Câu 27: Lead Auditor: ISO/IEC 27001 Lead Auditor

You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. The next step in your audit plan is to verity the information security of ABC's healthcare mobile app development, support, and lifecycle process. During the audit, you learned the organization outsourced the mobile app development to a professional software development organization with CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS (ISO 22301) and ISMS (ISO/IEC 27001) certified. The IT Manager presents the software security management procedure and summarises the process as follows:The mobile app development shall adopt "security-by-design" and "security-by-default" principles, as a minimum. The following security functions for personal data protection shall be available:Access control. Personal data encryption, i.e., Advanced Encryption Standard (AES) algorithm, key lengths: 256 bits; andPersonal data pseudonymization. Vulnerability checked and no security backdoorYou sample the latest Mobile App Test report - Reference ID: 0098, details as follows: You would like to investigate other areas further to collect more audit evidence. Select three options that will not be in your audit trail. (Choose three.)

1. A. Collect more evidence by downloading and testing the mobile app on your phone. (Relevant to control A.8.1) — đáp án hiện tại
2. B. Collect more evidence to determine the number of users of ABC's healthcare mobile app. (Relevant to clause 4.2)
3. C. Collect more evidence on how much residents' family members pay to install ABC's healthcare mobile app. (Relevant to clause 4.2) — đáp án hiện tại
4. D. Collect more evidence on how the developer trains its product support personnel. (Relevant to clause 7.2)
5. E. Collect more evidence on how the organization manages information security in the selection of an external service provider. (Relevant to control A.5.19)
6. F. Collect more evidence on how the organization performs testing of personal data handling. (Relevant to control A.5.34)
7. G. Collect more evidence on the organization's business continuity policy. (Relevant to control A.5.30) — đáp án hiện tại
8. H. Collect more evidence to verify the developer's CMMI Level 5, ITSM (ISO/IEC 20000-1), BCMS (ISO 22301) and ISMS (ISO/IEC 27001) certification. (Relevant to control A.5.21)