Câu 14: Lead Auditor: ISO/IEC 27001 Lead Auditor

You are performing an ISO 27001 ISMS surveillance audit at a residential nursing home, ABC Healthcare Services. ABC uses a healthcare mobile app designed and maintained by a supplier, WeCare, to monitor residents' well-being. During the audit, you learn that 90% of the residents' family members regularly receive medical device advertisements from WeCare, by email and SMS once a week. The service agreement between ABC and WeCare prohibits the supplier from using residents' personal data. ABC has received many complaints from residents and their family members. The Service Manager says that the complaints were investigated as an information security incident which found that they were justified. Corrective actions have been planned and implemented according to the nonconformity and corrective action management procedure. You write a nonconformity "ABC failed to comply with information security control A.5.34 (Privacy and protection of PII) relating to the personal data of residents' and their family members. A supplier, WeCare, used residents' personal information to send advertisements to family members."Select three options of the corrections and corrective actions listed that you would expect ABC to make in response to the nonconformity. (Choose three.)

1. A. ABC asks an ISMS consultant to test the ABC Healthcare mobile app for protection against cyber-crime.
2. B. ABC cancels the service agreement with WeCare. — đáp án hiện tại
3. C. ABC confirms that information security control A.5.34 is contained in the Statement of Applicability (SoA).
4. D. ABC discontinues the use of the ABC Healthcare mobile app.
5. E. ABC introduces background checks on information security performance for all suppliers. — đáp án hiện tại
6. F. ABC periodically monitors compliance with all applicable legislation and contractual requirements involving third parties. — đáp án hiện tại
7. G. ABC takes legal action against WeCare for breach of contract.
8. H. ABC trains all stiff on the importance of maintaining information security protocols.