ISO-IEC-27001-LEAD-IMPLEMENTER practice question 7 of 35

Scenario 7: CyTekShield CyTekShield based in Dublin. Ireland, is a cybersecurity consulting provider specializing in digital risk management and…

Full set: 290 questions

Domain Implementing an ISMS based on ISO/IEC 27001

Scenario 7: CyTekShield CyTekShield based in Dublin. Ireland, is a cybersecurity consulting provider specializing in digital risk management and enterprise security solutions. After facing multiple security incidents. CyberTekShield formed expanded its information security team by bringing in Sadie and Niamh as part of the team. This team is structured into three key divisions: incident response, security architecture and forensics Sadie will separate the demilitarized zone from CyTekShield's private network and publicly accessible resources, as part of implementing a screened subnet network architecture. In addition, Sadie will carry out comprehensive evaluations of any unexpected incidents, analyzing their causes and assessing their potential impact. She also developed security strategies and policies. Whereas Niamh. a specialized expert in forensic investigations, will be responsible for creating records of different data for evidence purposes To do this effectively, she first reviewed the company's information security incident management policy, which outlines the types of records to be created, their storage location, and the required format and content for specific record types. To support the process of handling of evidence related to information security events. CyTekShield has established internal procedures. These procedures ensure that evidence is properly identified, collected, and preserved within the company CyTekShield's procedures specify how to handle records in various storage mediums, ensuring that all evidence is safeguarded in its original state, whether the devices are powered on or off. As part of CyTekShield's initiative to strengthen information security measures, Niamh will conduct information security risk assessments only when significant changes are proposed and will document the results of these risk assessments Upon completion of the risk assessment process, Niamh is responsible to develop and implement a plan for treating information security risks and document the risk treatment results. Furthermore, while implementing the communication plan for information security, the CyTekShield's top management was responsible for creating a roadmap for new product development. This approach helps the company to align its security measures with the product development efforts, demonstrating a commitment to integrating security into every aspect of its business operations.CyTekShield uses a cloud service model that includes cloud-based apps accessed through the web or an application programming interface (API). All cloud services are provided by the cloud service provider, while data is managed by CyTekShield This introduces unique security considerations and becomes a primary focus for the information security team to ensure data and systems are protected in this environment.CyTekShield uses a cloud service model that includes cloud-based apps accessed through the web or an application programming interface (API). All cloud services are provided by the cloud service provider, while data is managed by CyTekShield This introduces unique security considerations and becomes a primary focus for the information security team to ensure data and systems are protected in this environment. Has CyTekShield appropriately addressed the handling of evidence related to information security events?
Answer options
A: No – as it does not include proper training for staff involved in evidence handling
B: Yes – it has appropriately addressed the handling of evidence Correct answer
C: No – because the process of evidence acquisition was not fully detailed
Correct Answer:
B. Yes – it has appropriately addressed the handling of evidence
Explanation

The scenario indicates that CyTekShield has appropriately addressed the handling of evidence. It explicitly states the company has "established internal procedures" to ensure evidence is "properly identified, collected, and preserved." These procedures cover various storage mediums and the safeguarding of evidence in its original state. Furthermore, a "specialized expert in forensic investigations" (Niamh) is responsible for this process, and the company's incident management policy details the types, storage, format, and content of records. This structured approach, led by a competent professional and supported by formal policy and procedure, directly aligns with the control objectives for evidence collection within an Information Security Management System (ISMS).

Why Incorrect

A. No – as it does not include proper training for staff involved in evidence handling The scenario implies competence by stating a "specialized expert in forensic investigations" is responsible. The presence of an expert leading the process addresses the need for skilled handling of evidence.
C. No – because the process of evidence acquisition was not fully detailed The scenario confirms that procedures for evidence "collection" (acquisition) exist. A summary scenario is not expected to contain the full, step-by-step procedural document, but it confirms the process is formally established. ---

References

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Reference: Annex A, Control A.5.28 "Collection of evidence". This control requires the organization to "establish and implement procedures for the identification, collection, acquisition and preservation of evidence related to information security events." The actions described for CyTekShield directly map to implementing this control.

2. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Reference: Section 5.28 "Collection of evidence". The implementation guidance for this control advises that procedures should be defined and should ensure the integrity and authenticity of collected evidence. CyTekShield's approach of safeguarding evidence "in its original state" and having a forensics expert manage the process aligns with this guidance.

3. PECB Group Inc. (2022). ISO/IEC 27001 Lead Implementer Training Course Material.

Reference: Module: "Annex A Controls". The courseware explains that control A.5.28 is satisfied by creating and maintaining formal procedures for evidence handling to ensure it is admissible in legal or disciplinary proceedings. CyTekShield's documented internal procedures and policies fulfill this requirement.

4. Rowlingson, R. (2004). A ten step process for forensic readiness. International Journal of Digital Evidence, 2(3), 1-28.

Reference: This foundational academic paper on forensic readiness outlines the necessity of having pre-defined procedures for evidence collection and preservation before an incident occurs. CyTekShield's proactive establishment of internal procedures aligns with this principle, demonstrating appropriate handling.

Scroll to Top