You are working for a company as the CISO. Your company decided to go for the ISO 27001 certification. After six months of preparation, the external audit by a certain certification body is scheduled for next Monday. If your company passes the audit, it will receive the ISO 27001 certificate. Which of the following is the least common activity conducted by the external auditors?
A. Invite senior management for meeting
B. Consult subject matter experts
C. Conduct penetration testing to validate the security controls
D. Ask for documents before on-site auditing
Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.
My suggested answer is C. Conduct penetration testing to validate the security controls.
ISO 27001 is the requirements for Information security management systems (ISMS).
An ISMS may be certified compliant with ISO/IEC 27001 by a number of Accredited Registrars worldwide. Certification against any of the recognized national variants of ISO/IEC 27001 (e.g. JIS Q 27001, the Japanese version) by an accredited certification body is functionally equivalent to certification against ISO/IEC 27001 itself.
In some countries, the bodies that verify conformity of management systems to specified standards are called “certification bodies”, while in others they are commonly referred to as “registration bodies”, “assessment and registration bodies”, “certification/ registration bodies”, and sometimes “registrars”.
The ISO/IEC 27001 certification, like other ISO management system certifications, usually involves a three-stage external audit process defined by the ISO/IEC 17021 and ISO/IEC 27006 standards:
Stage 1 is a preliminary, informal review of the ISMS, for example checking the existence and completeness of key documentation such as the organization’s information security policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP). This stage serves to familiarize the auditors with the organization and vice versa.
Stage 2 is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation (for example by confirming that a security committee or similar management body meets regularly to oversee the ISMS). Certification audits are usually conducted by ISO/IEC 27001 Lead Auditors. Passing this stage results in the ISMS being certified compliant with ISO/IEC 27001.
Ongoing involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually but (by agreement with management) are often conducted more frequently, particularly while the ISMS is still maturing.
It’s common for auditors to interview with the top management or management representative to audit the leadership and commitment, information security policy, and organizational roles, responsibilities and authorities.
Subject Matter Expert
During an audit, if an audit team does not have sufficient knowledge when auditing a complex issue they often call upon subject matter experts to provide advice.
Stage 1 is a preliminary, informal review of the ISMS, for example checking the existence and completeness of key documentation.
Penetration Testing is conducted to identify and analyze risks. To validate if risk management is implemented and compliant to the requirements of the standard, it is not necessary to conduct penetration testing. Besides, penetration testing needs more planning work to avoid disrupting the production systems and may cause legal ramifications. It’s rare for certification bodies to conduct penetration testing in the certification audit.