auditee has identified the resident's needs and expectations on how they should protect the resident's personal data Correct answer

E: The auditee has identified the resident's needs and expectations on the comfort facility, medical professional's competence, and clean environment

F: The auditee has identified the resident's needs and expectations on healthcare medical treatment services

G: The IT service agreement with the data center where the artificial intelligence (AI) cloud server is located Correct answer

H: The auditee is considering the purchase of a healthcare monitoring app from an external software company

Correct Answer:

C. The auditee has identified the governmental authorities' needs and expectations on healthcare services and patient data handling; D. The auditee has identified the resident's needs and expectations on how they should protect the resident's personal data; G. The IT service agreement with the data center where the artificial intelligence (AI) cloud server is located

Explanation

To verify the ISMS scope, an auditor must check that the organization has considered the requirements of interested parties (Clause 4.2) and its interfaces and dependencies (Clause 4.3). Governmental authorities (C) and residents (D) are key interested parties whose requirements regarding data handling and privacy must be considered. The IT service agreement with the outsourced data center (G) is crucial evidence of how the organization defines and controls the interfaces and dependencies with an external provider that is explicitly included in the scope.

Why Incorrect

A. Facility and environmental safety are typically outside the scope of an ISMS, relating more to physical safety or quality management.
B. An ISO 9001 certification is for a different management system (quality) and is not direct evidence for the ISMS scope.
E. Comfort, staff competence, and cleanliness are aspects of service quality (ISO 9001), not information security.
F. Medical treatment services are the core business function, but the ISMS scope focuses on the security of the information related to those services.
H. Considering a future purchase is not evidence of the current, implemented ISMS scope.

References

1. ISO/IEC 27001:2022, Clause 4.3, "Determining the scope of the information security management system": This clause requires the scope determination to consider "the requirements of interested parties referred to in 4.2" and "interfaces and dependencies between activities performed by the organization, and those that are performed by other organizations."

2. ISO/IEC 27001:2022, Clause 4.2, "Understanding the needs and expectations of interested parties": This requires identifying interested parties (e.g., customers/residents, government bodies) and their relevant requirements.

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House. Chapter 4 explains that evidence for scope includes contracts and SLAs with third parties (like data centers) that fall within the ISMS boundaries.

Keep practicing

Take the free ISO-IEC-27001-LEAD-AUDITOR practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test