PECB ISO-IEC-27001-Lead-Implementer Exam With Confidence Using Practice Dumps

According to ISO/IEC 17021-1:2015 (which provides the requirements for bodies providing audit and certification of management systems and is referenced by ISO/IEC 27001 audits), clients do not have the right to request or conduct background checks on auditors provided by an accredited certification body, except for potential conflicts of interest or impartiality concerns, which must be disclosed. The certification body is responsible for ensuring the competence, integrity, and impartiality of its auditors.

It is best practice for the certification body to evaluate audit findings and make certification decisions (C).

It is perfectly acceptable and encouraged for organizations to apply for a combined audit for integrated management systems, such as ISO 9001 and ISO/IEC 27001 (B).

Notifying the certification body of a conflict of interest is a best practice and required for audit impartiality (D).

Requesting background checks beyond verifying competence, impartiality, and conflict of interest is NOT aligned with auditing best practices (A), and it is proper for the certification body to deny such a request.

Relevant Extracts:

ISO/IEC 17021-1:2015, Clause 9.2.2.2: “The certification body shall select audit team members and technical experts that, collectively, have the necessary competence for the audit. The certification body shall not provide information that compromises confidentiality or privacy.”

ISO/IEC 27001:2022 Implementation Guidance, auditing section: “Certification bodies ensure the independence and competence of auditors and maintain impartiality. Organizations may raise concerns about impartiality or conflicts of interest, but certification bodies manage personnel records and background information in accordance with confidentiality requirements.”

According to ISO/IEC 27002:2022, information security is based on the principles of confidentiality, integrity, and availability (CIA). Confidentiality refers to preventing unauthorized disclosure, integrity ensures information accuracy and trustworthiness, and availability ensures information is accessible when needed.

In this case:

Confidentiality was compromised when the sensitive email was mistakenly sent to the competitor.

The integrity was violated when the competitor altered the proprietary data to mislead clients.

This directly aligns with the definitions in ISO/IEC 27002:2022, clause 3.1.7 (Confidential Information) and 3.1.13 (Information Security Breach).

ISO/IEC 27001:2022 is the certifiable standard for Information Security Management Systems (ISMS). While ISO/IEC 27002 provides guidelines and best practices to help organizations implement the controls listed in Annex A of ISO/IEC 27001, it is not mandatory to follow ISO/IEC 27002 to achieve ISO/IEC 27001 certification. Instead, organizations must select and implement appropriate controls from Annex A, or other controls as necessary, based on their risk assessment. ISO/IEC 27002 serves as guidance but is not itself an auditable or certifiable requirement.

"The controls listed in Annex A are not exhaustive and additional controls may be needed. ISO/IEC 27002 provides implementation guidance and is not mandatory for certification against ISO/IEC 27001."

— ISO/IEC 27001:2022, Introduction and Clause 6.1.3; ISO/IEC 27002:2022, Foreword